502091 - [HTML5] Crash [@ nsContentSink::ProcessHeaderData] with meta in innerHTML

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes in current trunk build when you have the html5.enable pref set to true.

http://crash-stats.mozilla.com/report/index/e7e913f7-e4e4-41d6-a2b1-43c4f2090702
0  	xul.dll  	nsContentSink::ProcessHeaderData  	 content/base/src/nsContentSink.cpp:531
1 	xul.dll 	nsContentSink::ProcessMETATag 	content/base/src/nsContentSink.cpp:810
2 	xul.dll 	xul.dll@0x9a7adf

Comment 1

[Henri Sivonen (:hsivonen) (temporarily not reading bugmail)]

Attachment: Patch for initializing nsContentSink when parsing fragment

nsContentSink wasn't initialized properly in the fragment case. The patch initializes it in ParseFragment() to make sure it's initialized every time the fragment parsing code runs.

Comment 3

[Brian Carpenter [:geeknik]]

I'm seeing this crash in Minefield build 20090707043451 when I'm editing text in a field @ http://su.pr.

http://crash-stats.mozilla.com/report/index/c21b9026-261d-4164-a7cd-adf812090708
http://crash-stats.mozilla.com/report/index/d9debddf-b20e-493f-9342-d64db2090708

Comment 4

[IU]

I get this crash when I click a new email in my Hotmail Inbox.

Comment 5

[[e-mail]]

Firefox is crashing for me too, when using hotmail.

http://crash-stats.mozilla.com/report/index/82b1940b-6472-44dc-b91d-425512090710
http://crash-stats.mozilla.com/report/index/9e6bf7cc-ef44-4ecb-a2c0-b20d32090710
http://crash-stats.mozilla.com/report/index/8ddc647b-b62a-4fd0-9269-7d5dd2090710

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2a1pre) Gecko/20090710 Minefield/3.6a1pre ID:20090710044907

Comment 6

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Need tests too though.

Comment 8

[Henri Sivonen (:hsivonen) (temporarily not reading bugmail)]

Thanks. Pushed fix without test in order to avoid having testers seeing a known crash. I didn't forget the test.
http://hg.mozilla.org/mozilla-central/rev/439de76c5cc8

Comment 9

[Jonathan Griffin (:jgriffin)]

Attachment: mochitest test case

Here's a test case for this; passes on trunk with html5.enable=true.

Comment 10

[Jonathan Griffin (:jgriffin)]

Attachment: mochitest test case v2

Update to original test which resets html5.enable to its original value at the end of the test.

Comment 11

[Jonathan Griffin (:jgriffin)]

Pushed test as http://hg.mozilla.org/mozilla-central/rev/e32bae21e7a2