Crash [@ CNavDTD::BuildModel] with invalid url in iframe and document.write

RESOLVED WORKSFORME

Status

()

Core
HTML: Parser
--
critical
RESOLVED WORKSFORME
9 years ago
5 years ago

People

(Reporter: Martijn Wargers (dead), Unassigned)

Tracking

({crash, testcase})

Trunk
x86
Windows XP
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

9 years ago
Created attachment 348765 [details]
testcase

See testcase, which crashes in current trunk build when repeatedly clicking away the invalid url alert (probably better to keep down the enter key to reproduce the crash).

http://crash-stats.mozilla.com/report/index/c2710454-439a-4379-a5c5-82a520081118
0  	xul.dll  	CNavDTD::BuildModel  	 parser/htmlparser/src/CNavDTD.cpp:328
1 	xul.dll 	nsParser::BuildModel 	parser/htmlparser/src/nsParser.cpp:2352
2 	xul.dll 	nsParser::ResumeParse 	parser/htmlparser/src/nsParser.cpp:2221
3 	xul.dll 	nsScanner::Append 	parser/htmlparser/src/nsScanner.cpp:280
4 	xul.dll 	xul.dll@0x9a3e87 	

It doesn't seem to crash in Firefox3.0, it doesn't seem to go into the endless alert loop as current trunk builds seem to do.
Is this the same bug as Bug 464251, which is on the 3.0.x branch? It seems to be the same function calls and the same lines, with similar apparent causes.
(Assignee)

Updated

7 years ago
Crash Signature: [@ CNavDTD::BuildModel]
(Reporter)

Updated

5 years ago
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.