1748482 - Crash in [@ nsParser::OnStartRequest]

Status: RESOLVED FIXED

(Core :: XML, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

This signature remained after the fix for bug 1747264.

Crash report: https://crash-stats.mozilla.org/report/index/467c3e70-a464-45d7-8437-8c94b0220104

Reason: EXCEPTION_ACCESS_VIOLATION_WRITE

Top 10 frames of crashing thread:

0 xul.dll nsParser::OnStartRequest parser/htmlparser/nsParser.cpp:1072
1 xul.dll mozilla::image::SVGDocumentWrapper::OnStartRequest image/SVGDocumentWrapper.cpp:203
2 xul.dll mozilla::image::VectorImage::OnStartRequest image/VectorImage.cpp:1389
3 xul.dll static mozilla::image::ImageFactory::CreateImage image/ImageFactory.cpp:130
4 xul.dll imgRequest::OnDataAvailable image/imgRequest.cpp:969
5 xul.dll ProxyListener::OnDataAvailable image/imgLoader.cpp:3024
6 xul.dll nsCORSListenerProxy::OnDataAvailable netwerk/protocol/http/nsCORSListenerProxy.cpp:657
7 xul.dll nsBaseChannel::OnDataAvailable netwerk/base/nsBaseChannel.cpp:861
8 xul.dll nsInputStreamPump::OnInputStreamReady netwerk/base/nsInputStreamPump.cpp:377
9 xul.dll mozilla::NonBlockingAsyncInputStream::AsyncWaitRunnable::Run xpcom/io/NonBlockingAsyncInputStream.cpp:33

Comment 1

[Henri Sivonen (:hsivonen)]

Oops. I should have taken more care with bug 1747264. Sorry. I'll fix.

Comment 2

[Henri Sivonen (:hsivonen)]

Attachment: Bug 1748482 - Check XML parser for brokenness in various methods.

Comment 3

[Henri Sivonen (:hsivonen)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=47133dde3b61a525b52da0aefba5ec48248b6060

Comment 4

[Henri Sivonen (:hsivonen)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=47133dde3b61a525b52da0aefba5ec48248b6060

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e8542b6090c0
Check XML parser for brokenness in various methods. r=smaug

Comment 6

[Mathew Hodson]

This crash shows up for 91.4.1esr on crash stats.

Comment 7

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/e8542b6090c0

Comment 8

[Henri Sivonen (:hsivonen)]

Comment on attachment 9257606 [details]
Bug 1748482 - Check XML parser for brokenness in various methods.

Beta/Release Uplift Approval Request

• User impact if declined: Null pointer crash
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is a regression from bug 1747264, which was uplifted and turned out to be incomplete. Backing that one out would go back to an OOM crash instead of null pointer crash.
• String changes made/needed:

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: This is a regression from bug 1747264, which was uplifted.
• User impact if declined: Null pointer crash
• Fix Landed on Version: 97
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is a regression from bug 1747264, which was uplifted and turned out to be incomplete. Backing that one out would go back to an OOM crash instead of null pointer crash.

Comment 9

[Dianna Smith [:diannaS]]

Comment on attachment 9257606 [details]
Bug 1748482 - Check XML parser for brokenness in various methods.

Approved for 96.0rc2

Comment 10

[Dianna Smith [:diannaS]]

https://hg.mozilla.org/releases/mozilla-release/rev/6cf667698693

Comment 11

[Dianna Smith [:diannaS]]

Looks like the crash is still happening in 96. Henri, can you take a look?

Comment 12

[Henri Sivonen (:hsivonen)]

The crash stats here show that there were pre-existing crashes before bug 1747264 caused a spike, so I assume we're back to the crashes that were there before bug 1747264. That said, I'll see what I can do.

Comment 13

[Ryan VanderMeulen [:RyanVM]]

Crash volume with 96 looks a lot higher than previous releases.

Comment 14

[Ryan VanderMeulen [:RyanVM]]

Let's take the remaining crashes to a new bug for better tracking.

Comment 15

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9257606 [details]
Bug 1748482 - Check XML parser for brokenness in various methods.

Doesn't look like this patch ever made much of a noticeable difference on crash rates and it's pretty low-frequency on ESR anyway. Doesn't seem worth backporting.