Closed Bug 253979 Opened 20 years ago Closed 19 years ago

crash on geocities.com/killianrotc/ [@ nsEntryStack::Pop() ]

Categories

(Core :: DOM: HTML Parser, defect)

Product:
Core
Component:
DOM: HTML Parser
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla1.8beta2

People

(Reporter: zorm, Assigned: mrbkap)

References

(
URL
)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(5 files)

Minidump created by VS after firefox crashed.
90.07 KB, application/octet-stream
Details
Debug build log
3.31 KB, text/plain
Details
testcase
88 bytes, text/html
Details
Backtrace from testcase from a debug build from 2004-11-01
6.04 KB, text/plain
Details
wallpaper maybe
1.04 KB, patch
bzbarsky
: review+
brendan
: superreview+
Details | Diff | Splinter Review 
User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Avant Browser [avantbrowser.com]; .NET CLR 1.1.4322)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040614 Firefox/0.9

I was surfing around a couple of web pages when firefox crashed.
firefox!jpeg_get_small+0x4a4bb
The web page I believe caused the crash is 
http://www.geocities.com/killianrotc/ but it doesn't crash now and im not 
really sure.

Reproducible: Didn't try
Steps to Reproduce:
1.
2.
3.

    
    

    
  
2004080107/1.8a3/W2K is crashing too, moving to Browser.
Assignee: firefox → general
URL: http://www.geocities.com/killianrotc/
Component: General → Browser-General
Keywords: crash
Product: Firefox → Browser
QA Contact: firefox.general → general
Version: unspecified → Trunk

    
    

    
  
Confirming. Crashing on Linux FF .9 as well. I am building a fresh debug FF
build to see what is going on. My talkback isn't working, so someone else will
have to send the ID.
Status: UNCONFIRMED → NEW
Ever confirmed: true
OS: Windows 2000 → All
Hardware: PC → All

    
    

    
  

      
      
      
      

        Attached file
          
        Debug build log
        — 
      

    


  
This was what I got when I ran the debug build. It ran OK the first time I
accessed the page, I had to hit refresh 3 times to get a crash.

    
    

    
  
Talkback IDs:
TB464712Z
TB464710K

Keywords: talkbackid

    
    

    
  
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a3) Gecko/20040801

It is crashing after loading the menu, or crashing when I delete it´s Tab, JS
disabled. It is crashing on Reload, JS enabled.

TB465306Z, TB465190X, TB464703Y
JS is in the main file to animate the Title.
view-source:http://www.geocities.com/killianrotc/

The menu is very crappy html, with a lot of missing tags, and a funny <embed>
past the end of the <html>
http://www.geocities.com/killianrotc/menu.html

<html><head><title>Killian Army JROTC Menu</title>
<html><head><meta http-equiv="Content-Type" content="text/html;
charset=windows-1252"><title>menu</title>
<base target="main">
</head>
<BODY .....

....

<div align="center">
  <center>
  <table border="0" cellspacing="0" cellpadding="0" bordercolor="#000080">
    <tr>
      <td>
        
</body></html>

<script language="JavaScript1.2">
if (document.all)
document.body.onmousedown=new Function("if
(event.button==2||event.button==3)alert ('Code Yellow: Access Denied !')")
</script>
</body>
<embed src="america2.mi" hidden=true autostart=true loop=true> 
<noembed><bgsound src="america2.mi" loop=1></noembed> 
</html>



Script for timer controlled status bar news is in
http://www.geocities.com/killianrotc/header.htm

And this frame usues <style text/css> and lacks a </head>
http://www.geocities.com/killianrotc/home.htm

    
    

    
  
Owen's incidents Talkback IDs TB464712Z and TB464710K:
nsEntryStack::Pop()
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/htmlparser/src/nsDTDUtils.cpp,
line 295]
nsDTDContext::Pop() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/htmlparser/src/nsDTDUtils.cpp,
line 1040]
CNavDTD::CloseContainersTo() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/htmlparser/src/CNavDTD.cpp,
line 3577]
CNavDTD::CloseContainersTo() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/htmlparser/src/CNavDTD.cpp,
line 3767]
CNavDTD::HandleEndToken() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/htmlparser/src/CNavDTD.cpp,
line 2097]
CNavDTD::HandleToken() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/htmlparser/src/CNavDTD.cpp,
line 1022]
CNavDTD::BuildModel() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/htmlparser/src/CNavDTD.cpp,
line 510]
nsParser::BuildModel() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/htmlparser/src/nsParser.cpp,
line 704]
nsParser::ResumeParse() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/htmlparser/src/nsParser.cpp,
line 1761]
nsParser::OnDataAvailable() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/htmlparser/src/nsParser.cpp,
line 2426]
nsDocumentOpenInfo::OnDataAvailable() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/uriloader/base/nsURILoader.cpp,
line 710]
nsHTTPCompressConv::do_OnDataAvailable() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/streamconv/converters/nsHTTPCompressConv.cpp,
line 364]
nsHTTPCompressConv::OnDataAvailable() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/streamconv/converters/nsHTTPCompressConv.cpp,
line 291]
nsHttpChannel::OnDataAvailable() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp,
line 3631]
nsInputStreamPump::OnStateTransfer() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 436]
nsInputStreamPump::OnInputStreamReady() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 337]
nsInputStreamReadyEvent::EventHandler()
PL_HandleEvent() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/plevent.c,
line 674]
PL_ProcessPendingEvents() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/plevent.c,
line 608]
nsEventQueueImpl::ProcessPendingEvents() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/nsEventQueue.cpp,
line 395]
event_processor_callback() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 67]
libglib-2.0.so.0 + 0x4ba4b (0x40604a4b)
libglib-2.0.so.0 + 0x26a99 (0x405dfa99)
libglib-2.0.so.0 + 0x24b08 (0x405ddb08)
libglib-2.0.so.0 + 0x26fb6 (0x405dffb6)
libglib-2.0.so.0 + 0x25023 (0x405de023)
libgtk-x11-2.0.so.0 + 0x117c43 (0x402cfc43)
nsAppShell::Run() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 144]
nsAppShellService::Run() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 495]
xre_main() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/toolkit/xre/nsAppRunner.cpp,
line 692]
main() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 59]
libc.so.6 + 0x15c4c (0x409bfc4c)

Owen: Your build looks like 0.9 release. Could you retry with actual branch
nightbuild?

Hermann's stack are without symbols, but two of them are in GKPARSER.DLL too.

-> Parser
Component: Browser-General → HTML: Parser
Keywords: talkbackid
Summary: crash in jpeg_get_small → crash in jpeg_get_small [@ nsEntryStack::Pop() ]

    
  
Assignee: general → parser
QA Contact: general

    
    

    
  
Adam,

Huh, now I am not sure what I am building ;) I will pull a branch nightbuild and
we shall see.
QA Contact: owen-bugzilla

    
    

    
  
jpeg_get_small is nowhere near the parser...

    
    

    
  
Boris, I changed component based on stack from TalkBack server. "jpeg_get_small"
in summary is from original report. I would like to ask you if you could
redefine it better based on comments or with your experience (URL should crash
also your build). Thank you!

    
    

    
  
> URL should crash also your build

Not so far (loaded that page a dozen times or so, no crashes).

    
    

    
  
Firefox branch nightbuild is crashing on subframe
<http://www.geocities.com/killianrotc/home.htm> with this stack (TB478628):
nsEntryStack::Pop 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/htmlparser/src/nsDTDUtils.cpp,
line 295]
CNavDTD::CloseContainersTo 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/htmlparser/src/CNavDTD.cpp,
line 3764]
CNavDTD::HandleEndToken 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/htmlparser/src/CNavDTD.cpp,
line 2097]
CNavDTD::HandleToken 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/htmlparser/src/CNavDTD.cpp,
line 1022]
CNavDTD::BuildModel 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/htmlparser/src/CNavDTD.cpp,
line 511]
nsParser::BuildModel 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Depend/mozilla/htmlparser/src/nsParser.cpp,
line 1899]
Summary: crash in jpeg_get_small [@ nsEntryStack::Pop() ] → crash on geocities.com/killianrotc/ [@ nsEntryStack::Pop() ]

    
    

    
  
Website crashes on Mozilla 1.4.2 and 1.7.2 too.
instant crash Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.2) Gecko/20040803,
rightclicked on the link in URL and tried to load
http://www.geocities.com/killianrotc/home.htm into a new tab. 

view-source:http://www.geocities.com/killianrotc/home.htm shows, that the file
doesn´t have a </head> tag:

<html><head><title>...</title>
<style text/css>
a:link{color:blue}
a:visited{color:green}
a:hover{color:red}
</style>
<body ..............

and there is some geocities JS-Code after the </html> tag:

</body>
</html><!-- text below generated by server. PLEASE REMOVE
--></object></layer></div></span></style></noscript></table></script></applet>
<script language="JavaScript">var PUpage="76001077"; var PUprop="geocities";
</script><script language="JavaScript"
src="http://www.geocities.com/js_source/pu5geo.js"> .... more sccript, webbugs.

Talkback: TB489751Y
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB489751Y

    
    

    
  

      
      
      
      

        Attached file
          
        testcase
        — 
      

    


  
Crashes for me too (not all the time though), using:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a6) Gecko/20041128
Firefox/0.9.1+

The most minimal testcase I could come up with is this (made from
http://www.geocities.com/killianrotc/home.htm):
<html><head></head><body>
<a><a><p><font><p><font><b><a></font></a>
</body></html>

This testcase doesn't crash, but it sort of makes my browser unusable when I
load it. After I closed the browser, the browser is still in the memory and I
have to close it with the task manager.
Keywords: testcase

    
    

    
  
Another "real life" crashing page - http://www.rawacoustics.ca/ and clicking on
Subwoofers (TB2246031/FF1.0/W2K).

BTW FF1.0/W2K is having same symptoms as Martinj described in previous comment -
Firefox hang and resist in memory after closing.

    
    

    
  


  
The testcase seems especially to crash easily when pressing th 'Go' button.

    
    

    
  
Taking since I'm investigating this. I have a potential fix/wallpaper for this
crash, but I need to investigate it more. I'm still not entirely certain what
all of the code here is trying to do, so I'm not quite going to attach a patch yet.
Assignee: parser → mrbkap

    
    

    
  

      
      
      
      

        Attached patch
          
          
        wallpaper maybe
        — 
          — Splinter Review
      

    


  
I'm not sure if this is a real fix or a wallpaper. It stops us from crashing
and doesn't change our behavior in any way. I have a feeling that we're
duplicating stack entries or giving a RS stack to a non RS tag.

rbs, any thoughts?

        Attachment #168829 -
        Flags: review?(rbs)

    
    

    
  
Comment on attachment 168829 [details] [diff] [review]
wallpaper maybe

Passing the ball to bz, I thought I could get back to this, but I have been
swamped by end-of-year things.

        Attachment #168829 -
        Flags: review?(rbs) → review?(bzbarsky)

    
    

    
  
I'll try to get to this before alpha freeze, but don't hold your breath on that.... :(

    
    

    
  
Comment on attachment 168829 [details] [diff] [review]
wallpaper maybe

r=bzbarsky, but could we at least warn here?

        Attachment #168829 -
        Flags: review?(bzbarsky) → review+

    
    

    
  
Comment on attachment 168829 [details] [diff] [review]
wallpaper maybe

I've changed the if statement to:

NS_ENSURE_TRUE(scount > 0, result);

        Attachment #168829 -
        Flags: superreview?(rbs)

    
    

    
  
I'm not getting a crash on this site.
But if there is need for a fix. *shrugs*

    
    

    
  
Comment on attachment 168829 [details] [diff] [review]
wallpaper maybe

Asking brendan for sr= in hopes of getting this in 1.8b. Brendan, please see
comment 21 and comment 22.

        Attachment #168829 -
        Flags: superreview?(rbs) → superreview?(brendan)

    
    

    
  
Comment on attachment 168829 [details] [diff] [review]
wallpaper maybe

> NS_ENSURE_TRUE(scount > 0, result);

Sure, although I prefer != 0 to > 0 for unsigned comparisons.  Also, you might
move this line up to just after scount is initialized, and comment what it
means ("that the style stack was empty before we were removed!").

/be

        Attachment #168829 -
        Flags: superreview?(brendan) → superreview+

    
    

    
  
Fix checked in.
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.8beta2

    
    

    
  
parser/htmlparser/tests/crashtests/253979-1.html
http://hg.mozilla.org/mozilla-central/rev/b0337b6287f3
Flags: in-testsuite+
Crash Signature: [@ nsEntryStack::Pop() ]

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: