Closed Bug 1277517 Opened 8 years ago Closed 8 years ago

Firefox crashes on pale moon forums mozilla::dom::Element::UnbindFromTree

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Version:
46 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 485941

People

(Reporter: kalviskajaks, Unassigned)

References

(
URL
)

Details

(Keywords: crash, reproducible)

Crash Data

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:46.0) Gecko/20100101 Firefox/46.0
Build ID: 20160502172042

Steps to reproduce:

Go to https://forum.palemoon.org/viewtopic.php?t=9999 for example



Actual results:

Browser or tab crashes depending if e10s is enabled. BOTH release 46.0.1 and nightly 49 are affected. Happens on a newly created profile with no addons.

https://crash-stats.mozilla.com/report/index/2388cacd-75f2-4c0b-983a-0075b2160602

https://crash-stats.mozilla.com/report/index/55992de8-d9b1-4fbe-85a2-f431b2160602


Expected results:

the webpage should open without crashing.
Crash Signature: mozilla::dom::Element::UnbindFromTree
[Tracking Requested - why for this release]:

[Tracking Requested - why for this release]:

[Tracking Requested - why for this release]: crash w/ and w/o e10s
Severity: normal → critical
Status: UNCONFIRMED → NEW
status-firefox46: --- → wontfix
status-firefox47: --- → affected
status-firefox48: --- → affected
status-firefox49: --- → affected
status-firefox-esr38: --- → wontfix
status-firefox-esr45: --- → affected
tracking-firefox47: --- → ?
tracking-firefox48: --- → ?
tracking-firefox49: --- → ?
tracking-firefox-esr45: --- → ?
Ever confirmed: true
Keywords: crash, reproducible
Component: Untriaged → DOM
Product: Firefox → Core
stack overflow. So over deep DOM tree in the page. Trying to reproduce...
So far no luck reproducing here, on 64bit linux.
Tried e10s and non-e10s, local build and nightly build.
https://forum.palemoon.org/viewtopic.php?f=4&t=12166
has 2 linux users saying it doesnt crash, and several windows ones saying it does. Seems to be a windows(possibly Mac) only crash?
(In reply to kalviskajaks from comment #4)
> https://forum.palemoon.org/viewtopic.php?f=4&t=12166
> has 2 linux users saying it doesnt crash, and several windows ones saying it
> does. Seems to be a windows(possibly Mac) only crash?

All the crashes in crash stats seem to be Windows, and I cannot reproduce the crash on Mac as of yet.
The crash was reproduced on 32bit Firefox Windwos10 64bit.

However, now, I cannot reproduce the crash anymore. 
It seems the site has fix something their page code or data or ads.
In the linked thread https://forum.palemoon.org/viewtopic.php?f=4&t=12166 Pale Moon developer says 
"Should be fixed on the forum site now, it was hitting (CVE-2009-1232) Stack overflow using overly-deep XML tree due to a bogus Bing site data XML."
So this bug? https://bugzilla.mozilla.org/show_bug.cgi?id=485941
let's dup.
Status: NEW → RESOLVED
Closed: 8 years ago
status-firefox46: wontfix → ---
status-firefox47: affected → ---
status-firefox48: affected → ---
status-firefox49: affected → ---
status-firefox-esr38: wontfix → ---
status-firefox-esr45: affected → ---
tracking-firefox47: ? → ---
tracking-firefox48: ? → ---
tracking-firefox49: ? → ---
tracking-firefox-esr45: ? → ---
Resolution: --- → DUPLICATE
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.