502869 - [HTML5] Crash [@ nsHtml5TreeBuilder::appendToCurrentNodeAndPushElementMayFoster] with document.write and removing stuff

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, to get this crash, you need to have the html5.enable pref set to true.
I guess it might be related to the other HTML5 parser crashes.

http://crash-stats.mozilla.com/report/index/13e74244-37ab-4a11-b461-4a1592090707?p=1
0  	XUL  	nsHtml5TreeBuilder::appendToCurrentNodeAndPushElementMayFoster  	 parser/html/nsHtml5TreeBuilder.cpp:3384
1 	XUL 	nsHtml5TreeBuilder::startTag 	parser/html/nsHtml5TreeBuilder.cpp:1292
2 	XUL 	nsHtml5Tokenizer::stateLoop 	parser/html/nsHtml5Tokenizer.cpp:364
3 	XUL 	nsHtml5Tokenizer::tokenizeBuffer 	parser/html/nsHtml5Tokenizer.cpp:459
4 	XUL 	nsHtml5Parser::Parse 	parser/html/nsHtml5Parser.cpp:378
5 	XUL 	nsHTMLDocument::WriteCommon 	content/html/document/src/nsHTMLDocument.cpp:2172
6 	XUL 	nsHTMLDocument::ScriptWriteCommon 	content/html/document/src/nsHTMLDocument.cpp:2228
7 	XUL 	nsHTMLDocument::Write 	content/html/document/src/nsHTMLDocument.cpp:2256
8 	XUL 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
9 	XUL 	XPCWrappedNative::CallMethod 	js/src/xpconnect/src/xpcwrappednative.cpp:2691
10 	XUL 	XPC_WN_CallMethod 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1732
11 	libmozjs.dylib 	js_Invoke 	js/src/jsinterp.cpp:1389
etc...

Comment 1

[Henri Sivonen (:hsivonen) (not reading bugmail until 2026-07-27)]

Attachment: Set life cycle before emitting EOF

Comment 2

[Henri Sivonen (:hsivonen) (not reading bugmail until 2026-07-27)]

Comment on attachment 393748 [details] [diff] [review]
Set life cycle before emitting EOF

This patch isn't quite right.

Comment 3

[Henri Sivonen (:hsivonen) (not reading bugmail until 2026-07-27)]

Attachment: Flush and set life cycle better relative to eof()

Comment 4

[Ben Newman (:bnewman) (:benjamn)]

Comment on attachment 393810 [details] [diff] [review]
Flush and set life cycle better relative to eof()

Changes make sense to me.  I can also confirm that this patch fixes the crash under WinXP.  Would it be useful to write a crash test for this, to prevent regressions?

Comment 5

[Henri Sivonen (:hsivonen) (not reading bugmail until 2026-07-27)]

http://hg.mozilla.org/mozilla-central/rev/15ea02367063

(In reply to comment #4)
> (From update of attachment 393810 [details] [diff] [review])
> Changes make sense to me.  I can also confirm that this patch fixes the crash
> under WinXP.

Thank you.

> Would it be useful to write a crash test for this, to prevent
> regressions?

Yes. I need to learn how to write crash tests.

Comment 6

[Mats Palmgren (inactive)]

Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/4a82058ffa7a

Comment 7

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/4a82058ffa7a