firefox crashed with nsScriptSecurityManager::SecurityCompareURI

[Hilario J. Montoliu (hjmf)]

Binary package hint: firefox-3.5

Firefox crashed just after hitting ctrl+T to open a new tab.

I had 2 windows opened with a couple of tabs each one. One was running a java applet.

I haven't been able to reproduce the crash yet.

I'm running karmic up to date:

hmontoliu@ulises-devel:~/tmp/ffcrash/retrace$ lsb_release -rc
Release: 9.10
Codename: karmic
hmontoliu@ulises-devel:~/tmp/ffcrash/retrace$ apt-cache policy firefox
firefox:
  Installed: 3.5.3+build1+nobinonly-0ubuntu2
  Candidate: 3.5.3+build1+nobinonly-0ubuntu2
  Version table:
 *** 3.5.3+build1+nobinonly-0ubuntu2 0
        500 http://es.archive.ubuntu.com karmic/main Packages
        100 /var/lib/dpkg/status

The backtrace shows (stripped):

#0 NS_SecurityCompareURIs (aSourceURI=0xa72eced0,
#0 NS_SecurityCompareURIs (aSourceURI=0xa72eced0,
#1 nsScriptSecurityManager::SecurityCompareURIs (
#2 nsScriptSecurityManager::CheckSameOriginPrincipal (
#3 nsPrincipal::Equals (this=0xa7125e70, aOther=0xb791be80,
#4 xpc_SameScope (ccx=..., d=0xbfa26668, dest=0x0,
#5 XPCConvert::NativeInterface2JSObject (ccx=..., d=0xbfa26668, dest=0x0,
#6 xpc_qsXPCOMObjectToJsval (ccx=..., p=0xa71badc0, cache=0x0,
#7 nsIDOMNSEvent_GetOriginalTarget (cx=0xa8975000,
#8 js_GetSprop (cx=0xa8975000, obj=0xb3e1a320, pobj=0xaee902a0,
#9 js_NativeGet (cx=0xa8975000, obj=0xb3e1a320, pobj=0xaee902a0,
#10 js_Interpret (cx=0xa8975000) at jsinterp.cpp:4436
#11 js_Invoke (cx=0xa8975000, argc=1, vp=0xa8eae5f4, flags=0)
#12 js_fun_apply (cx=0xa8975000, argc=0, vp=0xa8eae5bc)
#13 js_Interpret (cx=0xa8975000) at jsinterp.cpp:5147

I've attached a full (and big) backtrace

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Probably related to bug #428901 but bactraces differ

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Probably related to bug #428901 but backtraces differ:

#0 nsScriptSecurityManager::CheckPropertyAccessImpl (
#0 nsScriptSecurityManager::CheckPropertyAccessImpl (
#1 nsScriptSecurityManager::CheckPropertyAccess (
#2 nsScriptSecurityManager::CheckObjectAccess (cx=0xb182c400,
#3 js_InternalGetOrSet (cx=0xb182c400, obj=0xb188f480,
#4 js_GetSprop (cx=0xb182c400, obj=0xb188f480, pobj=0xb188f4a0,
#5 js_NativeGet (cx=0xb182c400, obj=0xb188f480, pobj=0xb188f4a0,
#6 js_Interpret (cx=0xb182c400) at jsinterp.cpp:4436
#7 js_Invoke (cx=0xb182c400, argc=0, vp=0xa910d740, flags=0)
#8 js_InternalInvoke (cx=0xb182c400, obj=0xb188f480,
#9 js_InternalGetOrSet (cx=0xb182c400, obj=0xb188f480,
#10 js_GetSprop (cx=0xb182c400, obj=0xb188f480, pobj=0xb188f4a0,
#11 js_NativeGet (cx=0xb182c400, obj=0xb188f480, pobj=0xb188f4a0,
#12 js_GetPropertyHelper (cx=0xb182c400, obj=0xb188f480,
#13 js_Interpret (cx=0xb182c400) at jsinterp.cpp:4449

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Firefox it's been behaving very unstable however I haven't been able to obtain a test case

[Hilario J. Montoliu (hjmf) (hmontoliu)]

As of today I haven't got any new crashes since 2009-09-13 probably this issue has been fixed with the updates applied in the mean time.

I've marked other similar crashes as dups of this one.

I think this report can be closed.

[Micah Gersten (micahg)]

This bug report is being closed due to your last comment regarding this being fixed with an update. For future reference you can manage the status of your own bugs by clicking on the current status in the yellow line and then choosing a new status in the revealed drop down box. You can learn more about bug statuses at https://wiki.ubuntu.com/Bugs/Status . Thank you again for taking the time to report this bug and helping to make Ubuntu better. Please submit any future bugs you may find.