59930 - Crash on hitting spacebar after browsing for a while

Status: VERIFIED DUPLICATE of bug 61519

(Core :: DOM: UI Events & Focus Handling, defect, P3)

Description

[Boris Zbarsky [:bzbarsky]]

Build id:  linux trunk 2000111106 and CVS build from same time.

After about 2 hours of continuous browsing, Mozilla will usually crash on me
with exit code 139.  The crash usually happens when I hit the spacebar to scroll
a page, but I have not discovered a certain way to reproduce it. I've been
seeing this for the last week or so, but today I browsed long enough with a
debug build to get the crash.

Stack trace:

#0  nsXBLPrototypeHandler::ExecuteHandler (this=0x8693bb8, aReceiver=0x8551fa8,
    aEvent=0x9161a00) at nsXBLPrototypeHandler.cpp:296
        focusController = {mRawPtr = 0x880ead8}
        win = {mRawPtr = 0x0}
        piWin = {mRawPtr = 0x0}
        rootWin = {mRawPtr = 0x0}
        command = {<nsString> = {<basic_nsAWritableString<short unsigned int>> =
{<basic_nsAReadableString<short unsigned int>> = {<nsPrivateSharableString<short
unsigned int>> = {_vptr. = 0x40158d20 <nsAutoString virtual table>}, <No data
fields>}, <No data fields>}, <nsStr> = {mLength = 0, mCapacity = 63, mCharSize =
eTwoByte, mOwnsBuffer = 0, {
        mStr = 0xbfffcdb0 "", mUStr = 0xbfffcdb0}}, <No data fields>},
  mBuffer = "\000\000ÿ¿É`M@¨\037U\b\004\000\000\000sºT@
\000\000\000ÈG\006\bVºT@ \fY@¨\037U\bðÍÿ¿¨bM@¨\037U\b\030\003\026@¦\031%@\210ê#@¨\037U\b\bÎÿ¿\026\006#@\000\000\000\000:E\020@ \fY@¨\037U\bÈÏÿ¿\030\003\026@8Îÿ¿/aM@¨\037U\b\003\000\000\000sºT@ÈG\006\bVºT@"}
        onEvent = {<nsString> = {<basic_nsAWritableString<short unsigned int>> =
{<basic_nsAReadableString<short unsigned int>> = {<nsPrivateSharableString<short
unsigned int>> = {_vptr. = 0x40158d20 <nsAutoString virtual table>}, <No data
fields>}, <No data fields>}, <nsStr> = {mLength = 13, mCapacity = 63, mCharSize
= eTwoByte, mOwnsBuffer = 0, {
        mStr = 0xbfffccc8 "o", mUStr = 0xbfffccc8}}, <No data fields>},
  mBuffer =
"o\000n\000x\000b\000l\000k\000e\000y\000p\000r\000e\000s\000s\000\000\000¦\031%@\210ê#@¸;i\b\004Íÿ¿\026\006#@~C\020@\204,mA¦\031%@\210ê#@h;i\b
Íÿ¿\026\006#@\000\000\000\000:E\020@¦\031%@\210ê#@\000\032\026\t<Íÿ¿\026\006#@~C\020@\204,mA\000\032\026\tøÍÿ¿É.\020@lÍÿ¿"}
        str = {<nsString> = {<basic_nsAWritableString<short unsigned int>> =
{<basic_nsAReadableString<short unsigned int>> = {<nsPrivateSharableString<short
unsigned int>> = {
          _vptr. = 0x40158d20 <nsAutoString virtual table>}, <No data fields>},
<No data fields>}, <nsStr> = {mLength = 8, mCapacity = 63, mCharSize = eTwoByte,
mOwnsBuffer = 0, {
        mStr = 0xbfffcc30 "k", mUStr = 0xbfffcc30}}, <No data fields>},
  mBuffer =
"k\000e\000y\000p\000r\000e\000s\000s\000\000\000\000\000\000\000\000\000s\000i\000m\000p\000\013\000\000\000Jb\n@\024Ïÿ¿0<i\b\013\000\000\000\030\003\026@XY\n@ÐNQ\b\024Ïÿ¿\210Ìÿ¿wY\n@4Íÿ¿ \204g\büP\037@´Ìÿ¿\0005\037@4Íÿ¿ \204g\büP\037@4Y\n@¦\031%@\210ê#@h;i\bÀÌÿ¿"}
        onEventAtom = {mRawPtr = 0x88deb00}
        handler = (void *) 0x0
        handlerText = {<nsString> = {<basic_nsAWritableString<short unsigned
int>> = {<bas
ic_nsAReadableString<short unsigned int>> = {<nsPrivateSharableString<short
unsigned int>>
 = {
          _vptr. = 0x40158d20 <nsAutoString virtual table>}, <No data fields>},
<No data f
ields>}, <nsStr> = {mLength = 978, mCapacity = 1008, mCharSize = eTwoByte,
mOwnsBuffer = 1
, {
        mStr = 0x8d172f8 "\n", mUStr = 0x8d172f8}}, <No data fields>},
  mBuffer =
"\000\000g\b\210è\237\bÈ+H\b\030¥O\b¸\025&\tØÎ:\bÔËÿ¿\212!\031@Ü\025&\tÚ\000\0
00\000ï\037\000\000Är\035@ØÎ:\b\016\000\000\000Ü\025&\tÐÏÿ¿Òð\031@ØÎ:\bÜ\025&\tÄr\035@0Ðÿ¿
¸Ûd\b¨\037U\b\001", '\000' <repeats 15 times>, " \fY@\002\000\000\000pÌÿ¿ßóI@ Ìÿ¿"}
        boundGlobal = {mRawPtr = 0x0}
        winRoot = {mRawPtr = 0x8551fb0}
        boundContext = {mRawPtr = 0x880ead8}
        owner = {mRawPtr = 0x0}
        scriptObject = (void *) 0x89fe8ac
        eventListener = {mRawPtr = 0x0}
        jsListener = {mRawPtr = 0x0}
#1  0x4146c627 in nsXBLWindowKeyHandler::WalkHandlersInternal (this=0x85b2148,
    aKeyEvent=0x9161a00, aEventType=0x82167a8, aHandler=0x8693bb8)
    at nsXBLWindowKeyHandler.cpp:256
        rec = {mRawPtr = 0x8551fa8}
        disabled = {<nsString> = {<basic_nsAWritableString<short unsigned int>>
= {<basic_
nsAReadableString<short unsigned int>> = {<nsPrivateSharableString<short
unsigned int>> =
{
          _vptr. = 0x40158d20 <nsAutoString virtual table>}, <No data fields>},
<No data f
ields>}, <nsStr> = {mLength = 0, mCapacity = 63, mCharSize = eTwoByte,
mOwnsBuffer = 0, {
        mStr = 0xbfffcf3c "", mUStr = 0xbfffcf3c}}, <No data fields>},
  mBuffer =
"\000\000#@~C\020@\204,mA\000\032\026\t\bÐÿ¿É.\020@à<\006\b(\000\000\000?", '\
000' <repeats 15 times>,
"chrome://global/content/htmlBindings.xml\000ngs.xml\000\032\026\
tvI\020@\204,mA\000\000\000\000ÜÒ\025@¸;i\b\000\000\000\000\000\000\000"}
        elt = {mRawPtr = 0x8546e9c}
        stopped = 0
        privateEvent = {mRawPtr = 0x9161a0c}
        matched = 1
        nextHandler = {mRawPtr = 0x8546e9c}
        aHandler = (nsIXBLPrototypeHandler *) 0xbfffcf20
        rv = 0
        currHandler = {mRawPtr = 0x8693bb8}
#2  0x4146cb88 in nsXBLWindowKeyHandler::WalkHandlers (this=0x85b2148,
    aKeyEvent=0x9161a04, aEventType=0x82167a8) at nsXBLWindowKeyHandler.cpp:293
        evt = {mRawPtr = 0x9161a08}
        prevent = 0
        keyEvent = {mRawPtr = 0x9161a00}
#3  0x4146cc8a in nsXBLWindowKeyHandler::KeyPress (this=0x85b2148,
aKeyEvent=0x9161a04)
    at nsXBLWindowKeyHandler.cpp:310
        this = (nsXBLWindowKeyHandler *) 0xbfffc630
#4  0x4115d1f8 in nsEventListenerManager::HandleEvent (this=0x8dec5a8,
    aPresContext=0x8d10408, aEvent=0xbffff5ac, aDOMEvent=0xbffff1ac,
    aCurrentTarget=0x8551fa8, aFlags=2, aEventStatus=0xbffff4d8)
    at nsEventListenerManager.cpp:1118
        ls = (nsListenerStruct *) 0x8b1a178
        mKeyListener = (nsIDOMKeyListener *) 0x85b2148
        i = 0
        ret = 0
        kungFuDeathGrip = {mRawPtr = 0x8dec5a8}
        empty = {<nsString> = {<basic_nsAWritableString<short unsigned int>> =
{<basic_nsAReadableString<short unsigned int>> = {<nsPrivateSharableString<short
unsigned int>> = {
          _vptr. = 0x40158d20 <nsAutoString virtual table>}, <No data fields>},
<No data fields>}, <nsStr> = {mLength = 0, mCapacity = 63, mCharSize = eTwoByte,
mOwnsBuffer = 0, {
        mStr = 0xbfffd0a0 "", mUStr = 0xbfffd0a0}}, <No data fields>},
  mBuffer =
"\000\000#@Àó<\t¼Ðÿ¿\026\006#@~C\020@ \fY@Àó<\t|Ñÿ¿É.\020@ìÐÿ¿\233ÌI@Àó<\t\a\000\000\000áüS@ð\000\000\000ÈG\006\bÀüS@ \fY@Äó<\t\004Ñÿ¿ÝÐI@Àó<\t\030\003\026@¦\031%@\210ê#@Àó<\t\034Ñÿ¿\026\006#@\000\000\000\000:E\020@ \fY@Àó<\t"}
#5  0x404d754b in nsWindowRoot::HandleChromeEvent (this=0x8551fa8,
    aPresContext=0x8d10408, aEvent=0xbffff5ac, aDOMEvent=0xbffff1ac, aFlags=2,
    aEventStatus=0xbffff4d8) at nsWindowRoot.cpp:186
        kungFuDeathGrip = {mRawPtr = 0x93cf3c4}
        ret = 0
        domEvent = (nsIDOMEvent *) 0x0
#6  0x4049f29d in GlobalWindowImpl::HandleDOMEvent (this=0x93cf3c0,
    aPresContext=0x8d10408, aEvent=0xbffff5ac, aDOMEvent=0xbffff1ac, aFlags=2,
    aEventStatus=0xbffff4d8) at nsGlobalWindow.cpp:574
        ret = 0
        domEvent = (nsIDOMEvent *) 0x0
        kungFuDeathGrip1 = {mRawPtr = 0x8551fac}
        kungFuDeathGrip2 = {mRawPtr = 0x8dec600}
#7  0x40b092a4 in nsXULDocument::HandleDOMEvent (this=0x85d5678,
aPresContext=0x8d10408,
    aEvent=0xbffff5ac, aDOMEvent=0xbffff1ac, aFlags=2, aEventStatus=0xbffff4d8)
    at nsXULDocument.cpp:2008
        aDOMEvent = (nsIDOMEvent **) 0xbffff1ac
        aFlags = 2
        ret = 0
        domEvent = (nsIDOMEvent *) 0x0
#8  0x40aec599 in nsXULElement::HandleDOMEvent (this=0x8555f38,
aPresContext=0x8d10408,
    aEvent=0xbffff5ac, aDOMEvent=0xbffff1ac, aFlags=2, aEventStatus=0xbffff4d8)
    at nsXULElement.cpp:3327
        ret = 0
        retarget = 0
        oldTarget = {mRawPtr = 0x0}
        domEvent = (nsIDOMEvent *) 0x0
        bindingParent = {mRawPtr = 0x0}
#9  0x40aec599 in nsXULElement::HandleDOMEvent (this=0x82ab2d0,
aPresContext=0x8d10408,
    aEvent=0xbffff5ac, aDOMEvent=0xbffff1ac, aFlags=2, aEventStatus=0xbffff4d8)
    at nsXULElement.cpp:3327
        ret = 0
        retarget = 0
        oldTarget = {mRawPtr = 0x0}
        domEvent = (nsIDOMEvent *) 0x0
        bindingParent = {mRawPtr = 0x0}
#10 0x40aec599 in nsXULElement::HandleDOMEvent (this=0x8d7b9f0,
aPresContext=0x8d10408,
    aEvent=0xbffff5ac, aDOMEvent=0xbffff1ac, aFlags=2, aEventStatus=0xbffff4d8)
    at nsXULElement.cpp:3327
        ret = 0
        retarget = 0
        oldTarget = {mRawPtr = 0x0}
        domEvent = (nsIDOMEvent *) 0x0
        bindingParent = {mRawPtr = 0x0}
#11 0x40aec599 in nsXULElement::HandleDOMEvent (this=0x8b2b158,
aPresContext=0x8d10408,
    aEvent=0xbffff5ac, aDOMEvent=0xbffff1ac, aFlags=2, aEventStatus=0xbffff4d8)
    at nsXULElement.cpp:3327
        ret = 0
        retarget = 0
        oldTarget = {mRawPtr = 0x0}
        domEvent = (nsIDOMEvent *) 0x0
        bindingParent = {mRawPtr = 0x0}
#12 0x40aec599 in nsXULElement::HandleDOMEvent (this=0x8b2b200,
aPresContext=0x8d10408,
    aEvent=0xbffff5ac, aDOMEvent=0xbffff1ac, aFlags=2, aEventStatus=0xbffff4d8)
    at nsXULElement.cpp:3327
        ret = 0
        retarget = 0
        oldTarget = {mRawPtr = 0x0}
        domEvent = (nsIDOMEvent *) 0x0
        bindingParent = {mRawPtr = 0x0}
#13 0x40af215d in nsXULElement::HandleChromeEvent (this=0x8b2b200,
    aPresContext=0x8d10408, aEvent=0xbffff5ac, aDOMEvent=0xbffff1ac, aFlags=2,
    aEventStatus=0xbffff4d8) at nsXULElement.cpp:4269
        kungFuDeathGrip = {mRawPtr = 0x85d5678}
#14 0x4049f29d in GlobalWindowImpl::HandleDOMEvent (this=0x8e65600,
    aPresContext=0x8d10408, aEvent=0xbffff5ac, aDOMEvent=0xbffff1ac, aFlags=2,
    aEventStatus=0xbffff4d8) at nsGlobalWindow.cpp:574
        ret = 0
        domEvent = (nsIDOMEvent *) 0x0
        kungFuDeathGrip1 = {mRawPtr = 0x8b2b214}
        kungFuDeathGrip2 = {mRawPtr = 0x88a9050}
#15 0x414a9458 in nsDocument::HandleDOMEvent (this=0x8e7def8,
aPresContext=0x8d10408,
    aEvent=0xbffff5ac, aDOMEvent=0xbffff1ac, aFlags=2, aEventStatus=0xbffff4d8)
    at nsDocument.cpp:3038
        aDOMEvent = (nsIDOMEvent **) 0xbffff1ac
        aFlags = 2
        mRet = 0
        domEvent = (nsIDOMEvent *) 0x0
#16 0x414e3848 in nsGenericElement::HandleDOMEvent (this=0x84ed064,
    aPresContext=0x8d10408, aEvent=0xbffff5ac, aDOMEvent=0xbffff1ac, aFlags=1,
    aEventStatus=0xbffff4d8) at nsGenericElement.cpp:1437
        ret = 0
        retarget = 0
        oldTarget = {mRawPtr = 0x0}
        domEvent = (nsIDOMEvent *) 0x9161a04
        bindingParent = {mRawPtr = 0x0}
#17 0x41241da3 in nsHTMLHtmlElement::HandleDOMEvent (this=0x84ed050,
    aPresContext=0x8d10408, aEvent=0xbffff5ac, aDOMEvent=0x0, aFlags=1,
    aEventStatus=0xbffff4d8) at nsHTMLHtmlElement.cpp:185
No locals.
#18 0x411d7f7b in PresShell::HandleEventInternal (this=0x8c530d8,
aEvent=0xbffff5ac,
    aView=0x8f489c8, aFlags=1, aStatus=0xbffff4d8) at nsPresShell.cpp:4876
        this = (PresShell *) 0x8c530d8
        rv = 0
        manager = (nsIEventStateManager *) 0x88c3d90
#19 0x411d7c8c in PresShell::HandleEvent (this=0x8c530d8, aView=0x8f489c8,
    aEvent=0xbffff5ac, aEventStatus=0xbffff4d8, aForceHandle=0,
aHandled=@0xbffff46c)
    at nsPresShell.cpp:4811
        manager = (nsIEventStateManager *) 0x88c3d90
        this = (PresShell *) 0x8c530d8
        clientData = (void *) 0x88389cc
        frame = (nsIFrame *) 0x8c53104
        rv = 0
#20 0x41abb7d9 in nsView::HandleEvent (this=0x8f489c8, event=0xbffff5ac,
aEventFlags=8,
    aStatus=0xbffff4d8, aForceHandle=0, aHandled=@0xbffff46c) at nsView.cpp:366
        event = (nsGUIEvent *) 0xbffff5ac
        obs = (nsIViewObserver *) 0x8c530dc
#21 0x41abb77e in nsView::HandleEvent (this=0x8c92cc8, event=0xbffff5ac,
aEventFlags=8,
     aStatus=0xbffff4d8, aForceHandle=0, aHandled=@0xbffff46c) at nsView.cpp:350
        pKid = (nsIView *) 0x8f489c8
        cnt = 0
        numkids = 1
        trect = {x = 0, y = 0, width = 13860, height = 23670}
        x = 0
        y = 0
        event = (nsGUIEvent *) 0xbffff5ac
        obs = (nsIViewObserver *) 0x8c530dc
#22 0x41abb77e in nsView::HandleEvent (this=0x9058000, event=0xbffff5ac,
aEventFlags=28,
    aStatus=0xbffff4d8, aForceHandle=1, aHandled=@0xbffff46c) at nsView.cpp:350
        pKid = (nsIView *) 0x8c92cc8
        cnt = 0
        numkids = 3
        trect = {x = 0, y = 0, width = 13860, height = 7845}
        x = 0
        y = 0
        event = (nsGUIEvent *) 0xbffff5ac
        obs = (nsIViewObserver *) 0x8c530dc
#23 0x41ace18e in nsViewManager2::DispatchEvent (this=0x81f0080, aEvent=0xbffff5ac,
    aStatus=0xbffff4d8) at nsViewManager2.cpp:1437
        p2t = 15
        t2p = 0.0666666701
        handled = 1
        baseView = (nsIView *) 0x8c92cc8
        view = (nsIView *) 0x9058000
        offset = {x = 0, y = 0}
        sb = (nsIScrollbar *) 0x0
        aEvent = (nsGUIEvent *) 0xbffff5ac
#24 0x41abaf0d in HandleEvent (aEvent=0xbffff5ac) at nsView.cpp:67
        vm = (nsIViewManager *) 0x81f0080
        aEvent = (nsGUIEvent *) 0xbffff5ac
        result = nsEventStatus_eIgnore
        view = (nsIView *) 0x402be001
#25 0x406c7e51 in nsWidget::DispatchEvent (this=0x88817c0, aEvent=0xbffff5ac,
    aStatus=@0xbffff56c) at nsWidget.cpp:1483
        gw = (GtkObject *) 0x962c950
        nativeWidget = (void *) 0xbfffc630
#26 0x406c7bc9 in nsWidget::DispatchWindowEvent (this=0x88817c0, event=0xbffff5ac)
    at nsWidget.cpp:1374
        this = (nsWidget *) 0x88817c0
        status = nsEventStatus_eIgnore
#27 0x406c5191 in nsWidget::OnInput (this=0x88817c0, aEvent=@0xbffff5ac)
    at nsWidget.cpp:101
        ret = 0
        releaseWidget = 1
        widget = (nsWidget *) 0x88817c0
#28 0x406c1200 in handle_key_press_event (w=0x0, event=0x94852f0, p=0x88817c0)
    at nsWidget.h:201
        this = (nsWidget *) 0x88817c0
        kevent = {<nsInputEvent> = {<nsGUIEvent> = {<nsEvent> = {
        eventStructType = 9 '\t', message = 131, point = {x = 0, y = 0},
refPoint = {
          x = 0, y = 0}, time = 3425802033, flags = 2, internalAppFlags =
1082575687},
      widget = 0x88817c0, nativeMsg = 0x406f64ee}, isShift = 0, isControl = 0,
    isAlt = 0, isMeta = 0}, keyCode = 0, charCode = 32, isChar = 1082559753}
        win = (nsWidget *) 0x88817c0
#29 0x406c162e in dispatch_superwin_event (event=0x94852f0, window=0x88817c0)
    at nsGtkEventHandler.cpp:975
        event = (GdkEvent *) 0x94852f0
        window = (nsWindow *) 0xbfffc630
#30 0x406c14ea in handle_gdk_event (event=0x94852f0, data=0x0)
    at nsGtkEventHandler.cpp:889
        grabbingWindow = (nsWindow *) 0x94852f0
        grabbingGdkWindow = (GdkWindow *) 0x89267e8
        grabbingMozArea = (GtkWidget *) 0x408434cd
        window = (nsWindow *) 0x88817c0
        current_grab = (GtkWidget *) 0x0
        superwin_grab = 0
        object = (GtkObject *) 0x962c950
        event_time = 0
#31 0x4084353b in gdk_event_dispatch () from /usr/lib/libgdk-1.2.so.0
No symbol table info available.
#32 0x40870186 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
No symbol table info available.
#33 0x40870751 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
No symbol table info available.
#34 0x408708f1 in g_main_run () from /usr/lib/libglib-1.2.so.0
No symbol table info available.
#35 0x40798c69 in gtk_main () from /usr/lib/libgtk-1.2.so.0
No symbol table info available.
#36 0x406b5984 in nsAppShell::Run (this=0x80aeef0) at nsAppShell.cpp:335
        this = (nsAppShell *) 0x80aeef0
#37 0x405d4fb5 in nsAppShellService::Run (this=0x80ac3f8) at
nsAppShellService.cpp:407
        this = (nsAppShellService *) 0x0
#38 0x80523fb in main1 (argc=1, argv=0xbffff8c4, nativeApp=0x0) at
nsAppRunner.cpp:1015
        rv = 0
        eventQService = {mRawPtr = 0x808e210}
        obsService = {mRawPtr = 0x80a5920}
        needAutoreg = 0
        cmdLineArgs = {mRawPtr = 0x80ac2b8}
        appShell = {mRawPtr = 0x80ac3f8}
        walletService = {mRawPtr = 0x81f3978}
#39 0x8052d26 in main (argc=1, argv=0xbffff8c4) at nsAppRunner.cpp:1255
        argv = (char **) 0xbffff8c4
        nativeApp = (nsINativeAppSupport *) 0x0
        rv = 0
        splash = (nsISplashScreen *) 0x0
        dosplash = 0
        remoterv = 0
        argused = 0
        mainResult = 0
#40 0x403009cb in __libc_start_main (main=0x8052ba0 <main>, argc=1, argv=0xbffff8c4,
    init=0x804c244 <_init>, fini=0x805edcc <_fini>, rtld_fini=0x4000ae60
<_dl_fini>,
    stack_end=0xbffff8bc) at ../sysdeps/generic/libc-start.c:92
        argv = (char **) 0xbffff8c4
        rtld_fini = (void (*)(void)) 0x4000ae60 <_dl_fini>
        stack_end = (void *) 0xbfffc630

Comment 1

[Bradley Baetz]

I get a crash as well, with a copule of messages about dereferencing a NULL
nsCOMPPtr (I can't duplicate it now, or I'd copy the exact error message).
CONFIRMING.  I don't get a core dump, or anything else - the process just quits,
even though I'm using a debug build. I was going to file a bug, but that didn't
seem like much to go on...

It doesn't have to be after a few hours - I once got it by starting up, going to
google, then typing (in the search box) "foo bar" - it crashed on the space,
even though the text box was in focus, and had accepted (and displayed) the "foo".

It _may_ be related to having the page start/finish/something else loading on a
different window to the one I'm using - ie I user bookmarks/the location bar to
go to google, go to a different desktop to do something else, then come back and
hit the space bar). It has happened without doing this - it just seems to happen
more often when I do do this.

Comment 2

[Chris Siebenmann]

 I am also seeing this a lot lately with current CVS trunk builds. This is
definetly a recent regression, and for me it renders the browser quite hard
to use, since it will crash randomly. I tend to see this mostly when I hit
spacebar to scroll a window, and I think sometimes when I hit the Back button
to go back in a window.

 Flash: I have a consistent reproduction. Reproduction:
1. go to http://news.bbc.co.uk/
2. Hit spacebar once to scroll down.
3. Pick a random story to go to that's in view; any will do.
4. when that story is loaded, hit spacebar: BOOM.

(Adding myself to CC list, too, since this is a crash that I am very interested
in seeing a fix for.)

 Note that Mozilla on Linux will (currently) never leave a core dump on an
unpatched Linux kernel: multithreaded programs don't dump core at the moment
there. 'mozilla -g' will have the debugger tell you when a SEGV happens.
(Although you need a non-stripped build to get anything useful from it.)

Comment 3

[Gavin Jackson]

This crash also occurs when visiting mozillazine.org and picking a random link. 
For example the Netscape 6 Release article. Press the space bar on that page and 
it crashes

Comment 4

[kirun]

Crash Windows 95 / 2000111420

MOZILLA caused an invalid page fault in
module GKHTML.DLL at 014f:602b87b4.
Registers:
EAX=00000000 CS=014f EIP=602b87b4 EFLGS=00010246
EBX=00f614d0 SS=0157 ESP=0068e344 EBP=0068e620
ECX=0068e62c DS=0157 ESI=00000000 FS=0e37
EDX=0068e62c ES=0157 EDI=01903fb0 GS=0000
Bytes at CS:EIP:
8b 08 ff 51 10 56 8d 4d a4 ff 75 0c ff 15 1c a5
Stack dump:
00000000 0068e62c 60cea182 00fd4020 00000000 60d18090 00000008 0000003f 00000001
00000000 0068e370 0065006b 00700079 00650072 00730073 60b60000 

Comment 5

[Matthias Versen [:Matti]]

*** Bug 60833 has been marked as a duplicate of this bug. ***

Comment 6

[Mike W.]

I have the same thing happening in Win98SE.

Mike

Comment 7

[Bradley Baetz]

Adding crash keyword, changing severity based on
http://bugzilla.mozilla.org/bug_status.html#severity and changing OS to ALL
based on other comments. This bug is annoying, and makes navigating pages with
the keyboard risky.

Comment 8

[Bradley Baetz]

It appears (from using printfs) that GetFocusedWindow is returning null. All
other callers of GetFocusedWindow seem to check the result, so it may be a bug
in the XBL code (nsXBLPrototypeHandler.cpp:296, or thereabouts)

ccing hyatt because I got told (on IRC) that thats who to cc on xbl related bugs.

Comment 9

[Vincent Schut]

I found another more or less consistent (tried four times) reproducing script on
a win98 system, using build 2000112520:
1. start mozilla, type www.hotbot.com in the url bar, let page load. DO NOT
CLICK IN THE SEARCH FORM AREA.
2. open a new browser window by clicking ctrl-n.
3. make this browser window try to go to a url where the server refuses to
connect (it just happened because my mailserver was out of order today), you
will get a message 'connection refused accessing....', click OK.
4. close window.
5. now click in the search form area of hotbot, and press the spacebar. Usually
it crashes immediately.

remark: once it did not crash but the other spacebar bug (bug 26882) appeared:
the page scrolled down. Could these two bugs be related...?

Hope this helps to solve the puzzle,
Vincent.

Comment 10

[John Morrison]

See top crash bug 59782 or bug 61519 (and other duplicates.)

Comment 11

[Asa Dotzler [:asa]]

*** Bug 61871 has been marked as a duplicate of this bug. ***

Comment 12

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Changing crasher bug milestone to mozilla0.9.

Comment 13

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Blizzard fixed this a month ago, after hyatt didn't.

*** This bug has been marked as a duplicate of 61519 ***

Comment 14

[Loco]

VERIFIED.