Closed Bug 1293978 Opened 8 years ago Closed 8 years ago

Crash in memcpy | nsHtml5TreeBuilder::accumulateCharacters

Categories

(Core :: DOM: HTML Parser, defect)

Product:
Core
Component:
DOM: HTML Parser
Version:
49 Branch
Platform:
x86
Windows
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1286911
Tracking Flags:
Tracking Status
firefox48 --- unaffected
firefox49 --- affected
firefox50 --- affected
firefox51 --- ?

People

(Reporter: philipp, Unassigned)

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-160256e1-f215-4c88-ba83-471dc2160810.
=============================================================
Crashing Thread (34)
Frame 	Module 	Signature 	Source
0 	vcruntime140.dll 	memcpy 	f:\dd\vctools\crt\vcruntime\src\string\i386\memcpy.asm:194
1 	xul.dll 	nsHtml5TreeBuilder::accumulateCharacters(char16_t const*, int, int) 	parser/html/nsHtml5TreeBuilderCppSupplement.h:960
2 	xul.dll 	nsHtml5TreeBuilder::characters(char16_t const*, int, int) 	parser/html/nsHtml5TreeBuilder.cpp:454
3 	xul.dll 	nsHtml5Tokenizer::flushChars(char16_t*, int) 	parser/html/nsHtml5Tokenizer.cpp:273
4 	xul.dll 	nsHtml5Tokenizer::emitCarriageReturn(char16_t*, int) 	parser/html/nsHtml5Tokenizer.cpp:3473
5 	xul.dll 	nsHtml5Tokenizer::stateLoop<nsHtml5SilentPolicy>(int, char16_t, int, char16_t*, bool, int, int) 	parser/html/nsHtml5Tokenizer.cpp:1831
6 	xul.dll 	nsHtml5Tokenizer::tokenizeBuffer(nsHtml5UTF16Buffer*) 	parser/html/nsHtml5Tokenizer.cpp:405
7 	xul.dll 	nsHtml5StreamParser::ParseAvailableData() 	parser/html/nsHtml5StreamParser.cpp:1414
8 	xul.dll 	nsHtml5StreamParser::DoDataAvailable(unsigned char const*, unsigned int) 	parser/html/nsHtml5StreamParser.cpp:1111

this crash on windows seems to be regressing since firefox 48 nightly builds and in numbers since firefox 49 beta (msvc switch?). this is currently the #40 browser crash in 49.0b1 making up 0.26% of all crashes.
status-firefox49: --- → affected
status-firefox50: --- → affected
status-firefox51: --- → ?
Status: NEW → RESOLVED
Closed: 8 years ago
Keywords: regression
Resolution: --- → DUPLICATE
Group: dom-core-security
Group: dom-core-security
You need to log in before you can comment on or make changes to this bug.