Closed Bug 502223 Opened 15 years ago Closed 15 years ago

[HTML5] Crash [@ sHtml5PendingNotification::nsHtml5PendingNotification] with binding document.write

Categories

(Core :: DOM: HTML Parser, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: martijn.martijn, Unassigned)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(1 file)

Attached file zipped up testcase
To get this crash, you need to have the html5.enable pref set to true.

See zipped up testcase, to reproduce the crash, open the file named 'Kopie van parentframe.htm'.

http://crash-stats.mozilla.com/report/index/7d7d0c31-d15f-4d30-a789-c5fa22090703?p=1
0  	xul.dll  	nsHtml5PendingNotification::nsHtml5PendingNotification  	 parser/html/nsHtml5PendingNotification.h:51
1 	xul.dll 	nsTArrayElementTraits<nsHtml5PendingNotification>::Construct<nsIContent*> 	obj-firefox/dist/include/nsTArray.h:193
2 	xul.dll 	nsTArray<nsHtml5PendingNotification>::AssignRange<nsIContent*> 	obj-firefox/dist/include/nsTArray.h:875
3 	xul.dll 	nsTArray<nsHtml5PendingNotification>::AppendElements<nsIContent*> 	obj-firefox/dist/include/nsTArray.h:618
4 	xul.dll 	nsHtml5TreeBuilder::PostPendingAppendNotification 	parser/html/nsHtml5TreeBuilderHSupplement.h:107
5 	xul.dll 	nsHtml5TreeOperation::Perform 	parser/html/nsHtml5TreeOperation.cpp:63
6 	xul.dll 	nsHtml5TreeBuilder::Flush 	parser/html/nsHtml5TreeBuilderCppSupplement.h:477
7 	xul.dll 	nsHtml5Parser::Parse 	parser/html/nsHtml5Parser.cpp:442
8 	xul.dll 	nsHTMLDocument::WriteCommon 	content/html/document/src/nsHTMLDocument.cpp:2172
9 	xul.dll 	nsHTMLDocument::ScriptWriteCommon 	content/html/document/src/nsHTMLDocument.cpp:2250
10 	xul.dll 	nsHTMLDocument::Write 	content/html/document/src/nsHTMLDocument.cpp:2256
11 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
12 	xul.dll 	XPCWrappedNative::CallMethod 	js/src/xpconnect/src/xpcwrappednative.cpp:2478
I think bug 503473 is relevant here.
Depends on: 503473
Attachment #386727 - Attachment mime type: application/zip → application/java-archive
Can't reproduce with a Mac 20090726 trunk build, but since I'm running the test from the attachment using jar: maybe that's not valid for this bug.
Maybe a duplicate of bug 502869.
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ sHtml5PendingNotification::nsHtml5PendingNotification]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: