536097 - [HTML5][Patch] spinning in nsHtml5TreeBuilder::startTag()?

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, defect, P1)

Description

[Jeff Muizelaar [:jrmuizel]]

I think this has happened to me a couple of times and seems related to using facebook.

Shark gives a call stack of:

98.3%	98.3%	nsHtml5TreeBuilder::startTag(nsHtml5ElementName*, nsHtml5HtmlAttributes*, int)	
0.0%	98.3%	 nsHtml5Tokenizer::emitCurrentTagToken(int, int)	
0.0%	98.3%	  nsHtml5Tokenizer::stateLoop(int, unsigned short, int, unsigned short*, int, int, int)	
0.0%	98.3%	   nsHtml5Tokenizer::tokenizeBuffer(nsHtml5UTF16Buffer*)	
0.0%	98.3%	    nsHtml5StreamParser::ParseAvailableData()	
0.0%	98.3%	     nsHtml5StreamParserContinuation::Run()	
0.0%	98.3%	      nsThread::ProcessNextEvent(int, int*)	
0.0%	98.3%	       NS_ProcessNextEvent_P(nsIThread*, int)

Comment 1

[Henri Sivonen (:hsivonen)]

Do you mean spinning as in infinite loop or spinning that eventually stops?

Comment 2

[Jeff Muizelaar [:jrmuizel]]

I've never seen it stop, but I haven't waited more than a couple minutes.

Comment 3

[Henri Sivonen (:hsivonen)]

For now, I'll assume this is an infinite loop, because finite but long spinning in that method makes no sense.

Comment 4

[Jeff Muizelaar [:jrmuizel]]

Happened again when logging out of facebook. Same stack.

Comment 5

[Jeff Muizelaar [:jrmuizel]]

Here's a reproducible, though not minimal, test case:
http://people.mozilla.org/~jmuizelaar/html5/600.html

The test case comes from an ad iframe on facebook.

Comment 6

[Henri Sivonen (:hsivonen)]

Oops sorry about the keyword. Great to have a test case already!

Comment 7

[Henri Sivonen (:hsivonen)]

The test case doesn't appear to spin in startTag but instead it returns to the event loop without completing the load.

Comment 8

[Jeff Muizelaar [:jrmuizel]]

It still spins in startTag for me and Joe Drew with trunk. I can try to reduce the test case further if it doesn't work for you.

Comment 9

[Jeff Muizelaar [:jrmuizel]]

I've reduced the test case at http://people.mozilla.org/~jmuizelaar/html5/600.html further. The problem seems related to document.write()

Comment 10

[Henri Sivonen (:hsivonen)]

The problem here is that the tokenizer emits a start tag token for iframe when the tree builder is in the NS_HTML5TREE_BUILDER_TEXT mode. It should be impossible for the tokenizer to emit a start tag token in that case. The document.write()-related state choreography must be faulty somehow.

Comment 11

[Henri Sivonen (:hsivonen)]

Attachment: Fix

Comment 12

[Henri Sivonen (:hsivonen)]

Attachment: More defensive fix

Comment 13

[Henri Sivonen (:hsivonen)]

Attachment: Crashtest

Thanks for catching this!

Comment 14

[Henri Sivonen (:hsivonen)]

http://hg.mozilla.org/mozilla-central/rev/d2dfc88b95d0
http://hg.mozilla.org/mozilla-central/rev/6ff8448d081e