97082 - crashes with null mParser [@ HTMLContentSink::CreateContentObject]

Status: VERIFIED WORKSFORME

(Core :: DOM: HTML Parser, defect, P1)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

There are a number of crashes in talkback at the following stack (this one is
from a 2001082406 build on Windows, so the line numbers are all 1 too high):

HTMLContentSink::CreateContentObject
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 859]
SinkContext::OpenContainer
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 1450]
HTMLContentSink::OpenContainer
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 3378]
CViewSourceHTML::WriteTag
[d:\builds\seamonkey\mozilla\htmlparser\src\nsViewSourceHTML.cpp, line 922]
CViewSourceHTML::HandleToken
[d:\builds\seamonkey\mozilla\htmlparser\src\nsViewSourceHTML.cpp, line 1076]
CViewSourceHTML::BuildModel
[d:\builds\seamonkey\mozilla\htmlparser\src\nsViewSourceHTML.cpp, line 588]
nsParser::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 2222]
nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 2086]
nsParser::ContinueParsing
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1716]
CSSLoaderImpl::Cleanup
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 734]
CSSLoaderImpl::SheetComplete
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 849]
CSSLoaderImpl::ParseSheet
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 884]
CSSLoaderImpl::DidLoadStyle
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 920]
SheetLoadData::OnStreamComplete
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 672]
nsStreamLoader::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamLoader.cpp, line 123]
nsResChannel::EndRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\res\src\nsResChannel.cpp, line 571]
nsResChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\res\src\nsResChannel.cpp, line 555] 


That's the whole stack talkback shows, so it seems a little like there might be
some corruption, but I suspect that's not the case.  The disassembly and
registers make it look like |mParser| is null on line 858:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/html/document/src/nsHTMLContentSink.cpp&rev=3.480&mark=858#841

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

User comments:

     (34490379) Comments: When tried to open a test page through Composer
     (34412634) URL: http://europe.cnn.com/cnnsi/world/europe/
     (34412605) URL: http://europe.cnn.com/cnnsi/world/europe/
     (34314217) URL: http://www.startpagina.nl/
     (34158699) Comments: 8/15/2001 Win32 build.I went to a JA mailcast
unsubscribe URL.That is when it crashed.

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Some of the Linux stacks (but not the Windows ones) seem to be more complete:

<above, down to nsResChannel::OnStopRequest>nsFileChannel::OnStopRequest()
nsOnStopRequestEvent::HandleEvent()
nsARequestObserverEvent::HandlePLEvent()
PL_HandleEvent()
PL_ProcessPendingEvents()
nsEventQueueImpl::ProcessPendingEvents()
event_processor_callback()
our_gdk_io_invoke()
libglib-1.2.so.0 + 0xeaca (0x40340aca)
libglib-1.2.so.0 + 0x10186 (0x40342186)
libglib-1.2.so.0 + 0x10751 (0x40342751)
libglib-1.2.so.0 + 0x108f1 (0x403428f1)
libgtk-1.2.so.0 + 0x8c5b9 (0x402665b9)
nsAppShell::Run()
nsAppShellService::Run()
main1() 

Comment 3

[harishd]

--> 0.9.4

Comment 4

[harishd]

I tried several times on 08/27/01 Win32 build but couldn't reproduce the crash!

Comment 5

[harishd]

no word on this crash. Moving to 0.9.5.

Comment 6

[Jan Carpenter]

This stack signature is not showing up in either the trunk or N610 or M093
topcrash reports.

Comment 7

[harishd]

Marking WFM.

Comment 8

[Moied]

Verified WFM with build ID 20020207 on win2k