279112 - firefox crashed with SIGBUS error [@ nsAString::GetReadableBuffer - nsContentUtils::TrimCharsInSet]

Status: RESOLVED EXPIRED

(Core :: DOM: Core & HTML, defect)

Description

[Renaud Manus]

User-Agent:       Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.7.5) Gecko/20041109 Firefox/1.0
Build Identifier: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.7.5) Gecko/20041109 Firefox/1.0

Firefox crashed (once) unexpectedly receiving a SIGBUS.

The stack shows:

-----------------  lwp# 1 / thread# 1  --------------------
 ff1c9e50 __1cJnsAStringRGetReadableBuffer6kMppkH_I_ (2023e04, ffbfd2ac, 800,
41730, ff157e54, ff20b520) + 70
 0073aa98
__1cOnsContentUtilsOTrimCharsInSet6FpkcrknJnsAString__knUnsDependentSubstring__
(ffbfd41c, 132304b, 2023e04, e371f0, 54adac, 1472400) + 8
 007bfa0c
__1cPHTMLContentSinkNAddAttributes6MrknNnsIParserNode_pnOnsIHTMLContent_ii_I_
(0, ffbfd41c, 2302ac0, 551bb4, 0, ffbfd32c) + 144
 007c0c0c __1cLSinkContextNOpenContainer6MrknNnsIParserNode__I_ (2309250,
2304430, 2c, 2309b20, 1, 0) + 204
 0053ca7c
__1cHCNavDTDNOpenContainer6MpknNnsCParserNode_nJnsHTMLTag_ipnMnsEntryStack__I_
(23063e0, 2304430, 7c87c4, 1472af0, 0, 1) + 1ec
 005396b8
__1cHCNavDTDXHandleDefaultStartToken6MpnGCToken_nJnsHTMLTag_pnNnsCParserNode__I_
(23063e0, 2023ee0, 1, 2304430, 63, ffbfd5f4) + 3c8
 0053a4d0 __1cHCNavDTDQHandleStartToken6MpnGCToken__I_ (0, 2023ee0, 555144, 0,
2304430, 1412ee8) + 2d4
 00538bec __1cHCNavDTDLHandleToken6MpnGCToken_pnJnsIParser__I_ (23063e0, 48,
2309130, 2023ee0, 1, 0) + 5b8
 00537ab4
__1cHCNavDTDKBuildModel6MpnJnsIParser_pnMnsITokenizer_pnQnsITokenObserver_pnOnsIContentSink__I_
(23063e0, 2309130, 804e03ef, 0, 0, 1e9bb58) + 390
 0054e4ac __1cInsParserKBuildModel6M_I_ (2309130, 1e9bb58, 0, 2309e68, 537724,
1410df0) + a8
 0054e12c __1cInsParserLResumeParse6Miii_I_ (2309130, 804e03e8, 1, 54e404,
2309130, 804e0000) + 12c
 0054d258 __1cInsParserPContinueParsing6M_I_ (0, 3, 54e000, 1413830, 1473644,
2309130) + 60
 007e39ec __1cNCSSLoaderImplNSheetComplete6MpnNSheetLoadData_i_v_ (2309918,
2210650, 1, 179a5a8, 0, 220e458) + b8
 007e38e0
__1cNCSSLoaderImplKParseSheet6MpnVnsIUnicharInputStream_pnNSheetLoadData_ri_I_
(2309918, 7e65a4, 2210650, ffbfdc9c, 14758c0, 7e0f78) + 148
 007e2198
__1cNSheetLoadDataQOnStreamComplete6MpnWnsIUnicharStreamLoader_pnLnsISupports_IpnVnsIUnicharInputStream__I_
(1, ffbfe130, 2210650, 0, 211c6e0, ffbfe19c) + 5e8
 00451984
__1cVnsUnicharStreamLoaderNOnStopRequest6MpnKnsIRequest_pnLnsISupports_I_I_
(2010518, 147561c, 0, 0, 451800, 80000000) + 1a4
 004b1a88 __1cNnsHttpChannelNOnStopRequest6MpnKnsIRequest_pnLnsISupports_I_I_
(230c338, 2204c68, 0, 60, 6e3, 0) + 2cc
 0043a3e8 __1cRnsInputStreamPumpLOnStateStop6M_I_ (2204c68, 4b4328, 0, 140af18,
0, 80000000) + 88
 0043a044 __1cRnsInputStreamPumpSOnInputStreamReady6MpnTnsIAsyncInputStream__I_
(2204c68, 21c9f40, 2, 80000000, 0, 3) + 70
 ff18cbbc ???????? (2204c6c, 1e0be70, 43a69c, c, 0, 1405ae0)
 ff1a7a80 PL_HandleEvent (1e0be74, 1548f4c, 0, feb23aec, 1548f48, 1e0be74) + 14
 ff1a7998 PL_ProcessPendingEvents (1548f48, ff000000, 0, 19, b, 1548f48) + 78
 ff1a9a34 __1cQnsEventQdDueueImplUProcessPendingEvents6M_I_ (156c238, 5, 1,
fec6ba0c, 1000, ff1a9a14) + 20
 006098f8 ???????? (1687090, 1, 178edf0, 0, 178b968, 609c2c)
 ff24611c g_main_dispatch (ffbfe5f8, 1532cb8, 2, ff26e3e0, 14f1964, fffffffd) + 100
 ff246990 g_main_iterate (1532cb8, 1, 1, 1, 14f1964, ff26c6a0) + 7c0
 ff246b74 g_main_run (1, 0, 25bcc, ff09cf60, 1, 178ee00) + ac
 ff012870 gtk_main (1, 0, 0, 178ee00, ff0a14b4, 1c00) + f0
 00609fd8 __1cKnsAppShellDRun6M_I_ (1547708, 156c238, 609dac, 14545dc, c1f30000,
14545dc) + 3c
 00e7423c __1cIxre_main6FippcpknMnsXREAppData__i_ (14b04ac, 14ef9ac, ffbfec8c,
ffbfec94, ffbfecb0, ffbfecb8) + f7c
 003ac5e0 _start   (0, 0, 0, 0, 0, 0) + 108


If needed, I have the corefile available.

Reproducible: Didn't try

Comment 1

[Ben Fowler]

It is not my pigeon but your core file is unlikely to be of much use
in bugzilla (on the grounds of size if nothing else), particularly
as you have provided a backtrace. I am sure that it would be 
appreciated if you are able to confirm the crash on a more recent
lizard, but I have no idea whether that is even possible. 

Comment 2

[timeless]

@see also bug 243941

Comment 3

[Gervase Markham [:gerv]]

This is an automated message, with ID "auto-resolve01".

This bug has had no comments for a long time. Statistically, we have found that
bug reports that have not been confirmed by a second user after three months are
highly unlikely to be the source of a fix to the code.

While your input is very important to us, our resources are limited and so we
are asking for your help in focussing our efforts. If you can still reproduce
this problem in the latest version of the product (see below for how to obtain a
copy) or, for feature requests, if it's not present in the latest version and
you still believe we should implement it, please visit the URL of this bug
(given at the top of this mail) and add a comment to that effect, giving more
reproduction information if you have it.

If it is not a problem any longer, you need take no action. If this bug is not
changed in any way in the next two weeks, it will be automatically resolved.
Thank you for your help in this matter.

The latest beta releases can be obtained from:
Firefox:     http://www.mozilla.org/projects/firefox/
Thunderbird: http://www.mozilla.org/products/thunderbird/releases/1.5beta1.html
Seamonkey:   http://www.mozilla.org/projects/seamonkey/

Comment 4

[Gervase Markham [:gerv]]

This bug has been automatically resolved after a period of inactivity (see above
comment). If anyone thinks this is incorrect, they should feel free to reopen it.