Closed Bug 1160891 Opened 9 years ago Closed 4 years ago

Mac crash in nsHtml5TreeOperation::nsHtml5TreeOperation()

Categories

(Core :: DOM: HTML Parser, defect)

Product:
Core
Component:
DOM: HTML Parser
Platform:
Unspecified
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox47 --- affected
firefox48 --- affected
firefox49 --- affected
firefox-esr45 --- affected
firefox50 --- affected
firefox51 --- affected

People

(Reporter: metasieben, Unassigned)

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-9de27f9d-1bff-444f-b02a-948f52150503.
=============================================================
Reporter: Do you have a set of steps to reproduce this bug?  Thanks.
Flags: needinfo?(mozilla)
Sadly no, I wasn't even looking at the window(different desktop) and had no interaction with the browser.

The active tab was a page, automatically refreshing itself every 60 seconds, with the following code:

<!DOCTYPE html>
<meta http-equiv='refresh' content='60'>
<style>*{font:10px/120% Monaco,monospace;color:#333;}td:nth-child(3),.r{text-align:right;}tr:hover td{background:#efefef;}</style>
<table>
<tr><td>&nbsp;</td></tr>
</table>
Flags: needinfo?(mozilla)
Crash Signature: [@ nsHtml5TreeOperation::nsHtml5TreeOperation()] → [@ nsHtml5TreeOperation::nsHtml5TreeOperation()] [@ nsHtml5TreeOperation::nsHtml5TreeOperation]
All crashes *containing* nsHtml5TreeOperation::nsHtml5TreeOperation in signature are Mac
https://crash-stats.mozilla.com/report/list?signature=nsHtml5TreeOperation%3A%3AnsHtml5TreeOperation#tab-reports


> report bp-9de27f9d-1bff-444f-b02a-948f52150503.
> =============================================================

 0 	XUL	nsHtml5TreeOperation::nsHtml5TreeOperation()	parser/html/nsHtml5TreeOperation.cpp
1 	XUL	nsHtml5TreeBuilder::appendElement(void*, void*)	obj-firefox/x86_64/dist/include/nsTArray.h
2 	XUL	nsHtml5TreeBuilder::appendToCurrentNodeAndPushElement(nsHtml5ElementName*, nsHtml5HtmlAttributes*)	parser/html/nsHtml5TreeBuilder.cpp
3 	XUL	nsHtml5TreeBuilder::startTag(nsHtml5ElementName*, nsHtml5HtmlAttributes*, bool)	parser/html/nsHtml5TreeBuilder.cpp
4 	XUL	nsHtml5Tokenizer::emitCurrentTagToken(bool, int)	parser/html/nsHtml5Tokenizer.cpp
5 	XUL	int nsHtml5Tokenizer::stateLoop<nsHtml5SilentPolicy>(int, char16_t, int, char16_t*, bool, int, int)	parser/html/nsHtml5Tokenizer.cpp
6 	XUL	nsHtml5Tokenizer::tokenizeBuffer(nsHtml5UTF16Buffer*)	parser/html/nsHtml5Tokenizer.cpp
7 	XUL	nsHtml5StreamParser::ParseAvailableData()	parser/html/nsHtml5StreamParser.cpp
Severity: major → critical
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: crash
Summary: crash in nsHtml5TreeOperation::nsHtml5TreeOperation() → Mac crash in nsHtml5TreeOperation::nsHtml5TreeOperation()
I hit this crash submitting the form on https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fbashhub.com%2F&t=Bashhub%20%C2%B7%20Every%20command. The progress spinner span for ~10secs then the page crashed.
Crash volume for signature 'nsHtml5TreeOperation::nsHtml5TreeOperation':
 - nightly (version 50): 4 crashes from 2016-06-06.
 - aurora  (version 49): 9 crashes from 2016-06-07.
 - beta    (version 48): 48 crashes from 2016-06-06.
 - release (version 47): 1072 crashes from 2016-05-31.
 - esr     (version 45): 115 crashes from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          0          0          2          1          1          0
 - aurora           0          4          1          0          2          0          2
 - beta             6          4         10          7          7         10          0
 - release        165        138        148        194        178        142         37
 - esr             11          8         10         11          9         12          7

Affected platform: Mac OS X
status-firefox47: --- → affected
status-firefox48: --- → affected
status-firefox49: --- → affected
status-firefox50: --- → affected
status-firefox-esr45: --- → affected
Crash volume for signature 'nsHtml5TreeOperation::nsHtml5TreeOperation':
 - nightly (version 51): 2 crashes from 2016-08-01.
 - aurora  (version 50): 6 crashes from 2016-08-01.
 - beta    (version 49): 17 crashes from 2016-08-02.
 - release (version 48): 137 crashes from 2016-07-25.
 - esr     (version 45): 145 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       0       0       1
 - aurora        1       1       1
 - beta          6       8       2
 - release      46      33      12
 - esr          10      13      12

Affected platforms: Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly           #652
 - aurora  #1672     #229
 - beta    #2814
 - release #389      #198
 - esr     #584
status-firefox51: --- → affected

Closing because no crashes reported for 12 weeks.

Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.