34882 - regression in table tests - crash creating doc element

Status: VERIFIED DUPLICATE of bug 17412

(Core :: Layout, defect, P3)

Description

[karnaze (gone)]

Harish, I assigned a similar bug to you before. Please handle this similarly. 
There is xul inside this html file, which I assume is ok, since it worked 
previously.

nsCSSFrameConstructor::ConstructDocElementFrame(nsIPresShell * 0x024fe610, 
nsIPresContext * 0x02490030, nsFrameConstructorState & {...}, nsIContent * 
0x0249fa78, nsIFrame * 0x011f2894, nsIStyleContext * 0x026f43c0, nsIFrame * & 
0x0031edb6) line 3185 + 30 bytes
nsCSSFrameConstructor::ContentInserted(nsCSSFrameConstructor * const 0x024fe910, 
nsIPresContext * 0x02490030, nsIContent * 0x00000000, nsIContent * 0x0249fa78, 
int 0, nsILayoutHistoryState * 0x00000000) line 8009
StyleSetImpl::ContentInserted(StyleSetImpl * const 0x024fe9d0, nsIPresContext * 
0x02490030, nsIContent * 0x00000000, nsIContent * 0x0249fa78, int 0) line 1028
PresShell::InitialReflow(PresShell * const 0x024fe610, int 11370, int 8895) line 
1461
HTMLContentSink::StartLayout() line 3223
HTMLContentSink::OpenBody(HTMLContentSink * const 0x0249fcc0, const 
nsIParserNode & {...}) line 2707
CNavDTD::OpenBody(const nsIParserNode * 0x024fa500) line 2673 + 31 bytes
CNavDTD::OpenContainer(const nsIParserNode * 0x024fa500, nsHTMLTag 
eHTMLTag_body, int 1, nsEntryStack * 0x00000000) line 2926 + 12 bytes
CNavDTD::HandleDefaultStartToken(CToken * 0x024ef1d0, nsHTMLTag eHTMLTag_body, 
nsIParserNode * 0x024fa500) line 1086 + 20 bytes
CNavDTD::HandleStartToken(CToken * 0x024ef1d0) line 1424 + 22 bytes
CNavDTD::HandleToken(CNavDTD * const 0x024fac20, CToken * 0x024ef1d0, nsIParser 
* 0x0249e520) line 771 + 12 bytes
CNavDTD::HandleToken(CNavDTD * const 0x024fac20, CToken * 0x024f0e00, nsIParser 
* 0x0249e520) line 728 + 20 bytes
CNavDTD::BuildModel(CNavDTD * const 0x024fac20, nsIParser * 0x0249e520, 
nsITokenizer * 0x024fa6b0, nsITokenObserver * 0x00000000, nsIContentSink * 
0x0249fcc0) line 509 + 20 bytes
nsParser::BuildModel() line 1298 + 34 bytes
nsParser::ResumeParse(int 1, int 0) line 1182 + 11 bytes
nsParser::OnDataAvailable(nsParser * const 0x0249e524, nsIChannel * 0x0249c670, 
nsISupports * 0x00000000, nsIInputStream * 0x0249ee5c, unsigned int 0, unsigned 
int 713) line 1616 + 19 bytes
nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const 0x0249d280, 
nsIChannel * 0x0249c670, nsISupports * 0x00000000, nsIInputStream * 0x0249ee5c, 
unsigned int 0, unsigned int 713) line 269 + 46 bytes
nsFileChannel::OnDataAvailable(nsFileChannel * const 0x0249c674, nsIChannel * 
0x0249ddf0, nsISupports * 0x00000000, nsIInputStream * 0x0249ee5c, unsigned int 
0, unsigned int 713) line 625 + 49 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x02497f90) 
line 406 + 47 bytes
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x02492690) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x02492690) line 563 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x012c19b0) line 508 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x020701f6, unsigned int 49406, unsigned int 0, 
long 19667376) line 1018 + 9 bytes
USER32! 77e71820()

Comment 1

[harishd]

Reassigning to rickg.

Comment 2

[rickg]

The *most* we'll be able to do is not blow up. But the fact that we're given a 
XUL document and told it's HTML is bad. Once I stop the madness in the parser, 
I'll forward this to judson to correct the doc id problem.

Comment 3

[karnaze (gone)]

Another possibility is that this test case is not valid, but only Hyatt knows 
for sure.

Comment 4

[rickg]

I've run a few tests like this, where I'm given XUL/XML but told text/html as 
the mimetype. The parsing engine seems to deal with it ok. When I get back to 
the office, I'll try the test you cite explicity. Also: we might want to get jud 
involved since he's the one who owns the code that's claiming this is HTML and 
not XUL/XML.

Comment 5

[harishd]

*** This bug has been marked as a duplicate of 17412 ***

Comment 6

[Chris Petersen]

Marking verified dup of 17412.