465526 - Crash [@ CNavDTD::BuildModel] with invalid url in iframe and document.write

Status: RESOLVED WORKSFORME

(Core :: DOM: HTML Parser, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes in current trunk build when repeatedly clicking away the invalid url alert (probably better to keep down the enter key to reproduce the crash).

http://crash-stats.mozilla.com/report/index/c2710454-439a-4379-a5c5-82a520081118
0  	xul.dll  	CNavDTD::BuildModel  	 parser/htmlparser/src/CNavDTD.cpp:328
1 	xul.dll 	nsParser::BuildModel 	parser/htmlparser/src/nsParser.cpp:2352
2 	xul.dll 	nsParser::ResumeParse 	parser/htmlparser/src/nsParser.cpp:2221
3 	xul.dll 	nsScanner::Append 	parser/htmlparser/src/nsScanner.cpp:280
4 	xul.dll 	xul.dll@0x9a3e87 	

It doesn't seem to crash in Firefox3.0, it doesn't seem to go into the endless alert loop as current trunk builds seem to do.

Comment 1

[Gordon P. Hemsley [:GPHemsley]]

Is this the same bug as Bug 464251, which is on the 3.0.x branch? It seems to be the same function calls and the same lines, with similar apparent causes.