131785 - mozilla crashes when I open a html file

Status: VERIFIED DUPLICATE of bug 121841

(Core :: DOM: HTML Parser, defect)

Description

[targon69]

I run Mozilla 0.9.9-1 from Debian/testing.
I have a file which crashes Mozilla whenever it is opened.
I will attach this file in a moment.

-- System Information
Debian Release: 3.0
Architecture: i386
Kernel: Linux aragorn 2.4.17 #1 Don Dez 27 17:58:41 CET 2001 i686
Locale: LANG=C, LC_CTYPE=de_DE@euro

Versions of packages mozilla-browser depends on:
ii  debconf                       1.0.26     Debian configuration management sy
ii  libc6                         2.2.5-3    GNU C Library: Shared libraries an
ii  libglib1.2                    1.2.10-4   The GLib library of C routines
ii  libgtk1.2                     1.2.10-9   The GIMP Toolkit set of widgets fo
ii  libjpeg62                     6b-5       The Independent JPEG Group's JPEG
ii  libnspr4                      2:0.9.9-1  Netscape Portable Runtime Library
ii  libstdc++2.10-glibc2.2        1:2.95.4-1 The GNU stdc++ library
ii  xlibs                         4.1.0-14   X Window System client libraries
ii  zlib1g                        1:1.1.4-1  compression library - runtime

Comment 1

[targon69]

Attachment: Opening this file will crash mozilla.

Comment 2

[Olivier Cahagne]

build 2002031803 hand for me on Win2k.

Reporter, can you post Talkback ID, see 'mozilla/components/talkback/talkback' ?

Comment 3

[Olivier Cahagne]

Attachment: Reduced testcase that make Mozilla hang/crash

Comment 4

[Olivier Cahagne]

Moving to Parser.

Comment 5

[Olivier Cahagne]

Keyword: +testcase

Comment 6

[Andrew Lin]

crashed for me, 0.9.9/Win98.  Had to ctrl-alt-delete so Talkback didn't launch.
 I can't seem to find any duplicates, so marking new

Comment 7

[harishd]

This is the stack I get ( looks very similar to bug 121841 ):

NTDLL! 77f9eea9()
nsDebug::Assertion(const char * 0x10124a58 `string', const char * 0x10124a98
`string', const char * 0x10124920 `string', int 356) line 291 + 13 bytes
nsWritingIterator<unsigned short>::write(const unsigned short * 0x03c0e066,
unsigned int 15) line 356 + 37 bytes
nsCharSinkTraits<nsWritingIterator<unsigned short>
>::write(nsWritingIterator<unsigned short> & {...}, const unsigned short *
0x03c0e066, unsigned int 15) line 559
copy_string(nsReadingIterator<unsigned short> & {...}, const
nsReadingIterator<unsigned short> & {...}, nsWritingIterator<unsigned short> &
{...}) line 90 + 39 bytes
nsAString::do_AppendFromReadable(const nsAString & {...}) line 362 + 55 bytes
nsAString::AppendFromReadable(const nsAString & {...}) line 329
nsAString::Append(const nsAString & {...}) line 282 + 19 bytes
nsAutoString::nsAutoString(const nsAString & {...}) line 1230
nsCommentNode::SetText(nsCommentNode * const 0x03c40108, const nsAString &
{...}, int 0) line 246
nsGenericDOMDataNode::AppendData(const nsAString & {...}) line 508 + 50 bytes
nsCommentNode::AppendData(nsCommentNode * const 0x03c40124, const nsAString &
{...}) line 60 + 18 bytes
SinkContext::AddComment(const nsIParserNode & {...}) line 1957
HTMLContentSink::AddComment(HTMLContentSink * const 0x03bfa110, const
nsIParserNode & {...}) line 3482 + 18 bytes
CNavDTD::HandleCommentToken(CToken * 0x03bf90c8) line 2203 + 34 bytes
CNavDTD::HandleToken(CNavDTD * const 0x03aad0a0, CToken * 0x03bf90c8, nsIParser
* 0x03bf8ee8) line 902 + 12 bytes
CNavDTD::BuildModel(CNavDTD * const 0x03aad0a0, nsIParser * 0x03bf8ee8,
nsITokenizer * 0x03c10370, nsITokenObserver * 0x00000000, nsIContentSink *
0x03bfa110) line 520 + 20 bytes
nsParser::BuildModel() line 2005 + 34 bytes
nsParser::ResumeParse(int 1, int 0, int 1) line 1871 + 11 bytes
nsParser::OnDataAvailable(nsParser * const 0x03bf8eec, nsIRequest * 0x03bc23e8,
nsISupports * 0x00000000, nsIInputStream * 0x03bedab8, unsigned int 0, unsigned
int 2376) line 2494 + 21 bytes
nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const 0x03bc2e40,
nsIRequest * 0x03bc23e8, nsISupports * 0x00000000, nsIInputStream * 0x03bedab8,
unsigned int 0, unsigned int 2376) line 241 + 46 bytes
nsStreamListenerTee::OnDataAvailable(nsStreamListenerTee * const 0x03b53a98,
nsIRequest * 0x03bc23e8, nsISupports * 0x00000000, nsIInputStream * 0x03bef178,
unsigned int 0, unsigned int 2376) line 56 + 51 bytes
nsHttpChannel::OnDataAvailable(nsHttpChannel * const 0x03bc23ec, nsIRequest *
0x03bef3a4, nsISupports * 0x00000000, nsIInputStream * 0x03bef178, unsigned int
0, unsigned int 2376) line 2573 + 57 bytes
nsOnDataAvailableEvent::HandleEvent() line 193 + 70 bytes
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x0384316c) line 116
PL_HandleEvent(PLEvent * 0x0384316c) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x0145eb40) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x0010095e, unsigned int 49475, unsigned int 0,
long 21359424) line 1071 + 9 bytes
USER32! 77e148dc()
USER32! 77e14aa7()
USER32! 77e266fd()


*** This bug has been marked as a duplicate of 121841 ***

Comment 8

[Moied]

Verified dup