21107 - Crash in HTML content sink

Status: VERIFIED DUPLICATE of bug 21271

(Core :: Layout, defect, P3)

Description

[Jeremy Misavage]

Overview Description:
While visiting http://www.geocities.com/tekhir/index.html Mozilla crashes and
returns a not enough memory error.  A linux machine froze and another Linux
crashed.

Steps to Reproduce:
1) Visit this page using 1999-12-07-12 on NT

Actual Results:
Crashes browser.

Expected Results:
Should keep on working.

Build Date & Platform Bug Found:
1999-12-07-12 for win32 on a Windows NT 4.0 SP3 machine.

Additional Builds and Platforms Tested On:
Linux 1999-12-06-08 (crash)
Linux 1999-12-06-13 (frozen)
Win 95 1999-12-06-09 (crash)

Additional Information:
The bug does not occur on every system.  A Win95 machine did work using the
1999-12-07-12 win32 build.  The 1999-12-06-08 build for WinNT also worked.

Comment 1

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I see this crash in the 7-13 build on Linux as well.  It didn't crash in my
debug build from last week, so I don't have a stack trace.

If I download the file locally and put in a base href, it doesn't crash.  (There
are security warnings because the scripts aren't run.)  This means the scripts
are necessary to cause the crash.

Comment 2

[andreww]

Works fine for me on todays Mac build.

Comment 3

[Alex Musil]

Crashes for me on Windows.

Stack trace:

operator delete(void * 0xdddddddd) line 47 + 3 bytes
SinkContext::~SinkContext() line 1015 + 18 bytes
SinkContext::`scalar deleting destructor'(unsigned int 1) + 15 bytes
HTMLContentSink::~HTMLContentSink() line 1977 + 28 bytes
HTMLContentSink::`scalar deleting destructor'(unsigned int 1) + 15 bytes
HTMLContentSink::Release(HTMLContentSink * const 0x036d60c0) line 2003 + 134
bytes
nsCOMPtr<nsIUnicharStreamLoaderObserver>::~nsCOMPtr<nsIUnicharStreamLoaderObserv
er>() line 434
nsUnicharStreamLoader::~nsUnicharStreamLoader() line 86 + 11 bytes
nsUnicharStreamLoader::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsUnicharStreamLoader::Release(nsUnicharStreamLoader * const 0x03349210) line
104 + 131 bytes
nsCOMPtr<nsIStreamListener>::assign_assuming_AddRef(nsIStreamListener *
0x00000000) line 416
nsCOMPtr<nsIStreamListener>::assign_with_AddRef(nsISupports * 0x00000000) line
761
nsCOMPtr<nsIStreamListener>::operator=(nsIStreamListener * 0x00000000) line 516
nsChannelListener::~nsChannelListener() line 1518
nsChannelListener::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsChannelListener::Release(nsChannelListener * const 0x0377a490) line 1501 + 134
bytes
nsCOMPtr<nsIStreamListener>::~nsCOMPtr<nsIStreamListener>() line 434
nsHTTPResponseListener::~nsHTTPResponseListener() line 85 + 34 bytes
nsHTTPResponseListener::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsHTTPResponseListener::Release(nsHTTPResponseListener * const 0x03349390) line
87 + 131 bytes
nsCOMPtr<nsIStreamObserver>::~nsCOMPtr<nsIStreamObserver>() line 434
nsAsyncStreamObserver::~nsAsyncStreamObserver() line 129 + 11 bytes
nsAsyncStreamListener::~nsAsyncStreamListener() + 15 bytes
nsAsyncStreamListener::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsAsyncStreamObserver::Release(nsAsyncStreamObserver * const 0x0334cca0) line
132 + 127 bytes
nsAsyncStreamListener::Release(nsAsyncStreamListener * const 0x0334cca0) line
138 + 12 bytes
nsStreamListenerEvent::~nsStreamListenerEvent() line 75 + 27 bytes
nsOnStopRequestEvent::~nsOnStopRequestEvent() line 258 + 8 bytes
nsOnStopRequestEvent::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsStreamListenerEvent::DestroyPLEvent(PLEvent * 0x03578750) line 104 + 30 bytes
PL_DestroyEvent(PLEvent * 0x03578750) line 545 + 10 bytes
PL_HandleEvent(PLEvent * 0x03578750) line 532 + 9 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x0107b5d0) line 483 + 9 bytes
_md_EventReceiverProc(HWND__ * 0xcd2f014a, unsigned int 49355, unsigned int 0,
long 17282512) line 947 + 9 bytes
USER32! 77e71820()
0107b5d0()

Not sure if this is related to frames at all, so marking as a general layout bug
and reassigning to Troy.

Comment 4

[troy]

*** This bug has been marked as a duplicate of 21271 ***

Comment 5

[leger]

Yes.  Marking Verified as a dup.