184029 - hang or crash in cache with nested iframe/javascript

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[R.K.Aa.]

For the past days i get a hang or crash when loading pages at http://dinside.no
Another sympthom that somthing has / is about to go wrong, is some adds there
don't load; at best they turn up with svisible <--script > tags.

The hang/crash happens both with official trunk builds as well as my own CVS
build. BZ was able to reproduce the hang.

The processes can't be killed with the usual "killall mozilla-bin" when the hang
occurs - i have to "killall -9 mozilla-bin".

When run in gdb the hang turns out as a crash instead.

To reproduce:

Today it hung when simply loading http://dinside.no but yesterday i reproducably
did this:

Load http://www.dinside.no/php/art.php?id=33747
If you don't freeze right away:
notice the odd add script tag. Half way down the side is a pic of an Audi. 
Below a box with links: Click "Store bilder"

On the successive page there are links to images. Just click the >> link to
display next image, and next again. Hangs at the second or third click.

Top of stack:

(gdb) bt
#0  0x420736ee in malloc_consolidate () from /lib/i686/libc.so.6
#1  0x42072fb7 in _int_malloc () from /lib/i686/libc.so.6
#2  0x420722a5 in malloc () from /lib/i686/libc.so.6
#3  0x405952fe in operator new(unsigned) (sz=1108500864)
    at ../../../../libstdc++-v3/libsupc++/new_op.cc:48
#4  0x4059544f in operator new[](unsigned) (sz=757932348)
    at ../../../../libstdc++-v3/libsupc++/new_opv.cc:36
#5  0x4091b0ec in CreateDiskCacheEntry(nsDiskCacheBinding*) ()
   from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libnecko.so
#6  0x4091c521 in nsDiskCacheMap::WriteDiskCacheEntry(nsDiskCacheBinding*) ()
   from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libnecko.so
#7  0x4091a133 in nsDiskCacheDevice::DeactivateEntry(nsCacheEntry*) ()
   from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libnecko.so
#8  0x40917781 in nsCacheService::DeactivateEntry(nsCacheEntry*) ()
   from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libnecko.so
#9  0x40917581 in nsCacheService::CloseDescriptor(nsCacheEntryDescriptor*) ()
   from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libnecko.so
#10 0x40913761 in nsCacheEntryDescriptor::Close() ()
   from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libnecko.so
#11 0x40912870 in nsCacheEntryDescriptor::~nsCacheEntryDescriptor() ()
   from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libnecko.so
#12 0x4091257b in nsCacheEntryDescriptor::Release() ()
   from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libnecko.so
#13 0x401a1ce0 in nsCOMPtr_base::assign_with_AddRef(nsISupports*) ()
---Type <return> to continue, or q <return> to quit---
   from /home/dark/MOZ/TREE1/mozilla/dist/bin/libxpcom.so
#14 0x408f6b52 in nsHttpChannel::CloseCacheEntry(unsigned) ()
   from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libnecko.so

Comment 1

[R.K.Aa.]

Adding regression keyword. The hang is not in 1.2.1

Comment 2

[R.K.Aa.]

Attachment: backtrace from non-debug CVS (with symbols)

Comment 3

[R.K.Aa.]

Forgot: There is enough free physical RAM and swapdisk (Installed: 512MB/1GB)

Comment 4

[Andrew Schultz]

Attachment: testcase for <script></script>

this exhibits the <script></script>, but no hang.

Comment 5

[Andrew Schultz]

Attachment: testcase for hang (part 1)

Comment 6

[Andrew Schultz]

Attachment: testcase for hang (load this one)

iframe with a script that generates a script that creates an iframe

with part 1 as an bugzilla attachment, the bug doesn't trigger (probably the
no-cache thing).  I've changed the iframe URL for this part to another server. 
You could also download both parts and reproduce the bug locally.

The bug seems to hit after 4 times of shift-reloading this file.

Comment 7

[Andrew Schultz]

regression between linux trunk build 2002120309 and 2002120422

Comment 8

[Andrew Schultz]

Comment on attachment 108588 [details]
testcase for <script></script>

I can't reproduce the <script></script> bug with this testcase anymore... very
confused.

Comment 9

[Andrew Schultz]

Attachment: testcase <script></script> (part 1)

Comment 10

[Andrew Schultz]

Attachment: testcase for <script></script> (load this one)

iframe with javascript that generates an iframe with <script> tags.
this regressed at the same point as the hang, and works fine with the iframe
src as a bugzilla attachment.

Comment 11

[Andrew Schultz]

both problems are caused by checkin for bug 149887.

==> Parser

Comment 12

[Andrew Schultz]

resummarizing

Comment 13

[harishd]

backed out the patch in bug 149887.