Closed Bug 50150 Opened 26 years ago Closed 26 years ago

nsHTMLToTXTSinkStream::EndLine() causes nsAReadableString infinite loop

Categories

(Core :: DOM: HTML Parser, defect, P3)

Product:
Core
Component:
DOM: HTML Parser
Platform:
x86
Windows NT
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: kinmoz, Assigned: akkzilla)

References

(
URL
)

Details

I'm not exactly sure what I did to cause this to happen, I think I was loading the bonsai hook page to try and reproduce bug #50148. http://bonsai.mozilla.org/toplevel.cgi?treeid=SeaMonkey In any case, I'm seeing an infinite loop in nsReadingIterator::operator-=() that keeps throwing assertions, which seems to be caused by some code in nsHTMLToTXTSinkStream::EndLine(): 1294 rickg 3.40 // Remove SPACE from the end of the line. 1295 while(' ' == mCurrentLine[mCurrentLine.Length()-1]) 1296 mCurrentLine.SetLength(mCurrentLine.Length()-1); In the debugger I can see that mCurrentLine.Length == 0 which means that the 'while' expression above is trying to get the mCurrentLine[-1] character. Perhaps a length check is in order here?
Here's the stack trace that occurs during the infinite loop: NTDLL! 77f762e8() nsDebug::Assertion(const char * 0x01bfbb74 ??_C@_0FH@NPKE@Infinite?5loop?3?5can?8t?5advance?5?$CIba@, const char * 0x01bfbb68 ??_C@_09KPMO@one_hop?$DO0?$AA@, const char * 0x01bfba84 ??_C@_0CH@IHJC@?4?4?2?4?4?2dist?2include?2nsAReadableSt@, int 228) line 253 + 13 bytes nsReadingIterator<unsigned short>::operator-=(int 1) line 228 + 32 bytes nsReadingIterator<unsigned short>::operator+=(int -1) line 204 + 14 bytes basic_nsAReadableString<unsigned short>::CharAt(unsigned int 4294967295) line 548 + 23 bytes basic_nsAReadableString<unsigned short>::operator[](unsigned int 4294967295) line 557 nsHTMLToTXTSinkStream::EndLine(int 1) line 1295 + 39 bytes nsHTMLToTXTSinkStream::AddToLine(const unsigned short * 0x0456f570, int 13) line 1259 nsHTMLToTXTSinkStream::Write(const nsString & {...}) line 1475 nsHTMLToTXTSinkStream::AddLeaf(nsHTMLToTXTSinkStream * const 0x0456c430, const nsIParserNode & {...}) line 943 nsXIFDTD::AddLeaf(const nsIParserNode & {...}) line 1113 + 22 bytes nsXIFDTD::HandleDefaultToken(CToken * 0x0319cf10, nsIParserNode & {...}) line 686 + 12 bytes nsXIFDTD::HandleStartToken(CToken * 0x0319cf10) line 652 + 16 bytes nsXIFDTD::HandleToken(nsXIFDTD * const 0x0456db90, CToken * 0x0319cf10, nsIParser * 0x0456cbf0) line 501 + 12 bytes nsXIFDTD::BuildModel(nsXIFDTD * const 0x0456db90, nsIParser * 0x0456cbf0, nsITokenizer * 0x0456fb60, nsITokenObserver * 0x00000000, nsIContentSink * 0x0456c430) line 411 + 20 bytes nsParser::BuildModel() line 1978 + 34 bytes nsParser::ResumeParse(int 0, int 0) line 1859 + 11 bytes nsParser::Parse(const basic_nsAReadableString<unsigned short> & {...}, void * 0x00000000, const nsString & {...}, int 0, int 1, nsDTDMode eDTDMode_autodetect) line 1669 + 15 bytes nsTextEncoder::EncodeToString(nsTextEncoder * const 0x0456cda0, basic_nsAWritableString<unsigned short> & {...}) line 213 + 41 bytes nsDOMSelection::ToString(nsDOMSelection * const 0x0456c160, const basic_nsAReadableString<unsigned short> & {...}, unsigned int 1081, int 80, basic_nsAWritableString<unsigned short> & {...}) line 1597 + 36 bytes nsHTMLEditor::OutputToString(nsHTMLEditor * const 0x03eee570, basic_nsAWritableString<unsigned short> & {...}, const basic_nsAReadableString<unsigned short> & {...}, unsigned int 1080) line 5552 + 54 bytes nsGfxTextControlFrame2::GetTextControlFrameState(basic_nsAWritableString<unsigne d short> & {...}) line 2799 + 72 bytes nsGfxTextControlFrame2::GetProperty(nsGfxTextControlFrame2 * const 0x0397b694, nsIAtom * 0x01333040, basic_nsAWritableString<unsigned short> & {...}) line 2189 nsHTMLTextAreaElement::GetValue(nsHTMLTextAreaElement * const 0x03ea0af0, basic_nsAWritableString<unsigned short> & {...}) line 358 nsGfxTextControlFrame2::GetText(nsGfxTextControlFrame2 * const 0x0397b614, nsString * 0x0012ee44, int 0) line 2609 + 19 bytes nsTextInputListener::Blur(nsIDOMEvent * 0x0456c314) line 354 nsEventListenerManager::HandleEvent(nsIPresContext * 0x044ba8f0, nsEvent * 0x0012f418, nsIDOMEvent * * 0x0012f144, nsIDOMEventTarget * 0x03eed214, unsigned int 7, nsEventStatus * 0x0012f43c) line 1176 + 23 bytes nsGenericElement::HandleDOMEvent(nsIPresContext * 0x044ba8f0, nsEvent * 0x0012f418, nsIDOMEvent * * 0x0012f144, unsigned int 1, nsEventStatus * 0x0012f43c) line 1437 nsHTMLTextAreaElement::HandleDOMEvent(nsHTMLTextAreaElement * const 0x03ea0afc, nsIPresContext * 0x044ba8f0, nsEvent * 0x0012f418, nsIDOMEvent * * 0x00000000, unsigned int 1, nsEventStatus * 0x0012f43c) line 533 nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x04492e58, nsIPresContext * 0x044ba8f0, nsEvent * 0x0012f7f0, nsIFrame * 0x028a31a0, nsEventStatus * 0x0012f758, nsIView * 0x0449b1b0) line 554 PresShell::HandleEventInternal(nsEvent * 0x0012f7f0, nsIView * 0x0449b1b0, nsEventStatus * 0x0012f758) line 4022 + 43 bytes PresShell::HandleEvent(PresShell * const 0x04469ac4, nsIView * 0x0449b1b0, nsGUIEvent * 0x0012f7f0, nsEventStatus * 0x0012f758, int 0, int & 1) line 3963 + 23 bytes nsView::HandleEvent(nsView * const 0x0449b1b0, nsGUIEvent * 0x0012f7f0, unsigned int 8, nsEventStatus * 0x0012f758, int 0, int & 1) line 787 nsView::HandleEvent(nsView * const 0x0449b980, nsGUIEvent * 0x0012f7f0, unsigned int 8, nsEventStatus * 0x0012f758, int 0, int & 1) line 760 nsView::HandleEvent(nsView * const 0x044592c0, nsGUIEvent * 0x0012f7f0, unsigned int 28, nsEventStatus * 0x0012f758, int 1, int & 1) line 760 nsViewManager2::DispatchEvent(nsViewManager2 * const 0x044594a0, nsGUIEvent * 0x0012f7f0, nsEventStatus * 0x0012f758) line 1429 HandleEvent(nsGUIEvent * 0x0012f7f0) line 69 nsWindow::DispatchEvent(nsWindow * const 0x0449b844, nsGUIEvent * 0x0012f7f0, nsEventStatus & nsEventStatus_eIgnore) line 614 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f7f0) line 635 nsWindow::DispatchFocus(unsigned int 108) line 3959 + 15 bytes nsWindow::ProcessMessage(unsigned int 8, unsigned int 0, long 0, long * 0x0012fb34) line 3019 + 19 bytes nsWindow::WindowProc(HWND__ * 0x02bf0630, unsigned int 8, unsigned int 0, long 0) line 883 + 27 bytes USER32! 77e71303() USER32! 77e71962() NTDLL! 77f763ef() USER32! 77e71a89() nsAppShell::Run(nsAppShell * const 0x00b87730) line 93 + 18 bytes nsAppShellService::Run(nsAppShellService * const 0x00b864a0) line 379 main1(int 1, char * * 0x00ac4fc0, nsISupports * 0x00000000) line 946 + 32 bytes main(int 1, char * * 0x00ac4fc0) line 1126 + 37 bytes mainCRTStartup() line 338 + 17 bytes KERNEL32! 77f1b9ea() I'm not sure if this helps or not, but the aString passed into nsHTMLToTXTSinkStream::Write() at the time this happens is: aString == "root=/cvsroot"
Taking this -- I think this is a dup of the bug that Daniel already fixed.
Assignee: rickg → akkana
Oops, meant to cc Daniel.
Looks like the other while loop in EndLine needs the same patch Daniel made to the other loop. In other words, it becomes: // Remove SPACE from the end of the line. while ((mCurrentline.Length() > 0) && (' ' == mCurrentLine[mCurrentLine.Length()-1])) mCurrentLine.SetLength(mCurrentLine.Length()-1); Daniel, that look okay? I can batch it in with the other changes I have to this file (which are ready to go in today).
Status: NEW → ASSIGNED
Your patch looks ok. If you want to avoid three calls to Length() in two lines, you can take the patch I just did before I saw your fix: @@ -1291,9 +1292,13 @@ return; } WriteQuotesAndIndent(); + // Remove SPACE from the end of the line. - while(' ' == mCurrentLine[mCurrentLine.Length()-1]) - mCurrentLine.SetLength(mCurrentLine.Length()-1); + PRUint32 linelength = mCurrentLine.Length(); + while(linelength > 0 && + ' ' == mCurrentLine[--linelength]) + mCurrentLine.SetLength(linelength); + if(mFlags & nsIDocumentEncoder::OutputFormatFlowed) { // Add the soft part of the soft linebreak (RFC 2646 4.1) mCurrentLine.AppendWithConversion(' ');
Great, I like that better (and so does Kin). I'll check it in that way.
Fix checked in.
Status: ASSIGNED → RESOLVED
Closed: 26 years ago
Resolution: --- → FIXED
Works for Me Platform: PC OS: Windows 98 Mozilla Version: 2000100508 Marking as Verified
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.