46269 - Crashes at CStartToken::IsEmpty

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect, P3)

Description

[Shiva Thirumazhusai]

Stack Trace: 
CStartToken::IsEmpty    
[d:\builds\seamonkey\mozilla\htmlparser\src\nsHTMLTokens.cpp
CBodyElement::HandleStartToken
[d:\builds\seamonkey\mozilla\htmlparser\src\COtherElements.h
COtherDTD::HandleStartToken
[d:\builds\seamonkey\mozilla\htmlparser\src\COtherDTD.cpp
COtherDTD::HandleToken  
[d:\builds\seamonkey\mozilla\htmlparser\src\COtherDTD.cpp
COtherDTD::BuildModel   
[d:\builds\seamonkey\mozilla\htmlparser\src\COtherDTD.cpp
nsParser::BuildModel    [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp
nsParser::ResumeParse   [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp
nsParser::EnableParser  [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp
CSSLoaderImpl::Cleanup
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp
CSSLoaderImpl::SheetComplete
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp
CSSLoaderImpl::ParseSheet
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp
CSSLoaderImpl::DidLoadStyle
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp
SheetLoadData::OnStreamComplete
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSLoader.cpp
nsStreamLoader::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamLoader.cpp
nsHTTPFinalListener::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cp
p
InterceptStreamListener::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\cache\mgr\nsCachedNetData.cpp
nsHTTPChannel::ResponseCompleted
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPChannel.cpp
nsHTTPServerListener::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cp
p
nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp
nsStreamListenerEvent::HandlePLEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp
PL_HandleEvent  [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c
_md_EventReceiverProc   [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c
USER32.DLL + 0x3eb0 (0x77e03eb0)
USER32.DLL + 0x401a (0x77e0401a)
USER32.DLL + 0x92da (0x77e092da)
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp
main1   [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp
main    [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp
WinMainCRTStartup()
KERNEL32.DLL + 0x7903 (0x77e77903)

    CStartToken::IsEmpty 23f04cef
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/htmlparser/src/nsHTMLTokens.
cpp
line 219
        Build: 2000071609 CrashDate: 2000-07-16 UptimeMinutes: 3  Total: 3 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14274215

    CStartToken::IsEmpty a4250f30
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/htmlparser/src/nsHTMLTokens.
cpp
line 219
        Build: 2000071609 CrashDate: 2000-07-16 UptimeMinutes: 13  Total: 13 
        OS: Windows NT  5.0 build 2195
        URL: www.w3c.org
        Comment: Backing up through W3C pages (on PNG)
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14278612

    CStartToken::IsEmpty 1b175c3f
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/htmlparser/src/nsHTMLTokens.
cpp
line 219
        Build: 2000071609 CrashDate: 2000-07-17 UptimeMinutes: 2  Total: 2 
        OS: Windows NT  4.0 build 1381
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14332811

    CStartToken::IsEmpty b7322318
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/htmlparser/src/nsHTMLTokens.
cpp
line 219
        Build: 2000071709 CrashDate: 2000-07-18 UptimeMinutes: 6  Total: 21 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14382302

    CStartToken::IsEmpty f1dfcd7c
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/htmlparser/src/nsHTMLTokens.
cpp
line 219
        Build: 2000071709 CrashDate: 2000-07-18 UptimeMinutes: 112  Total: 112 
        OS: Windows 98  4.10 build 67766222
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14382020

    CStartToken::IsEmpty 893af62b
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/htmlparser/src/nsHTMLTokens.
cpp
line 219
        Build: 2000071811 CrashDate: 2000-07-18 UptimeMinutes: 0  Total: 1 
        OS: Windows NT  4.0 build 1381
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14409904

    CStartToken::IsEmpty f6d986ac
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/htmlparser/src/nsHTMLTokens.
cpp
line 219
        Build: 2000071721 CrashDate: 2000-07-18 UptimeMinutes: 690  Total: 690 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14415866

    CStartToken::IsEmpty f6d986ac
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/htmlparser/src/nsHTMLTokens.
cpp
line 219
        Build: 2000071721 CrashDate: 2000-07-18 UptimeMinutes: 1  Total: 1 
        OS: Windows NT  5.0 build 2195
        URL: http://www.downsed.org/
        Comment: Navigating to home from page within the site.
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14438011

    CStartToken::IsEmpty b9ed1630
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/htmlparser/src/nsHTMLTokens.
cpp
line 219
        Build: 2000071721 CrashDate: 2000-07-18 UptimeMinutes: 56  Total: 246 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14437381

    CStartToken::IsEmpty 3beaa46f
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/htmlparser/src/nsHTMLTokens.
cpp
line 219
        Build: 2000071811 CrashDate: 2000-07-20 UptimeMinutes: 48  Total: 312 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14518742

    CStartToken::IsEmpty 3beaa46f
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/htmlparser/src/nsHTMLTokens.
cpp
line 219
        Build: 2000071621 CrashDate: 2000-07-20 UptimeMinutes: 451  Total: 897 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14519781

    CStartToken::IsEmpty 11beb20b
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/htmlparser/src/nsHTMLTokens.
cpp
line 219
        Build: 2000071921 CrashDate: 2000-07-20 UptimeMinutes: 17  Total: 17 
        OS: Windows 98  4.10 build 67766446
        URL: www.w3c.org
        Comment: I was entering the XHTML1.0 specification from the HTML-index 
page.
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14556986

    CStartToken::IsEmpty f6d986ac
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/htmlparser/src/nsHTMLTokens.
cpp
line 219
        Build: 2000072021 CrashDate: 2000-07-21 UptimeMinutes: 25  Total: 46 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14558416

    CStartToken::IsEmpty 9ab90bb7
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/htmlparser/src/nsHTMLTokens.
cpp
line 219
        Build: 2000072021 CrashDate: 2000-07-21 UptimeMinutes: 118  Total: 118 
        OS: Windows NT  4.0 build 1381
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14583427

    CStartToken::IsEmpty f6d986ac
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/htmlparser/src/nsHTMLTokens.
cpp
line 219
        Build: 2000071811 CrashDate: 2000-07-21 UptimeMinutes: 161  Total: 473 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14586610

    CStartToken::IsEmpty 3beaa46f
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/htmlparser/src/nsHTMLTokens.
cpp
line 219
        Build: 2000072021 CrashDate: 2000-07-21 UptimeMinutes: 25  Total: 46 
        OS: Windows NT  5.0 build 2195
        URL: http://www.w3.org/TR/xforms-datamodel/
        Comment: Loading the page gave a crash
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14606854

    CStartToken::IsEmpty 7b05b953
        
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/htmlparser/src/nsHTMLTokens.
cpp
line 219
        Build: 2000072109 CrashDate: 2000-07-22 UptimeMinutes: 5  Total: 5 
        OS: Windows NT  5.0 build 2195
        URL: 
        Comment: 
        Stacktrace: 
http://cyclone/reports/stackcommentemail.cfm?dynamicBBID=14635794

Comment 1

[Shiva Thirumazhusai]

Adding crash and topcrash keywords.

Comment 2

[Blake Ross]

hmmm...well, this is odd.   the entire function consists of returning a value:

 PRBool CStartToken::IsEmpty(void) {
   return mEmpty;
 }

And the line calling it:

       if(theToken->IsEmpty() && (aTag==aContext->Last())){

And the line declaring theToken as a pointer to a CStartToken object:

       CStartToken *theToken=(CStartToken*)theNode->mToken;

In what cases could this crash?

Comment 3

[harishd]

I've seen this crash too!! But wasn't able to reporduce it!! Assigning bug to 
myself to investigate more.

Comment 4

[Blake Ross]

nominating for beta3.  This obviously happens often, we need to fix it.

Comment 5

[Hixie (not reading bugmail)]

This crash is happening a LOT to me. So much so that it blocks my QA -- for
every two tests I run, I have to spend 3 minutes running tests and 5 minutes
waiting for N6 to shutdown then restart then navigate to the next test page.

I literally cannot view more than half a dozen or so pages before a crash
occurs. It often appears to occur after hitting the back button, although the
stack traces (per talkback) are always at CStartToken::IsEmpty.

Nominating for dogfood and nsbeta2, and moving up to blocker. I cannot do any 
reasonable amount of QA on the nsbeta2 branch while this bug is present. :-(

I'm using Win2K. The following talkback traces from me are this problem:
   14959711 - hit reload several times on a page
   14959961 - hit reload several times on a different page
   14964697 - browsed to (?)
   14964995 - browsed to http://www.webstandards.org/css/macie/valigndemo1.html
   14965110 - hit back button
   14965111 - hit back button
   14965641 - hit back button

Comment 6

[Hixie (not reading bugmail)]

   14999857 - hit the reload button a lot on 
            http://www.bath.ac.uk/%7Epy8ieh/internet/eviltests/lineheight4.html

Comment 7

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

See bug 43100 for my explanation of why this crashes.  Harish assigned that bug 
back to me b/c he couldn't repro. the bug.  I only saw it on Win98.

Comment 8

[Jay Patel [:jay]]

Putting on [dogfood+][nsbeta2+] radar. 

Comment 9

[harishd]

Attachment: Proposed patch.

Comment 10

[leger]

Excellent!  harishd, can you get a review and check in tonight so we can have it 
in the branch tomorrow please?

Comment 11

[leger]

Adding ETA 7/31

Comment 12

[harishd]

Fix is in ( branch and tip ).

Comment 13

[Hixie (not reading bugmail)]

Harish you rule! VERIFIED fixed on the same platform as I had the crashes on!
Woohoo! I can work again! :-D

Tested with Windows 2000 commerical build 6.0.17.2000080104.

Comment 14

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

*** Bug 43100 has been marked as a duplicate of this bug. ***