1824817 - Crash in [@ nsHtml5Parser::UnblockParser]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Ryan VanderMeulen [:RyanVM]]

This looks a lot like bug 1800981. I'm wondering if we were just a bit over-optimistic in closing it out last time as the crashes do appear to have started right around the time bug 1632975 re-landed.

Common URLs I'm seeing in crash reports include various image hosting sites like https://www.imagevenue.com and https://www.turboimagehost.com. I'm also seeing https://about.gitlab.com/ in there quite a bit, which was called out originally in bug 1800981 also.

Can you please take a look, Adam?

Crash report: https://crash-stats.mozilla.org/report/index/08fde832-bd7e-419f-af28-00bdf0230323

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(mBlocked > 0)

Top 10 frames of crashing thread:

0  xul.dll  nsHtml5Parser::UnblockParser  parser/html/nsHtml5Parser.cpp:131
1  xul.dll  nsIScriptElement::UnblockParser  dom/script/nsIScriptElement.cpp:21
1  xul.dll  mozilla::dom::ScriptLoader::UnblockParser  dom/script/ScriptLoader.cpp:3234
1  xul.dll  mozilla::dom::ScriptLoader::ProcessPendingRequests  dom/script/ScriptLoader.cpp:2742
2  xul.dll  mozilla::dom::ScriptLoader::OnStreamComplete  dom/script/ScriptLoader.cpp:2980
2  xul.dll  mozilla::dom::ScriptLoadHandler::OnStreamComplete  dom/script/ScriptLoadHandler.cpp:460
3  xul.dll  nsIncrementalStreamLoader::OnStopRequest  netwerk/base/nsIncrementalStreamLoader.cpp:81
4  xul.dll  mozilla::net::nsHTTPCompressConv::OnStopRequest  netwerk/streamconv/converters/nsHTTPCompressConv.cpp:180
5  xul.dll  std::_Func_impl_no_alloc<`lambda at /builds/worker/checkouts/gecko/netwerk/protocol/http/HttpChannelChild.cpp:808:13', void>::_Do_call  netwerk/protocol/http/HttpChannelChild.cpp:1064
6  xul.dll  mozilla::net::ChannelEventQueue::FlushQueue  netwerk/ipc/ChannelEventQueue.cpp:94

Comment 1

[Adam Vandolder [:avandolder]]

I've taken a bit of a look, and it seems likely that this is related, but not the same crash exactly - the gitlab (and nhl.com) failures in particular were all on builds affected by the previous bug. I've been unable to reproduce the failure locally, however.

Comment 2

[Henri Sivonen (:hsivonen) (on leave)]

I think this is only S3 at these crash rates, but this kind of thing is pretty bad, and it would be really good to get this investigated and fixed. Not sure what, besides carefuly reading of the suspected regressor patch, to do without a local repro / Pernosco trace, though.

Comment 3

[Adam Vandolder [:avandolder]]

These crashes came about as a result of bug 1632975, which changed when the microtask for script execution was queued. Later, the patch for bug 1827512 made further adjustments for this microtask. In the months since this second patch has landed, no crash in a build containing it has occurred.