Closed Bug 24600 Opened 26 years ago Closed 26 years ago

crash in SinkContext::FlushText on URL from the BBC News

Categories

(Core :: Layout, defect, P3)

Product:
Core
Component:
Layout
Platform:
x86
Windows NT
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: cbegle, Assigned: vidur)

References

(
URL
)

Details

(Keywords: crash)

BuildID: 2000012008 Platform: NT4.0 Mozilla crashes on the URL above. Stack trace: SinkContext::FlushText(int * 0x00000000, int 0) line 1873 + 6 bytes SinkContext::FlushTags() line 1778 HTMLContentSink::DidBuildModel(HTMLContentSink * const 0x03fd7bd0, int 0) line 2191 CNavDTD::DidBuildModel(CNavDTD * const 0x02d633a0, unsigned int 0, int 1, nsIParser * 0x03fd7da0, nsIContentSink * 0x03fd7bd0) line 696 + 14 bytes nsParser::DidBuildModel(unsigned int 0) line 587 + 55 bytes nsParser::ResumeParse(nsIDTD * 0x00000000, int 1) line 1017 nsParser::OnStopRequest(nsParser * const 0x03fd7da4, nsIChannel * 0x02e2db30, nsISupports * 0x00000000, unsigned int 0, const unsigned short * 0x00000000) line 1407 + 19 bytes nsStreamConverter::OnStopRequest(nsStreamConverter * const 0x02e2dc20, nsIChannel * 0x03fd07c4, nsISupports * 0x00000000, unsigned int 0, const unsigned short * 0x00000000) line 761 nsDocumentOpenInfo::OnStopRequest(nsDocumentOpenInfo * const 0x03fd1ef0, nsIChannel * 0x03fd07c4, nsISupports * 0x00000000, unsigned int 0, const unsigned short * 0x00000000) line 202 nsMsgProtocol::OnStopRequest(nsMsgProtocol * const 0x03fd07c0, nsIChannel * 0x03fd0204, nsISupports * 0x03fd0f74, unsigned int 0, const unsigned short * 0x00000000) line 214 + 74 bytes nsNNTPProtocol::OnStopRequest(nsNNTPProtocol * const 0x03fd07c0, nsIChannel * 0x03fd0204, nsISupports * 0x03fd0f74, unsigned int 0, const unsigned short * 0x00000000) line 849 nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x03fcc620) line 279 nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x03fcc230) line 93 + 12 bytes PL_HandleEvent(PLEvent * 0x03fcc230) line 522 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00ca02d0) line 483 + 9 bytes _md_EventReceiverProc(HWND__ * 0x01200766, unsigned int 49309, unsigned int 0, long 13238992) line 951 + 9 bytes USER32! 77e71268() 00ca02d0()
The URL that is attached to that message in the news URL above is: http://news.bbc.co.uk/hi/english/uk/newsid_596000/596294.stm Going directly that URL in the browser (not as a news attachment) doesn't crash Mozilla.
Severity: normal → critical
Adding "crash" keyword to all known open crasher bugs.
Keywords: crash
Fixed on 1/28/2000. The content sink fix prevented a dangling reference, but it's still a bit of a patch. Need to talk to parser guys about why we're being called in a specific way - CloseHTML without a CloseHead.
Status: NEW → RESOLVED
Closed: 26 years ago
Resolution: --- → FIXED
Fixed in the Feb 21 build.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.