21214 - browser crashes on my netscape news item

Status: VERIFIED DUPLICATE of bug 20645

(Core :: Layout, defect, P3)

Description

[David :Bienvenu]

First, I hit the following assert:    NS_ASSERTION(mStackPos > 0, "container w/o
parent"); in nsHTMLContentSink, line 1256. After the assert, I crash with the
stack below.


SinkContext::CloseContainer(const nsIParserNode & {...}) line 1255 + 38 bytes
HTMLContentSink::CloseContainer(HTMLContentSink * const 0x02c56950, const
nsIParserNode & {...}) line 2760 + 15 bytes
CNavDTD::CloseContainer(const nsIParserNode * 0x02c72e80, nsHTMLTag eHTMLTag_td,
int 0x00000001) line 2905 + 31 bytes
CNavDTD::CloseContainersTo(int 0x00000006, nsHTMLTag eHTMLTag_td, int
0x00000001) line 2939 + 20 bytes
CNavDTD::HandleDefaultStartToken(CToken * 0x01eab1d0, nsHTMLTag eHTMLTag_td,
nsIParserNode * 0x02c490b0) line 1033
CNavDTD::HandleStartToken(CToken * 0x01eab1d0) line 1353 + 22 bytes
CNavDTD::HandleToken(CNavDTD * const 0x02c19540, CToken * 0x01eab1d0, nsIParser
* 0x02c55540) line 752 + 12 bytes
CNavDTD::HandleSavedTokens(int 0x00000006) line 1658 + 23 bytes
CNavDTD::HandleOmittedTag(CToken * 0x01eb5ea0, nsHTMLTag eHTMLTag_p, nsHTMLTag
eHTMLTag_tbody, nsIParserNode * 0x02c38f40) line 1239 + 12 bytes
CNavDTD::HandleDefaultStartToken(CToken * 0x01eb5ea0, nsHTMLTag eHTMLTag_p,
nsIParserNode * 0x02c38f40) line 987 + 24 bytes
CNavDTD::HandleStartToken(CToken * 0x01eb5ea0) line 1353 + 22 bytes
CNavDTD::HandleToken(CNavDTD * const 0x02c19540, CToken * 0x01eb5ea0, nsIParser
* 0x02c55540) line 752 + 12 bytes
CNavDTD::BuildModel(CNavDTD * const 0x02c19540, nsIParser * 0x02c55540,
nsITokenizer * 0x02c198d0, nsITokenObserver * 0x00000000, nsIContentSink *
0x02c56950) line 524 + 20 bytes
nsParser::BuildModel() line 1040 + 34 bytes
nsParser::ResumeParse(nsIDTD * 0x00000000, int 0x00000000) line 966 + 11 bytes
nsParser::EnableParser(int 0x00000001) line 683 + 15 bytes
HTMLContentSink::ResumeParsing() line 3762 + 19 bytes
HTMLContentSink::OnUnicharStreamComplete(HTMLContentSink * const 0x02c56954,
nsIUnicharStreamLoader * 0x027e4900, unsigned int 0x00000000, unsigned int
0x000036c8, const unsigned short * 0x02088ff0) line 3855 + 11 bytes
nsUnicharStreamLoader::OnStopRequest(nsUnicharStreamLoader * const 0x027e4904,
nsIChannel * 0x027e4550, nsISupports * 0x00000000, unsigned int 0x00000000,
const unsigned short * 0x00000000) line 130 + 63 bytes
nsChannelListener::OnStopRequest(nsChannelListener * const 0x02b49060,
nsIChannel * 0x027e4550, nsISupports * 0x00000000, unsigned int 0x00000000,
const unsigned short * 0x00000000) line 1590
nsHTTPResponseListener::OnStopRequest(nsHTTPResponseListener * const 0x02b3a420,
nsIChannel * 0x027e8430, nsISupports * 0x027e4550, unsigned int 0x00000000,
const unsigned short * 0x00000000) line 255 + 56 bytes
nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x02b4b4f0) line
279
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x02b4b4a0) line 93 + 12 bytes
PL_HandleEvent(PLEvent * 0x02b4b4a0) line 522 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00c750e0) line 483 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x166201ea, unsigned int 0x0000c0da, unsigned int
0x00000000, long 0x00c750e0) line 947 + 9 bytes
USER32! 77e71268()

Comment 1

[David :Bienvenu]

this no longer crashes after the fix to 20645, which had the exact same stack
trace, so I'm marking this a dup.

*** This bug has been marked as a duplicate of 20645 ***

Comment 2

[Chris Petersen]

Marking as verified dup of 20645.

Comment 3

[Pulsebot]

Pushed by ffxbld-merge:
https://hg.mozilla.org/releases/mozilla-beta/rev/de8c8780e72f
[fenix] Update Android Components version to 94.0.20210909143340. (https://github.com/mozilla-mobile/fenix/pull/21214)