To reproduce, type "foopy:bazdof" into the URL bar of either viewer or apprunner. This happens because NS_NewURL() returns a null URL if it doesn't grok the protocol (e.g., "foopy:"). Later, when comparing two URLs in EqualBaseURLs() (nsWebShell.cpp), we attempt to deref the null pointer without checking. Assigning to rickg b/c I don't know who owns this code. CC'ing warren because I'm not sure if Necko will do this, also (return a null URL if it doesn't like the protocol, that is).
In necko, NS_NewURI returns an error. In netlib, NS_NewURL does too. The error should be checked, not url == nsnull.
Nisheeth -- please take a look. If it's a webshell bug, whack it -- if not, let's find the real owner.
*** This bug has been marked as a duplicate of 9387 ***
Agreed. This is a duplicate of 9387.