100451 - Trunk crash in DetermineHTMLParseMode [@ PL_strcmp]

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

DetermineHTMLParseMode will crash if the public ID is strcmp-less than all the
public IDs in the list because I used unsigned ints instead of signed ints. 
Noticed this in talkback.  URL given was
http://www.virtualcities.com/ons/ca/capets.htm .

Fix to be attached.

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I'll also add a comment: 

// These must be signed because maximum can go below zero and we'll crash if
// it's unsigned.

Comment 3

[jag (Peter Annema)]

Comment on attachment 49867 [details] [diff] [review]
patch

r=jag

Comment 4

[Chris Waterson]

Comment on attachment 49867 [details] [diff] [review]
patch

damned unsigned integers! :-) sr=waterson

Comment 5

[harishd]

*** Bug 100512 has been marked as a duplicate of this bug. ***

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Fix checked in 2001-09-19 19:15 PDT.

Comment 7

[Jay Patel [:jay]]

Adding crash, topcrash keywords and Trunk [@ PL_strcmp] to summary for future
reference, as this *was* a topcrasher on the MozillaTrunk:

PL_strcmp   13 
BBID range: 35401265 - 35608442
Min/Max Seconds since last crash: 15 - 47330
Min/Max Runtime: 119 - 157878
Crash data range: 2001-09-14 to 2001-09-19
Build ID range: 2001091409 to 2001091905

Stack Trace: 

	 PL_strcmp
[../../../../lib/libc/src/strcmp.c  line 45]
	 DetermineHTMLParseMode
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp  line 1073]
	 DetermineParseMode
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp  line 1135]
	 nsParser::WillBuildModel
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp  line 1381]
	 nsParser::ResumeParse
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp  line 1854]
	 nsParser::OnDataAvailable
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp  line 2490]
	 nsDocumentOpenInfo::OnDataAvailable
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp  line 245]
	 nsStreamListenerTee::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp  line 57]
	 nsHttpChannel::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line 2255]
	 nsOnDataAvailableEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerProxy.cpp  line 188]
	 PL_HandleEvent
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 591]
	 PL_ProcessPendingEvents
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 524]
	 _md_EventReceiverProc
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1072]
	 nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp  line 442]
	 main1
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1283]
	 main
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1600]
	 WinMain
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1618]
	 WinMainCRTStartup()
	 KERNEL32.DLL + 0x17d08 (0x77e87d08)
 
 	Source File : ../../../../lib/libc/src/strcmp.c line : 45
     (35608442)	Comments: bug 49903
     (35603680)	Comments: bug 100512
     (35586673)	URL: http://www.hw.ac.uk/libWWW/irn/pinakes/pinakes.html
(35586673)
Comments: testing bug 100512
     (35584140)	URL: http://www.hw.ac.uk/libWWW/irn/pinakes/pinakes.html
(35584140)
Comments: opening page
     (35580800)	URL: http://www.hw.ac.uk/libWWW/irn/pinakes/pinakes.html
(35580800)
Comments: opening the above link in a new window (ctrl click)
     (35401265)	URL: http://www.virtualcities.com/ons/ca/capets.htm
(35401265)
Comments: loading the URL  trying a newer build

Comment 8

[Moied]

Verified with Build ID 20011115 on win2k.