674 - NGLayout crashes on link from this URL

Status: VERIFIED FIXED

(Core :: Layout, defect, P2)

Description

[Angus Davis]

Go to jamie's page - about:jwz or www.jwz.org.
Click on "Links"
Notice NGLayout crashes.
I think it has something to do with the code you turned on for window.top -
here's a piece of the stack trace:

nsWebShell::QueryInterface(nsWebShell * const 0x010412a0, const nsID & {...},
void * * 0x10001180) line 375 + 19 bytes
GlobalWindowImpl::GetTop(GlobalWindowImpl * const 0x01073318, nsIDOMWindow * *
0x0012e668) line 324 + 20 bytes
GetWindowProperty(JSContext * 0x0108acf0, JSObject * 0x014544f0, long -33, long
* 0x0012ea44) line 242 + 16 bytes
js_Interpret(JSContext * 0x0108acf0, long * 0x0012ec74) line 2090 + 550 bytes
js_Execute(JSContext * 0x0108acf0, JSObject * 0x014544f0, JSScript * 0x010df450,
JSFunction * 0x00000000, JSStackFrame * 0x00000000, int 0, long * 0x0012ec74)
line 805 + 13 bytes
JS_EvaluateUCScriptForPrincipals(JSContext * 0x0108acf0, JSObject * 0x014544f0,
JSPrincipals * 0x00000000, unsigned short * 0x0145dec8, unsigned int 481, char *
0x0106e480, unsigned int 4, long * 0x0012ec74) line 2226 + 27 bytes
JS_EvaluateUCScript(JSContext * 0x0108acf0, JSObject * 0x014544f0, unsigned
short * 0x0145dec8, unsigned int 481, char * 0x0106e480, unsigned int 4, long *
0x0012ec74) line 2208 + 35 bytes
JS_EvaluateScript(JSContext * 0x0108acf0, JSObject * 0x014544f0, char *
0x0147be98, unsigned int 481, char * 0x0106e480, unsigned int 4, long *
0x0012ec74) line 2175 + 33 bytes
nsJSContext::EvaluateString(char * 0x0147be98, unsigned int 481, char *
0x0106e480, unsigned int 4, long * 0x0012ec74) line 76 + 50 bytes
HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode & {...}) line 1860 + 46
bytes
HTMLContentSink::AddLeaf(HTMLContentSink * const 0x01489c28, const nsIParserNode
& {...}) line 1240
CNavDTD::AddLeaf(const nsIParserNode & {...}) line 2748 + 22 bytes
(snip)

Comment 1

[vidur (gone)]

Tom, this is yours...

Comment 2

[joki (gone)]

No really, I tested this stuff.  Really.

Comment 3

[leger]

Adding crash keyword

Comment 4

[John Unruh]

Verified fixed.

Comment 5

[Matthias Versen [:Matti]]

mid-air collision ? / bugzilla cleanup
Reopening (current State: verfied and no resolution)

Comment 6

[Matthias Versen [:Matti]]

fixed

Comment 7

[Matthias Versen [:Matti]]

verified