[tbb-bugs] #16771 [Tor Browser]: TBB 5.5a1 crashes on Google Maps

[Tor Bug Tracker & Wiki]

#16771: TBB 5.5a1 crashes on Google Maps
-------------------------+-------------------------------------------------
     Reporter:  tom      |      Owner:  tbb-team
         Type:  defect   |     Status:  new
     Priority:  major    |  Milestone:
    Component:  Tor      |    Version:
  Browser                |   Keywords:  tbb-crash, tbb-5.0-regression,
   Resolution:           |  TorBrowserTeam201508
Actual Points:           |  Parent ID:
       Points:           |
-------------------------+-------------------------------------------------

Comment (by mikeperry):

 Ok, I managed to reproduce this on Low. The key ingredient seems to be a
 non-US Google maps. I couldn't get it to crash on the US one.

 My stacktrace did not have many similarities with tjr's, but that may be
 because I have debug symbols and he did not. The culprit seems to be our
 blob/object URI isolation: nsHostObjectProtocolHandler::RemoveDataEntry()
 is in both of my traces.

 I will attach them in a sec.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/16771#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online