568460 - [HTML5] Crash [@ SelectorMatches ]

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Ria Klaassen (not reading all bugmail)]

STR:

- Set html5.enable to true
- go to URL

http://crash-stats.mozilla.com/report/index/bp-3a67ce8a-bf15-4f91-94a7-4e0f42100527

0  	xul.dll  	SelectorMatches  	 layout/style/nsCSSRuleProcessor.cpp:2076
1 	xul.dll 	SelectorMatches 	layout/style/nsCSSRuleProcessor.cpp:1753
2 	xul.dll 	SelectorMatchesTree 	layout/style/nsCSSRuleProcessor.cpp:2176
3 	xul.dll 	ContentEnumFunc 	layout/style/nsCSSRuleProcessor.cpp:2228
4 	xul.dll 	RuleHash::EnumerateAllRules 	layout/style/nsCSSRuleProcessor.cpp:675
5 	xul.dll 	xul.dll@0x26ed3f 	
6 		@0x8db048f

No problem on Namoroko.

Comment 1

[Ria Klaassen (not reading all bugmail)]

Works: ac1df371f376

Comment 2

[Ria Klaassen (not reading all bugmail)]

Fails: 01af306025cb

Comment 3

[Boris Zbarsky [:bzbarsky]]

http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ac1df371f376&tochange=01af306025cb is the range.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Hrm.  My tip Linux debug build doesn't seem to show the problem... :(

Line 2076 there isn't something I would expect the html parser to affect, also.  I wonder what's going on.

Comment 5

[philippe (part-time)]

Crashes on 10.6 as well.
http://crash-stats.mozilla.com/report/index/095b8045-c6be-4f0c-988f-8d2cd2100527
is pretty useless, but I got a report from Apples Crash reporter (I'll attach the full log next):

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   XUL                           	0x002e74b2 nsRuleNode::GetStyleData(nsStyleStructID, nsStyleContext*, int) + 18
1   XUL                           	0x002f83a3 nsStyleContext::GetStyleData(nsStyleStructID) + 83
2   XUL                           	0x002dff53 nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*, nsRuleData*, nsCSSStruct*) + 1571
3   XUL                           	0x002e78d1 nsRuleNode::GetStyleData(nsStyleStructID, nsStyleContext*, int) + 1073
4   XUL                           	0x002f83a3 nsStyleContext::GetStyleData(nsStyleStructID) + 83
5   XUL                           	0x002dff53 nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*, nsRuleData*, nsCSSStruct*) + 1571
6   XUL                           	0x002e78d1 nsRuleNode::GetStyleData(nsStyleStructID, nsStyleContext*, int) + 1073
7   XUL                           	0x002f83a3 nsStyleContext::GetStyleData(nsStyleStructID) + 83
8   XUL                           	0x002dff53 nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*, nsRuleData*, nsCSSStruct*) + 1571

Comment 6

[philippe (part-time)]

Attachment: crash log, comment 5

Comment 7

[Boris Zbarsky [:bzbarsky]]

That looks like stack overflow.  Henri was working on the deep trees the html5 parser can produce, I think.

Comment 8

[Henri Sivonen (:hsivonen)]

Making the parser clip deep trees before they reach layout is bug 561874.

Comment 9

[Damon Sicore (:damons)]

Blocking 1.9.3 final+.  Regression.

Comment 10

[Henri Sivonen (:hsivonen)]

Bug 561874 landed. Please verify if it fixed this once the nightlies have
cycled.

Comment 11

[philippe (part-time)]

Doesn't crash any more on OS X 10.6.
http://hg.mozilla.org/mozilla-central/rev/6dbc5341b490
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.3a5pre) Gecko/20100604 Minefield/3.7a5pre

Comment 12

[Ria Klaassen (not reading all bugmail)]

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.3a5pre) Gecko/20100604 Minefield/3.7a5pre

Yes, it is fixed now. The page loads fine.