184043 - Mozilla crashes accessing URL [@ SinkContext::Begin]

Status: RESOLVED WORKSFORME

(Core :: DOM: HTML Parser, defect)

Description

[Greg K.]

FizzillaMach/2002120507 crashes at SinkContext::Begin on attempting to access
the URL, <http://www.price.com/mac/>. I was able to reproduce this crash three
times simply by pasting the URL into the URL Bar and pressing return.

Comment 1

[Greg K.]

Attachment: Crash report generated by FizzillaMach/2002120507 showing crash at SinkContext::Begin

Comment 2

[Greg K.]

Chimera/2002120404 accesses the URL successfully. I have both Chimera and
Mozilla configured to ask before accepting cookies, and Mozilla crashes before
presenting the cookie acceptance dialog (indeed, before displaying anything).

Comment 3

[Boris Zbarsky [:bzbarsky]]

(gdb) frame 0
#0  0x40e91450 in SinkContext::Begin (this=0x8a421a8, aNodeType=3671775962, 
    aRoot=0xdadadada, aNumFlushed=-623191334, aInsertionPoint=-1)
    at
/home/bzbarsky/mozilla/debug/mozilla/content/html/document/src/nsHTMLContentSink.cpp:1456
1456      NS_ADDREF(aRoot);

(gdb) frame 1
#1  0x40e96f48 in HTMLContentSink::BeginContext (this=0x8763840, aPosition=2)
    at
/home/bzbarsky/mozilla/debug/mozilla/content/html/document/src/nsHTMLContentSink.cpp:2970
2970                insertionPoint);
(gdb) p mCurrentContext->mStack[aPosition]
$10 = {mType = 3671775962, mContent = 0xdadadada, mFlags = 3671775962, 
  mNumFlushed = -623191334, mInsertionPoint = -623191334}
(gdb) p mCurrentContext->mStack[aPosition-1]
$11 = {mType = eHTMLTag_a, mContent = 0x8a41e60, mFlags = 0, mNumFlushed = 0, 
  mInsertionPoint = -1}

Looks like we're reading out of bounds on the context stack...

Comment 4

[Boris Zbarsky [:bzbarsky]]

Backing out bug 142965 locally fixes this.. (it's already backed out from CVS).

Comment 5

[harishd]

Observation: I was not able to reproduce the crash with or without the patch in
bug 142965 on windows. I'll take Boris's word here :-). Gerg, see if you
reproduce the crash in Monday's ( 12/09 ) build.

Comment 6

[Greg K.]

Boris, didn't you say you reproduced this on PC/Linux?

Comment 7

[Boris Zbarsky [:bzbarsky]]

Oh, yes.  Sorry.  Yes, PC/linux.

Comment 8

[Greg K.]

Maybe it's only apparent on Unix-oriented builds, then?

Comment 9

[Greg K.]

FizzillaMach/2002120907 doesn't crash accessing the URL.

Comment 10

[Greg K.]

No further sign of this crash using FizzillaMach/2003020603.