105896 - Crash on content-type text/xml

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Christian Schmidt]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.5+) 
Gecko/20011018
BuildID:    20011018

When I access a page with content-type text/xml and reload the page, Mozilla 
crashes.

Reproducible: Always

Steps to Reproduce:
1. Go to http://www.mozillaquestquest.com
2. Reload page
3. Reload page

Actual Results:  Mozilla crashes

Expected Results:  Mozilla should reload and display page

Talkback incident ID: TB36972120M

Comment 1

[Christian Schmidt]

Attachment: Very simple testcase

Comment 2

[Christian Schmidt]

This is a recent regression. It works with 0.9.5.

Talkback incident ID for attachment 54410 [details]: TB36972234K

Comment 3

[Olivier Cahagne]

wfm using build 2001101909 on Win2k (both URL and testcase).

Comment 4

[Ashley Bischoff (blog at handcoding.com)]

WFM 2001101909 on Win2k (url and testcase)

Reporter: Could you try a fresh profile? You can manage/create profiles with
"mozilla.exe -profilemanager".

CC: [e-mail], for talkback retrieval, please (TB36972234K)

Comment 5

[Oliver Klee]

Confirming for URL and testcase on 2001101909 Win2k.

Comment 6

[Christian Schmidt]

I experience the same behaviour even with a new profile and build 2001101909.

I appears to be the third text/xml-page in a session that crashes Mozilla. The 
following steps also reproduce the problem:

1. Visit http://bugzilla.mozilla.org/showattachment.cgi?attach_id=54410
2. Visit some other page
3. Visit http://bugzilla.mozilla.org/showattachment.cgi?attach_id=54410
4. Visit some other page
5. Visit http://bugzilla.mozilla.org/showattachment.cgi?attach_id=54410


BTW www.mozillaquestquest.com seems to alternate between the real site and a 
message from the ISP about the site being temporarily unavailable, so the site 
is probably a bad testcase.

Comment 7

[[e-mail] (gone - use [e-mail] instead)]

Incident ID 36972234 
Stack Signature 0x02bba308 4ce7fce7  
Bug ID  
Trigger Time  2001-10-21 05:35:05  
Email Address  [e-mail]  
URL visited  http://www.mozillaquestquest.com/  
User Comments   
Build ID 2001101806  
Product ID MozillaTrunk  
Platform ID Win32  
Trigger Reason Access violation  
Stack Trace  
0x02bba308 
nsGetServiceByCID::operator() 
[d:\builds\seamonkey\mozilla\xpcom\components\nsComponentManager.cpp, line 218] 
nsCOMPtr_base::assign_from_helper 
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 81] 
nsScanner::SetDocumentCharset 
[d:\builds\seamonkey\mozilla\htmlparser\src\nsScanner.cpp, line 193] 
nsScanner::nsScanner [d:\builds\seamonkey\mozilla\htmlparser\src\nsScanner.cpp, 
line 154] 
nsParser::Parse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 
1618] 
nsXMLDocument::StartDocumentLoad 
[d:\builds\seamonkey\mozilla\content\xml\document\src\nsXMLDocument.cpp, line 
605] 
nsContentDLF::CreateDocument 
[d:\builds\seamonkey\mozilla\content\build\nsContentDLF.cpp, line 333] 
nsContentDLF::CreateInstance 
[d:\builds\seamonkey\mozilla\content\build\nsContentDLF.cpp, line 233] 
nsDocShell::NewContentViewerObj 
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 3935] 
nsDocShell::CreateContentViewer 
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 3819] 
nsDSURIContentListener::DoContent 
[d:\builds\seamonkey\mozilla\docshell\base\nsDSURIContentListener.cpp, line 
107] 
nsDocumentOpenInfo::DispatchContent 
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 374] 
nsDocumentOpenInfo::OnStartRequest 
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 242] 
nsHttpChannel::ProcessNormal 
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 
579] 
nsHttpChannel::ProcessResponse 
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 
549] 
nsOnStartRequestEvent::HandleEvent 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 
126] 
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591] 
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 524] 
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 1072] 
nsAppShellService::Run 
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 305] 
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1297] 
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1610] 
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1628] 
WinMainCRTStartup() 
KERNEL32.DLL + 0x17d08 (0x77e97d08) 

Comment 8

[Oliver Klee]

I had TB36985964E and TB36985957M.

Comment 9

[Boris Zbarsky [:bzbarsky]]

Parser based on the stack

Comment 10

[harishd]

serviceEntry->mObject, in nsComponentManagerImpl::GetService, seems to be
invalid. CCing dp for input.

Comment 11

[harishd]

Here is my 2cents on the checkin that might have contributed to the crash.

http://bonsai.mozilla.org/cvsview2.cgi?diff_mode=context&whitespace_mode=show&file=nsXMLDocument.cpp&root=/cvsroot&subdir=mozilla/content/xml/document/src&command=DIFF_FRAMESET&rev1=1.131&rev2=1.132

CCing shanjian.

Comment 12

[Suresh Duddi (gone)]

Yeah this sure looks like an extra release that is causing this. ServiceManager
is left holding on to a deleted object.

From the checkin harishd pointed to, there is a COMPtr and an extra
ReleaseService being done on calias. The ReleaseService() should be removed.

Nice find harishd.

Comment 13

[harishd]

Attachment: patch v1.0

Comment 14

[Chris Waterson]

Comment on attachment 54523 [details] [diff] [review]
patch v1.0

sr=waterson

Comment 15

[harishd]

fix is in.

Comment 16

[Moied]

Verified Fixed on build ID 2001-10-22, No crashes on URL and Testcase tested on
Win2k, Linux and MacOSX.
Setting bug to Verified and adding keyword vtrunk

Comment 17

[Moied]

Changing status to verified