STEPS TO REPRODUCE: 1) Get a 1.8.x build or a 1.8.0.x build with any of the patches from bug 326645 applied. 2) Load the URL in the URL field. EXPECTED RESULTS: no crash ACTUAL RESULTS: (gdb) where #0 0x8904408b in ?? () #1 0xb664f3b9 in nsAttributeChildList::GetLength (this=0x83d0098, aLength=0xbfffdb80) at ../../../../mozilla/content/base/src/nsDOMAttribute.cpp:760 #2 0xb7fc4f19 in XPTC_InvokeByIndex () at ../../../../../../../mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp:69 (gdb) frame 1 #1 0xb664f3b9 in nsAttributeChildList::GetLength (this=0x83d0098, aLength=0xbfffdb80) at ../../../../mozilla/content/base/src/nsDOMAttribute.cpp:760 760 mAttribute->GetValue(value); (gdb) p *mAttribute warning: can't find linker symbol for virtual table for `nsDOMAttribute' value $1 = {<nsIDOMAttr> = {<nsIDOMNode> = {<nsISupports> = { _vptr.nsISupports = 0x200061}, <No data fields>}, <No data fields>}, <nsIDOM3Node> = {<nsISupports> = { _vptr.nsISupports = 0x720070}, <No data fields>}, <nsIAttribute> = {<nsISupports> = {_vptr.nsISupports = 0x70006f}, mAttrMap = 0x720065, mNodeInfo = {mRawPtr = 0x790074}}, mRefCnt = {mValue = 7602208}, _mOwningThread = {mThread = 0x610068}, static sInitialized = 1, mValue = {<nsSubstring> = {<nsAString_internal> = { mVTable = 0x200074, mData = 0x610068, mLength = 2097267, mFlags = 7209071}, <No data fields>}, <No data fields>}, mChild = 0x79006c, mChildList = 0x610020} The mNodeInfo and mChildList pointers are pretty clearly bogus. So's the mAttrMap pointer: (gdb) p *mAttribute.mAttrMap Cannot access memory at address 0x720065 So it seems to me that mAttribute is dead. I wonder why...

Ah, it looks like on trunk the DropReference() call in ~nsDOMAttribute was added in bug 324572. We should probably port that part over to branch.

This is dead simple, actually..

Comment on attachment 226246 [details] [diff] [review] Fix looks good r/sr/a=sicking

Fixed on both branches.

Verified fixed on mac 1.5.0 branch build 2006062008 and on the 2.0 branch.