256938 - mozilla hangs in nsParser on that URL

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Robin Lu]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040825
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040825

mozilla hangs if I want to view URL
http://www-8.ibm.com/shop/cn/community2/Welcome.wss?co=fesco

Reproducible: Always
Steps to Reproduce:
1. launch mozilla
2. fill the URL bar with
http://www-8.ibm.com/shop/cn/community2/Welcome.wss?co=fesco
3. press enter

Actual Results:  
mozilla hangs


stack trace:
10482:  ./mozilla-bin
-----------------  lwp# 1 / thread# 1  --------------------
 ff33c864 _write   (ff36675c, 6, ff3661f5, ffbfdd60, ff3661f5, 0) + c
 ff3142dc _ndoprnt (ff3661f5, ffbfde28, 6, ffffffff, ffffffff, ff3661f5) + 2e24
 ff314ebc fprintf  (ff36675c, fe3b4dd7, 3012, fd48113f, fd48118a, fd481194) + ac
fe2fea08 unsigned nsDebugImpl::Assertion(const char*,const char*,const
char*,int) (c7810, fd48113f, fd48118a, fd481194, 190, 0) + f0
 00054214 void nsDebug::Assertion(const char*,const char*,const char*,int)
(fd48113f, fd48118a, fd481194, 190, ffbfebc4, ff398100) + e4
 fd42775c nsScannerIterator&nsScannerIterator::advance(int) (ffbfe37c, 442, 0,
10011, 468, ffbfed04) + ac
 fd424c4c unsigned nsScanner::Peek(nsAString&,int,int) (9af100, ffbfe430, 400,
42, 468, ffbfed04) + 154
 fd412764 unsigned nsParser::WillBuildModel(nsString&) (12220a8, 9af144,
1223198, 468, ffbfee18, ff398100) + d4
 fd4140f4 unsigned nsParser::ResumeParse(int,int,int) (12220a8, 1, 0, 1,
ffbfee18, ff36cf6c) + 64
 fd416d04 unsigned
nsParser::OnDataAvailable(nsIRequest*,nsISupports*,nsIInputStream*,unsigned,unsigned)
(12220a8, 121d290, 0, 1223198, 0, 468) + 2dc
 fcb2f1c8 unsigned
nsDocumentOpenInfo::OnDataAvailable(nsIRequest*,nsISupports*,nsIInputStream*,unsigned,unsigned)
(b0fe18, 121d290, 0, 1223198, 0, 468) + 88
 fd7f36e8 unsigned
nsStreamListenerTee::OnDataAvailable(nsIRequest*,nsISupports*,nsIInputStream*,unsigned,unsigned)
(1220b60, 121d290, 0, 1265d2c, 0, 468) + 3d0 fd982d30 unsigned
nsHttpChannel::OnDataAvailable(nsIRequest*,nsISupports*,nsIInputStream*,unsigned,unsigned)
(121d290, 1265e30, 0, 1265d2c, 0, 468) + 338
 fd79cb70 unsigned nsInputStreamPump::OnStateTransfer() (1265e30, 1000,
ff366b00, ff398000, ff367b84, 0) + 330
 fd79c49c unsigned nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*)
(1265e30, 1265d2c, 0, 0, ff367b84, 0) + c4
 fe285ddc void*nsInputStreamReadyEvent::EventHandler(PLEvent*) (1265ecc, 1, 0,
0, 0, 0) + 8c
 fe2d2774 PL_HandleEvent (1265ecc, 0, 0, 0, 0, 0) + 94
 fe2d2510 PL_ProcessPendingEvents (144468, 0, 0, 0, 0, 0) + 148
 fe2d8ac0 unsigned nsEventQueueImpl::ProcessPendingEvents() (130170, 491380,
d1e10, 0, 0, 0) + b0
 fcdb43d8 int event_processor_callback(_GIOChannel*,GIOCondition,void*) (491380,
1, 130170, 1, 31ec8, ff32fd3c) + 38
 fe8a9990 g_main_dispatch (d1718, 0, ffc, fffffffd, 0, fe9041d8) + 178
 fe8aacf0 g_main_context_dispatch (d1718, 90920, bbfd4, 1, 1000, fe9041d8) + a8
 fe8ab104 g_main_context_iterate (d1718, 1, 1, 0, d1720, d59490) + 3a0
 fe8aba24 g_main_loop_run (3de7c0, fe906a20, 1, fe906a1c, 14ea78, d1718) + 2f4
 febefad4 gtk_main (8000, 0, 3de7c0, 3400, fed86204, 0) + f4
 fcdb4da0 unsigned nsAppShell::Run() (25eb20, 0, 910d0, 0, 0, ffe) + 68
 faccaa64 unsigned nsAppShellService::Run() (25fa18, 0, 0, ffbff728, ff367b84,
4) + 2c
 00020834 unsigned main1(int,char**,nsISupports*) (1, ffbffa54, 254780, 2ae24,
fed7c574, fea7db40) + 13c4
 00021fcc main     (1, ffbffa54, ffbffa5c, 90c00, ff3900c0, ff390100) + 49c
 0001aac8 _start   (0, 0, 0, 0, 0, 0) + 108
-----------------  lwp# 2 / thread# 2  --------------------
 ff33c11c pollsys  (f880fb34, 3, 0, 0)
 ff2d9f28 poll     (f880fb34, 3, ffffffff, ff398400, ff367b84, 0) + 7c
 ff197e1c _pr_poll_with_poll (139270, 3, ffffffff, 1, ff3ec4f4, 0) + 724
 ff1981a4 PR_Poll  (139270, 3, ffffffff, 0, 0, 0) + 24
 fd7edd30 int nsSocketTransportService::Poll() (138f18, 138f58, 1, 0, 0, 0) + a8
fd7eec6c unsigned nsSocketTransportService::Run() (138f18, 1000, ff366b00,
ff398400, ff367b84, 0) + 3a4
 fe2e0668 void nsThread::Main(void*) (12e2a8, 144680, 0, c, 0, 3) + 110
 ff19a6a4 _pt_root (144680, f8810000, 0, 0, ff19a508, 1) + 19c
 ff33b510 _lwp_start (0, 0, 0, 0, 0, 0)
-----------------  lwp# 4 / thread# 4  --------------------
 ff33b5b0 lwp_park (0, f849fc28, 0)
 ff3358b0 cond_wait_queue (3937c0, 394f48, f849fc28, 0, 0, 0) + 28
 ff335d28 cond_wait_common (3937c0, 394f48, f849fc28, 0, 0, 0) + 2a8
 ff335ec0 _cond_timedwait (3937c0, 394f48, f849fd58, c, ff367b84, 0) + 34
 ff335fb4 cond_timedwait (3937c0, 394f48, f849fd58, 186a0, ff398c00, 0) + 14
 ff335ff4 pthread_cond_timedwait (3937c0, 394f48, f849fd58, 3, 0, f849fd60) + c
 ff18dd90 pt_TimedWait (3937c0, 394f48, 7d2d66, 0, 0, 0) + 128
 ff18e62c PR_WaitCondVar (3937b8, 7d2d66, ff000000, 0, 0, 0) + 234
 fe2e9dd0 unsigned TimerThread::Run() (3893b0, 1000, ff366b00, ff398c00,
ff367b84, 0) + 408
 fe2e0668 void nsThread::Main(void*) (3937e0, 395008, 0, c, 0, 3) + 110
 ff19a6a4 _pt_root (395008, f84a0000, 0, 0, ff19a508, 1) + 19c
 ff33b510 _lwp_start (0, 0, 0, 0, 0, 0)
-----------------  lwp# 10 / thread# 10  --------------------
 ff33b5b0 lwp_park (0, f839fa88, 0)
 ff3358b0 cond_wait_queue (e4fb90, e50890, f839fa88, 0, 0, 0) + 28
 ff335d28 cond_wait_common (e4fb90, e50890, f839fa88, 0, 0, 0) + 2a8
 ff335ec0 _cond_timedwait (e4fb90, e50890, f839fbb8, 0, 1, 0) + 34
 ff335fb4 cond_timedwait (e4fb90, e50890, f839fbb8, 186a0, 0, 1000) + 14
 ff335ff4 pthread_cond_timedwait (e4fb90, e50890, f839fbb8, 3, 0, f839fbc0) + c
 ff18dd90 pt_TimedWait (e4fb90, e50890, 186a0, 0, ff367b84, 0) + 128
 ff18e62c PR_WaitCondVar (e4fb88, 186a0, 0, 0, 5, 0) + 234
 ff18f214 PR_Wait  (e50888, 186a0, 1, 0, 0, 0) + 19c
 f8c18e9c unsigned nsAutoMonitor::Wait(unsigned) (f839fdac, 186a0, fe2e0668,
ff3ea108, ff3ec4f4, 0) + 1c
 f8beeb54 void nsImapProtocol::ImapThreadMainLoop() (e504e8, e4fca0, ff000000,
0, 0, 0) + 10c
 f8bed848 unsigned nsImapProtocol::Run() (e504e8, 1000, ff366b00, ff399c00,
ff367b84, 0) + 120
 fe2e0668 void nsThread::Main(void*) (e4fca0, e50ca8, 0, c, 0, 3) + 110
 ff19a6a4 _pt_root (e50ca8, f83a0000, 0, 0, ff19a508, 1) + 19c
 ff33b510 _lwp_start (0, 0, 0, 0, 0, 0)
-----------------  lwp# 11 / thread# 11  --------------------
 ff33b5b0 lwp_park (0, f833fa88, 0)
 ff3358b0 cond_wait_queue (f44a18, 1041f60, f833fa88, 0, 0, 0) + 28
 ff335d28 cond_wait_common (f44a18, 1041f60, f833fa88, 0, 0, 0) + 2a8
 ff335ec0 _cond_timedwait (f44a18, 1041f60, f833fbb8, 0, 0, 0) + 34
 ff335fb4 cond_timedwait (f44a18, 1041f60, f833fbb8, 186a0, 0, 0) + 14
 ff335ff4 pthread_cond_timedwait (f44a18, 1041f60, f833fbb8, 3, 0, f833fbc0) + c
ff18dd90 pt_TimedWait (f44a18, 1041f60, 186a0, 0, ff367b84, 0) + 128
 ff18e62c PR_WaitCondVar (f44a10, 186a0, 0, 0, 0, 0) + 234
 ff18f214 PR_Wait  (1041f58, 186a0, 1, 0, 0, 0) + 19c
 f8c18e9c unsigned nsAutoMonitor::Wait(unsigned) (f833fdac, 186a0, 0, fffffff8,
0, fca260) + 1c
 f8beeb54 void nsImapProtocol::ImapThreadMainLoop() (103fbb0, f60068, ff000000,
0, 0, 0) + 10c
 f8bed848 unsigned nsImapProtocol::Run() (103fbb0, 1000, ff366b00, f8350400,
ff367b84, 0) + 120
 fe2e0668 void nsThread::Main(void*) (f60068, 1042378, 0, c, 0, 3) + 110
 ff19a6a4 _pt_root (1042378, f8340000, 0, 0, ff19a508, 1) + 19c
 ff33b510 _lwp_start (0, 0, 0, 0, 0, 0)

debug build keeps on print out:
Break: at file ../../dist/include/htmlparser/nsScannerString.h, line 400
###!!! ASSERTION: Infinite loop: can't advance a reading iterator beyond the end
of a string: 'one_hop>0', file ../../dist/include/htmlparser/nsScannerString.h,
line 400
Break: at file ../../dist/include/htmlparser/nsScannerString.h, line 400
###!!! ASSERTION: Infinite loop: can't advance a reading iterator beyond the end
of a string: 'one_hop>0', file ../../dist/include/htmlparser/nsScannerString.h,
line 400
Break: at file ../../dist/include/htmlparser/nsScannerString.h, line 400
###!!! ASSERTION: Infinite loop: can't advance a reading iterator beyond the end
of a string: 'one_hop>0', file ../../dist/include/htmlparser/nsScannerString.h,
line 400

it seems like a regression of bug 178088 recently being fixed

Comment 1

[Robin Lu]

Attachment: patch

"start" has already advanced offset and since end begins from start, we don't
need advance the offset anymore

Comment 2

[Johnny Stenback (:jst)]

Comment on attachment 157024 [details] [diff] [review]
patch

Duh, my bad. r+sr=jst

Comment 3

[Johnny Stenback (:jst)]

Comment on attachment 157024 [details] [diff] [review]
patch

Thanks for the fix! Plusing for branches as this regression is too silly to not
take.

Comment 4

[Johnny Stenback (:jst)]

Fixed on trunk, aviary, and 1.7 branches.