12331 - Crash at loading this CSS1 file

Status: VERIFIED FIXED

(Core :: Layout, defect, P2)

Description

[Teruko Kobayashi]

When you go to this url, Apprunner crashes.

Tested this in 8-20 M9 Win 32 and Mac build.

Windows Stack trace is following.

Incident # 12721953
Trigger Type:  Program Crash
Trigger Reason:  Access violation
 Call Stack:    (Signature = CSSLoaderImpl::LoadSheet 05c67f0d)
     CSSLoaderImpl::LoadSheet            [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp, line 1091]
     CSSLoaderImpl::Cleanup                [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp, line 662]
     CSSLoaderImpl::DidLoadStyle         [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp, line 817]
     0x027a7610

Mac stacktrace is following.

Incident # 12724659
Trigger Type:  Program Crash
 Trigger Reason:  PowerPC unmapped memory exception
 Call Stack:    (Signature = 0x622e6768 d6357518)
     0x622e6768
     layout.shlb + 0x2793bc (0x0ab97cbc)
     layout.shlb + 0x279c74 (0x0ab98574)
     layout.shlb + 0x278fd4 (0x0ab978d4)
     nsUnicharStreamLoader::OnStopRequest()               [nsNetStreamLoader.cpp, line 160]
     nsChannelListener::OnStopRequest()                      [nsDocLoader.cpp, line 2409]
     http.shlb + 0x689c (0x0b42b49c)
     Network.shlb + 0xc30 (0x0b5d1bf0)
     Network.shlb + 0x220 (0x0b5d11e0)
     PL_HandleEvent()
     PL_ProcessPendingEvents()
     nsEventQueueImpl::ProcessPendingEvents()            [nsEventQueue.cpp, line 117]
     EventDispatchingFunc()                                        [nsEventQueueService.cpp, line 352]
     _hashEnumerate()                                                [nsHashtable.cpp, line 81]
     PL_HashTableEnumerateEntries()
     nsHashtable::Enumerate()                                      [nsHashtable.cpp, line 210]
     nsEventQueueServiceImpl::ProcessEvents()             [nsEventQueueService.cpp, line 363]
     nsToolkit::RepeatAction()                                      [nsToolkit.cpp, line 144]
     Repeater::DoRepeaters()                                       [nsRepeater.cpp, line 111]
     nsMacMessagePump::DispatchEvent()                      [nsMacMessagePump.cpp, line 329]
     nsMacMessagePump::DoMessagePump()                  [nsMacMessagePump.cpp, line 230]
     nsAppShell::Run()                                                [nsAppShell.cpp, line 94]
     nsAppShellService::Run()                                      [nsAppShellService.cpp, line 469]
     main1()                                                              [nsAppRunner.cpp, line 761]

This happens in http://babel/tests/browser/css/css1/euc/euc-sec11.htm

This did not happen in 8-16 M9 build.

Comment 1

[Peter Linss]

Fixed to prevent loading of deferred alternate sheets after document disconnects
from loader. (Happened because doc re-loaded for charset converter.)

Comment 2

[Teruko Kobayashi]

I verified this in 9-10 Win32, Mac, and Linux build.