1420345 - Crash in nsHtml5TreeBuilder::appendToCurrentNodeAndPushElementMayFoster

Status: RESOLVED DUPLICATE of bug 1418000

(Core :: DOM: HTML Parser, defect, P1)

Description

[Randell Jesup [:jesup] (needinfo me)]

This bug was filed from the Socorro interface and is
report bp-cf55a05e-4157-4fcd-a819-14ada0171123.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll nsHtml5TreeBuilder::appendToCurrentNodeAndPushElementMayFoster parser/html/nsHtml5TreeBuilder.cpp:4257
1 xul.dll nsHtml5TreeBuilder::startTag parser/html/nsHtml5TreeBuilder.cpp:1109
2 xul.dll nsHtml5Tokenizer::emitCurrentTagToken parser/html/nsHtml5Tokenizer.cpp:342
3 xul.dll nsHtml5Tokenizer::stateLoop<nsHtml5SilentPolicy> parser/html/nsHtml5Tokenizer.cpp:2329
4 xul.dll nsHtml5Tokenizer::tokenizeBuffer parser/html/nsHtml5Tokenizer.cpp:449
5 xul.dll nsHtml5Parser::Parse parser/html/nsHtml5Parser.cpp:388
6 xul.dll nsHTMLDocument::WriteCommon dom/html/nsHTMLDocument.cpp:2029
7 xul.dll nsHTMLDocument::WriteCommon dom/html/nsHTMLDocument.cpp:1917
8 xul.dll mozilla::dom::HTMLDocumentBinding::write dom/bindings/HTMLDocumentBinding.cpp:652
9 xul.dll mozilla::dom::GenericBindingMethod dom/bindings/BindingUtils.cpp:3040

=============================================================

New crash in 58.0b4; no other crashes in crash-stats

Henri is off right now; anyone else who can look at this?

Comment 1

[Andrew Overholt [:overholt]]

Maybe Alphan or smaug can take a look? (It's already the weekend for Alphan and almost the weekend for Olli)

Comment 2

[Henri Sivonen (:hsivonen)]

The part of the stack that shows where the JS is called from looks like this is a duplicate of bug 1418000. I'd treat this as such unless evidence of this crash is builds where that bug is fixed shows up.

Comment 3

[Alphan Chen [:alchen]]

I would like to know more about bug 1418000.
Could someone help?
Thanks.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

That bug landed to beta 2017-11-23 
https://hg.mozilla.org/releases/mozilla-beta/rev/3039d8099e94

Comment 5

[Ryan VanderMeulen [:RyanVM]]

No crashes from 58b5 onwards, which fits exactly with when bug 1418000 was uplifted.