456954 - Firefox crashes when an XML document contains deeply nested <b> and <i> tags [@ nsCSSFrameConstructor::ProcessInlineChildren(nsFrameConstructorState&, nsIContent*, nsIFrame*, int, nsFrameItems&, int*) ]

Status: RESOLVED DUPLICATE of bug 323394

(Core :: CSS Parsing and Computation, defect)

Description

[bugzilla]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.2) Gecko/2008091620 Firefox/3.0.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.2) Gecko/2008091620 Firefox/3.0.2

If XHTML document which is served as text/xml contains uncommonly deeply nested <b> and <i> tags, Firefox 3.0.2 stable crashes when trying to render the document. This doees not happen when the same document is served as text/html. The ressource above contains a somewhat minimized testcase, extracted from a non-public webpage.

Reproducible: Always

Steps to Reproduce:
1. Open http://sandbox.pigsgrame.de/demos/ffcrash/
2. Load ffcrash.html, a text/html document. Firefox 3.0.2 will not crash
3. Load ffcrash.xml which is exactly the same document, but served as text/xml.
Actual Results:  
Firefox 3.0.2 crashes

Expected Results:  
Document should be rendered without crash

Comment 1

[Matthias Versen [:Matti]]

http://developer.mozilla.org/En/How_to_get_a_stacktrace_for_a_bug_report for your next crash bug report :-)
This time not needed becasue I can reprduce this crash with FF3.0.2

Thanks for the really great bug report with a testcase !

bp-352f2fd1-8b1b-11dd-a844-001cc45a2c28

EXCEPTION_STACK_OVERFLOW

0  	xul.dll  	nsCSSFrameConstructor::ProcessInlineChildren  	 mozilla/layout/base/nsCSSFrameConstructor.cpp:12772
1 	xul.dll 	nsCSSFrameConstructor::ConstructInline 	mozilla/layout/base/nsCSSFrameConstructor.cpp:12571
2 	xul.dll 	xul.dll@0x2c6563 	
3 	xul.dll 	nsCSSFrameConstructor::ConstructFrameInternal 	mozilla/layout/base/nsCSSFrameConstructor.cpp:7758
4 	xul.dll 	nsCSSFrameConstructor::ConstructFrame 	mozilla/layout/base/nsCSSFrameConstructor.cpp:7580
5 	xul.dll 	nsCSSFrameConstructor::ProcessInlineChildren 	mozilla/layout/base/nsCSSFrameConstructor.cpp:12800
6 	xul.dll 	nsCSSFrameConstructor::ConstructInline 	mozilla/layout/base/nsCSSFrameConstructor.cpp:12571
7 	xul.dll 	xul.dll@0x2c6563 	
8 	xul.dll 	nsCSSFrameConstructor::ConstructFrameInternal 	mozilla/layout/base/nsCSSFrameConstructor.cpp:7758
9 	xul.dll 	nsCSSFrameConstructor::ConstructFrame 	mozilla/layout/base/nsCSSFrameConstructor.cpp:7580
10 	xul.dll 	nsCSSFrameConstructor::ProcessInlineChildren 	mozilla/layout/base/nsCSSFrameConstructor.cpp:12800
11 	xul.dll 	nsCSSFrameConstructor::ConstructInline 	mozilla/layout/base/nsCSSFrameConstructor.cpp:12571
12 	xul.dll 	xul.dll@0x2c6563 	
[.....]

Comment 2

[Martijn Wargers (dead)]

Related to bug 323394?

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: ffcrash.xml

From the reporter's site, in case it goes away.