Bug 451997

This morning Epiphany began consistently crashing on me when I attempt to go to
http://bugzilla.gnome.org/.  From the stack trace and terminal messages it
appears to have something to do with favicons.

epiphany-2.22.2-1.fc9.i386
xulrunner-1.9-1.fc9.i386


GDB backtrace with debug symbols follows:

Program received signal SIGSEGV, Segmentation fault.
EphyDOMLinkEventListener::HandleEvent (this=0x8574930, aDOMEvent=0x8af34c8)
    at EphyBrowser.cpp:370
370	                rv = mOwner->mFixup->CreateExposableURI (favUri,
getter_AddRefs (exposableURI));

#0  EphyDOMLinkEventListener::HandleEvent (this=0x8574930, aDOMEvent=0x8af34c8)
    at EphyBrowser.cpp:370
#1  0x01540745 in nsEventListenerManager::HandleEventSubType (this=0x856abc8, 
    aListenerStruct=0x89e4b68, aListener=0x8574930, aDOMEvent=0x8af34c8, 
    aCurrentTarget=0x856ab5c, aPhaseFlags=2) at nsEventListenerManager.cpp:1080
#2  0x01540c5b in nsEventListenerManager::HandleEvent (this=0x856abc8, 
    aPresContext=0x8a26fb0, aEvent=0x8af34f0, aDOMEvent=0xbf86d004, 
    aCurrentTarget=0x856ab5c, aFlags=2, aEventStatus=0xbf86d008)
    at nsEventListenerManager.cpp:1184
#3  0x0155a225 in nsEventTargetChainItem::HandleEvent (this=0x8af3698, 
    aVisitor=@0xbf86cffc, aFlags=2) at nsEventDispatcher.cpp:210
#4  0x0155a3b7 in nsEventTargetChainItem::HandleEventTargetChain (
    this=0x8af3698, aVisitor=@0xbf86cffc, aFlags=6, aCallback=0x0)
    at nsEventDispatcher.cpp:291
#5  0x0155a6a4 in nsEventDispatcher::Dispatch (aTarget=0x8aeadd0, 
    aPresContext=0x8a26fb0, aEvent=0x8af34f0, aDOMEvent=0x8af34c8, 
    aEventStatus=0xbf86d0a0, aCallback=0x0) at nsEventDispatcher.cpp:483
#6  0x0155a97b in nsEventDispatcher::DispatchDOMEvent (aTarget=0x8aeadd0, 
    aEvent=0x0, aDOMEvent=0x8af34c8, aPresContext=0x8a26fb0, 
    aEventStatus=0xbf86d0a0) at nsEventDispatcher.cpp:541
#7  0x015400f2 in nsEventListenerManager::DispatchEvent (this=0x8af3550, 
    aEvent=0x8af34c8, _retval=0xbf86d134) at nsEventListenerManager.cpp:1309
#8  0x0150a977 in nsDOMEventRTTearoff::DispatchEvent (this=0x8a78458, 
    aEvt=0x8af34c8, _retval=0xbf86d134) at nsGenericElement.cpp:1092
#9  0x01559828 in nsPLDOMEvent::Run (this=0x8af3428) at nsPLDOMEvent.cpp:71
#10 0x014e256c in nsContentUtils::RemoveScriptBlocker ()
    at nsContentUtils.cpp:4221
#11 0x013e818f in ~mozAutoDocUpdate (this=0xbf86d220)
    at ../../../dist/include/content/mozAutoDocUpdate.h:72
#12 0x0150e41b in nsGenericElement::doInsertChildAt (aKid=0x8aeadd0, 
    aIndex=50, aNotify=0, aParent=0x8ac6ad0, aDocument=0x88a8bd0, 
    aChildArray=@0x8ac6ae4) at nsGenericElement.cpp:2765
#13 0x0150e5fc in nsGenericElement::InsertChildAt (this=0xbf86cd5c, 
    aKid=0x8aeadd0, aIndex=50, aNotify=0) at nsGenericElement.cpp:2674
#14 0x013809c3 in nsINode::AppendChildTo (this=0x8ac6ad0, aKid=0x8aeadd0, 
    aNotify=0) at ../../../dist/include/content/nsINode.h:321
#15 0x015a72ff in HTMLContentSink::ProcessLINKTag (this=0x88e98a0, 
    aNode=@0x8af2b50) at nsHTMLContentSink.cpp:2961
#16 0x013400cc in CNavDTD::AddHeadContent (this=0x8a7cfd8, aNode=0x8af2b50)
    at CNavDTD.cpp:3074
#17 0x013423e1 in CNavDTD::HandleStartToken (this=0x8a7cfd8, aToken=0x8aec5f8)
    at CNavDTD.cpp:1434
#18 0x013427b3 in CNavDTD::HandleToken (this=0x8a7cfd8, aToken=0x8aec5f8, 
    aParser=0x89e03e8) at CNavDTD.cpp:760
#19 0x01342ec1 in CNavDTD::BuildModel (this=0x8a7cfd8, aParser=0x89e03e8, 
    aTokenizer=0x8a82318, anObserver=0x0, aSink=0x88e9928) at CNavDTD.cpp:336
#20 0x01349c7a in nsParser::BuildModel (this=0x89e03e8) at nsParser.cpp:1773
#21 0x0134c2e5 in nsParser::ResumeParse (this=0x89e03e8, allowIteration=1, 
    aIsFinalChunk=0, aCanInterrupt=1) at nsParser.cpp:1650
#22 0x01349e86 in nsParser::OnDataAvailable (this=0x89e03e8, 
    request=0x8ab1e34, aContext=0x0, pIStream=0x88cd0e0, sourceOffset=0, 
    aLength=6240) at nsParser.cpp:2287
#23 0x017efc81 in nsDocumentOpenInfo::OnDataAvailable (this=0x88afb98, 
    request=0x8ab1e34, aCtxt=0x0, inStr=0x88cd0e0, sourceOffset=0, count=6240)
    at nsURILoader.cpp:306
#24 0x0129f68d in nsHTTPCompressConv::do_OnDataAvailable (this=0x88af350, 
    request=0x8ab1e34, context=0x0, offset=0, 
    buffer=0x88cf510 "<!DOCTYPE html PUBLIC \"-//W3C//DTD HTML 4.01
Transitional//EN\"\n", ' ' <repeats 22 times>,
"\"http://www.w3.org/TR/html4/loose.dtd\">\n<html>\n  <head>\n    <title>GNOME
Bug Tracking System</title>\n\n\n<base href=\""..., count=6240) at
nsHTTPCompressConv.cpp:375
#25 0x0129f873 in nsHTTPCompressConv::OnDataAvailable (this=0x88af350, 
    request=0x8ab1e34, aContext=0x0, iStr=0x8570b70, aSourceOffset=0, 
    aCount=2090) at nsHTTPCompressConv.cpp:319
#26 0x0128d5ea in nsStreamListenerTee::OnDataAvailable (this=0x8570bc0, 
    request=0x8ab1e34, context=0x0, input=0x8a765f0, offset=0, count=2090)
    at nsStreamListenerTee.cpp:97
#27 0x012dff2b in nsHttpChannel::OnDataAvailable (this=0x8ab1e08, 
    request=0x8a29ba8, ctxt=0x0, input=0x8a765f0, offset=0, count=2090)
    at nsHttpChannel.cpp:4522
#28 0x01274a0f in nsInputStreamPump::OnStateTransfer (this=0x8a29ba8)
    at nsInputStreamPump.cpp:508
#29 0x01274b58 in nsInputStreamPump::OnInputStreamReady (this=0x8a29ba8, 
    stream=0x8a765f0) at nsInputStreamPump.cpp:398
#30 0x01a47f69 in nsInputStreamReadyEvent::Run (this=0x8ab1398)
    at nsStreamUtils.cpp:111
#31 0x01a5d9e2 in nsThread::ProcessNextEvent (this=0x824a068, mayWait=0, 
    result=0xbf86d8f8) at nsThread.cpp:510
#32 0x01a2aa0e in NS_ProcessPendingEvents_P (thread=0x824a068, timeout=20)
    at nsThreadUtils.cpp:180
#33 0x019a028e in nsBaseAppShell::NativeEventCallback (this=0x8935f18)
    at nsBaseAppShell.cpp:121
#34 0x019896fe in nsAppShell::EventProcessorCallback (source=0x8934fb8, 
    condition=G_IO_IN, data=0x8935f18) at nsAppShell.cpp:69
#35 0x00c6876d in g_io_unix_dispatch (source=<value optimized out>, 
    callback=<value optimized out>, user_data=Could not find the frame base for
"g_io_unix_dispatch".
) at giounix.c:162
#36 0x00c31f38 in IA__g_main_context_dispatch (context=<value optimized out>)
    at gmain.c:2063
#37 0x00c3549b in g_main_context_iterate (context=<value optimized out>, 
    block=<value optimized out>, dispatch=<value optimized out>, self=Could not
find the frame base for "g_main_context_iterate".
)
    at gmain.c:2696
#38 0x00c3596a in IA__g_main_loop_run (loop=<value optimized out>)
    at gmain.c:2919
#39 0x06d30be0 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0