1840245 - Crash in [@ nsAttrValue::GetIntegerValue]

Status: RESOLVED DUPLICATE of bug 1840112

(Core :: DOM: HTML Parser, defect)

Description

[Wayne Mery (:wsmwk)]

First crash appears with 20230623 nightly builds. So far, no Firefox crashes with 20230624 nightly build. Thunderbird does not have a 20230624 nightly build to compare.

Crash report: https://crash-stats.mozilla.org/report/index/172c4cab-9141-4172-bccf-c291b0230624

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  nsAttrValue::GetIntegerValue const  dom/base/nsAttrValueInlines.h:147
0  xul.dll  mozilla::dom::HTMLTableElement::BuildInheritedAttributes  dom/html/HTMLTableElement.cpp:950
1  xul.dll  mozilla::dom::HTMLTableElement::BindToTree  dom/html/HTMLTableElement.cpp:960
2  xul.dll  nsINode::InsertChildBefore  dom/base/nsINode.cpp:1612
3  xul.dll  mozilla::dom::HTMLFieldSetElement::InsertChildBefore  dom/html/HTMLFieldSetElement.cpp:148
4  xul.dll  nsINode::AppendChildTo  dom/base/nsINode.h:931
4  xul.dll  nsHtml5TreeOperation::Append  parser/html/nsHtml5TreeOperation.cpp:253
4  xul.dll  nsHtml5TreeOperation::Append  parser/html/nsHtml5TreeOperation.cpp:270
4  xul.dll  nsHtml5TreeOperation::Perform::TreeOperationMatcher::operator  parser/html/nsHtml5TreeOperation.cpp:798
4  xul.dll  mozilla::detail::VariantImplementation<unsigned char, 1, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opUpdateCharsetSource, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineAndColumnNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu>::match  mfbt/Variant.h:266

bp-a80e0c8c-f510-47eb-b924-e23610230624 Thunderbird