536647 - Crash after clicking on link in Google Maps [@ XPC_XOW_AddProperty ][@ _ZL19XPC_XOW_AddPropertyP9JSContextP8JSObjectiPi ]

Status: VERIFIED DUPLICATE of bug 536562

Description

[Michael]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.3a1pre) Gecko/20091223 Minefield/3.7a1pre
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.3a1pre) Gecko/20091223 Minefield/3.7a1pre

Go to Google Maps, enter Blackfriars Bridge in the search box.  Click on the link that appears:

Did you mean:
Blackfriars Bridge near England, United Kingdom

Browser crashes immediately.

Reproducible: Always

Steps to Reproduce:
1.Go to Google Maps (see url above)
2. Enter Blackfriars Bridge
3. Click on "Did you mean:" link:

Blackfriars Bridge near England, United Kingdom

which has the url:
http://maps.google.com/maps?source=s_q&hl=en&geocode=&q=Blackfriars+Bridge&vps=1&jsv=196c&sll=38.544974,-121.755598&sspn=0.019031,0.014226&ie=UTF8&hq=Blackfriars+Bridge+loc:&radius=15000.000000&split=1

4. Browser crashes.
Actual Results:  
Browser crashes every time.

Expected Results:  
Browser never crashes

Comment 1

[Noah (NoahSUMO/SolidSnake) [:Noah]]

Did you submit the crash report? If you did, please copy and paste the link from about:crashes here.

That will offer more information on what may be responsible for the crash.

Step by step guide on viewing crash reports [in case you need it]:
https://support.mozilla.com/en-US/kb/Mozilla+Crash+Reporter#Viewing_crash_reports

Comment 2

[Dave Garrett]

Easily got a crash with a new profile in 3.7a1pre on Linux.
bp-833741d5-e82b-4c92-8d89-59e0c2091223
0  	libxul.so  	_ZL19XPC_XOW_AddPropertyP9JSContextP8JSObjectiPi  	 js/src/xpconnect/src/XPCCrossOriginWrapper.cpp:563
1 	libmozjs.so 	js_SetPropertyHelper 	js/src/jsobj.cpp:3790
2 	libmozjs.so 	js_Interpret 	js/src/jsops.cpp:1890
3 	libmozjs.so 	js_Invoke 	js/src/jsinterp.cpp:1384
4 	libmozjs.so 	js_InternalInvoke 	js/src/jsinterp.cpp:1439
5 	libmozjs.so 	JS_CallFunctionValue 	js/src/jsapi.cpp:5098
6 	libxul.so 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:2168
7 	libxul.so 	nsJSEventListener::HandleEvent 	dom/src/events/nsJSEventListener.cpp:228
...

I crash reliably after STR above and attempting to leave the page. (i.e. clicking a link on the page that goes elsewhere or closing the tab)

Please post your crash ID. I suspect you may have a different stack and signature if you get it on going to the page instead of leaving it as I do here.
https://developer.mozilla.org/en/How_to_get_a_stacktrace_for_a_bug_report

Might even be different crashes, but confirming for now nonetheless.

Comment 3

[Michael]

I have four crash reports for you:
bp-a9e75a9b-66e2-4b47-b4d1-10dcd2091223
bp-0ac162e9-11a7-4fcb-a235-034832091223
bp-bd9baf88-c222-44b1-939c-834b52091223
bp-282988d8-8120-4797-8c46-bd6b22091223

The first two are on trying to click on the link I indicted.  The last two are on trying to close the page, after Minefield relaunched and I asked to restore my previous open pages.

Comment 4

[Dave Garrett]

Yours:
bp-282988d8-8120-4797-8c46-bd6b22091223
0  	XUL  	XPC_XOW_AddProperty  	 js/src/xpconnect/src/XPCCrossOriginWrapper.cpp:563
1 	libmozjs.dylib 	js_SetPropertyHelper 	js/src/jsobj.cpp:3790
2 	libmozjs.dylib 	js_Interpret 	js/src/jsops.cpp:1890
3 	libmozjs.dylib 	js_Invoke 	js/src/jsinterp.cpp:1384
4 	libmozjs.dylib 	js_InternalInvoke 	js/src/jsinterp.cpp:1439
5 	libmozjs.dylib 	JS_CallFunctionValue 	js/src/jsapi.cpp:5098
6 	XUL 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:2168
7 	XUL 	nsJSEventListener::HandleEvent 	dom/src/events/nsJSEventListener.cpp:228
...

I can also get this on Windows XP:
bp-80bb225c-4b0a-4a75-a65e-b0fc32091223
0  	xul.dll  	XPC_XOW_AddProperty  	
1 	xul.dll 	PathExpr::`scalar deleting destructor' 	
2 	xul.dll 	nsFrame::ComputeSize 	
3 	mozjs.dll 	js_InternalInvoke 	
4 	xul.dll 	nsCaseInsensitiveCStringComparator::operator 	
5 	mozjs.dll 	js_SetPropertyHelper 	js/src/jsobj.cpp:4781
6 	mozjs.dll 	js_GetReservedSlot 	js/src/jsobj.cpp:6037
7 		@0x2d235ff 	
8 	mozjs.dll 	js_Invoke 	js/src/jsinterp.cpp:1384
9 	mozjs.dll 	js_InternalInvoke 	js/src/jsinterp.cpp:1439
10 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5098
11 	xul.dll 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:2168
12 	xul.dll 	nsJSEventListener::HandleEvent 	dom/src/events/nsJSEventListener.cpp:228
...

Mac OS X and Windows XP seem to agree on the signature, and the crash report page auto-correlates this to bug 536604 which is duped to bug 536562. Looks to be fixed already. Duping.

Comment 5

[Dave Garrett]

(In reply to comment #4)
> Mac OS X and Windows XP seem to agree on the signature

It says both Mac and Linux crash on the exact same line. Not sure why Linux has extra gobbledygook. :)