562089 - Crash in [@ 0x0 | HTMLContentSink::WillBuildModel(nsDTDMode)]

Status: RESOLVED WORKSFORME

(Core :: DOM: HTML Parser, defect)

Description

[Marcia Knous [:marcia]]

Seen while reviewing crash data and using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.3a5pre) Gecko/20100427 Minefield/3.7a5pre I am able to reproduce.

STR:
1. Load site in URL.
2. Crash.

https://crash-stats.mozilla.com/report/index/8a4dc7c9-0442-4fbd-a4c9-7ef3f2100427

Frame  	Module  	Signature [Expand]  	Source
0 		@0x0 	
1 	XUL 	HTMLContentSink::WillBuildModel 	content/html/document/src/nsHTMLContentSink.cpp:1673
2 	XUL 	nsParser::WillBuildModel 	parser/htmlparser/src/nsParser.cpp:1561
3 	XUL 	nsParser::ResumeParse 	parser/htmlparser/src/nsParser.cpp:2298
4 	XUL 	nsParser::OnDataAvailable 	parser/htmlparser/src/nsParser.cpp:2955
5 	XUL 	nsHTTPCompressConv::do_OnDataAvailable 	netwerk/streamconv/converters/nsHTTPCompressConv.cpp:375
6 	XUL 	nsHTTPCompressConv::OnDataAvailable 	netwerk/streamconv/converters/nsHTTPCompressConv.cpp:319
7 	XUL 	nsStreamListenerTee::OnDataAvailable 	netwerk/base/src/nsStreamListenerTee.cpp:111
8 	XUL 	nsHttpChannel::OnDataAvailable 	netwerk/protocol/http/src/nsHttpChannel.cpp:5382
9 	XUL 	nsInputStreamPump::OnStateTransfer 	netwerk/base/src/nsInputStreamPump.cpp:510
10 	XUL 	nsInputStreamPump::OnInputStreamReady 	netwerk/base/src/nsInputStreamPump.cpp:400
11 	XUL 	nsInputStreamReadyEvent::Run 	xpcom/io/nsStreamUtils.cpp:112
12 	XUL 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:527
13 	XUL 	NS_ProcessPendingEvents_P 	nsThreadUtils.cpp:200
14 	XUL 	nsBaseAppShell::NativeEventCallback 	widget/src/xpwidgets/nsBaseAppShell.cpp:125
15 	XUL 	nsAppShell::ProcessGeckoEvents 	widget/src/cocoa/nsAppShell.mm:394
16 	CoreFoundation 	__CFRunLoopDoSources0 	
17 	CoreFoundation 	__CFRunLoopRun 	
18 	CoreFoundation 	CFRunLoopRunSpecific 	
19 	CoreFoundation 	CFRunLoopRunInMode 	
20 	HIToolbox 	RunCurrentEventLoopInMode 	
21 	HIToolbox 	ReceiveNextEventCommon 	
22 	HIToolbox 	BlockUntilNextEventMatchingListInMode 	
23 	AppKit 	_DPSNextEvent 	
24 	AppKit 	-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 	
25 	AppKit 	-[NSApplication run] 	
26 	XUL 	nsAppShell::Run 	widget/src/cocoa/nsAppShell.mm:747
27 	XUL 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:182
28 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3551
29 	firefox-bin 	main 	browser/app/nsBrowserApp.cpp:158
30 	firefox-bin 	firefox-bin@0xbf5 	
31 		@0x2

Comment 1

[Marcia Knous [:marcia]]

Added the URL that causes the crash.

Comment 2

[Marcia Knous [:marcia]]

Have not yet been able to reproduce on Windows. Using the Mac build I crashed the first time, but was not able to reproduce the crash using the URL.

Comment 3

[Marcia Knous [:marcia]]

Another site that crashes pretty easily in this stack: http://www.letterheady.com. I simply expanded the "Popular" tab and when I opened one of the links I crashed. Have been able to repro on this site.

https://crash-stats.mozilla.com/report/index/bp-b32ac117-f8a6-443a-8d09-396402100503 is the link to that crash.

Comment 4

[Marcia Knous [:marcia]]

I am able to reproduce this on Windows vista but I get the same stack listed in Bug 563573 so this may be a dupe of that bug. I will wait to see what happens after that bug is fixed.

Comment 5

[Martijn Wargers (dead)]

Wfm, using:
Mozilla/5.0 (Windows NT 6.1; rv:2.0b6pre) Gecko/20100909 Firefox/4.0b6pre

Comment 6

[Wayne Mery (:wsmwk)]

(In reply to Marcia Knous [:marcia] from comment #4)
> I am able to reproduce this on Windows vista but I get the same stack listed
> in Bug 563573 so this may be a dupe of that bug. I will wait to see what
> happens after that bug is fixed.

still able to reproduce now?

I was not able to

Comment 7

[Wayne Mery (:wsmwk)]

WFM based on prior comments