firefox crashed with nsScriptSecurityManager::CheckPropertyAccessImpl

[Hilario J. Montoliu (hjmf)]

Binary package hint: firefox-3.5

Probably this crash is closely related to bug #428888 but as the backtrace differs quite I'm submitting as different bug.

This time firefox greyed out and shortly after crashed while browsing lauchpad. Again,as in bug #428888, another window was open with a java applet running in it.

I haven't found yet a reproducible test case.

My system is karmic updated;

hmontoliu@ulises-devel:~/tmp/ffcrash/retrace$ lsb_release -rc
Release: 9.10
Codename: karmic
hmontoliu@ulises-devel:~/tmp/ffcrash/retrace$ apt-cache policy firefox
firefox:
  Installed: 3.5.3+build1+nobinonly-0ubuntu2
  Candidate: 3.5.3+build1+nobinonly-0ubuntu2
  Version table:
 *** 3.5.3+build1+nobinonly-0ubuntu2 0
        500 http://es.archive.ubuntu.com karmic/main Packages
        100 /var/lib/dpkg/status

The first significant fields of the backtrace (attached) are:

#0 nsScriptSecurityManager::CheckPropertyAccessImpl (
#0 nsScriptSecurityManager::CheckPropertyAccessImpl (
#1 nsScriptSecurityManager::CheckPropertyAccess (
#2 nsScriptSecurityManager::CheckObjectAccess (cx=0xb182c400,
#3 js_InternalGetOrSet (cx=0xb182c400, obj=0xb188f480,
#4 js_GetSprop (cx=0xb182c400, obj=0xb188f480, pobj=0xb188f4a0,
#5 js_NativeGet (cx=0xb182c400, obj=0xb188f480, pobj=0xb188f4a0,
#6 js_Interpret (cx=0xb182c400) at jsinterp.cpp:4436
#7 js_Invoke (cx=0xb182c400, argc=0, vp=0xa910d740, flags=0)
#8 js_InternalInvoke (cx=0xb182c400, obj=0xb188f480,
#9 js_InternalGetOrSet (cx=0xb182c400, obj=0xb188f480,
#10 js_GetSprop (cx=0xb182c400, obj=0xb188f480, pobj=0xb188f4a0,
#11 js_NativeGet (cx=0xb182c400, obj=0xb188f480, pobj=0xb188f4a0,
#12 js_GetPropertyHelper (cx=0xb182c400, obj=0xb188f480,
#13 js_Interpret (cx=0xb182c400) at jsinterp.cpp:4449