507703 - [HTML5] HTML5 parser crash [@ nsHtml5TreeBuilder::markMalformedIfScript]

Status: RESOLVED DUPLICATE of bug 502973

(Core :: DOM: HTML Parser, defect)

Description

[Boris Zbarsky [:bzbarsky]]

BUILD: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090730 Minefield/3.6a1pre nightly.

REPRODUCIBLE: Not so far

STEPS THAT TRIGGERED IT:
1) Go to http://library.minlib.net/search/
2) Type "Ship of Destiny" into the search field
3) Select "Brookline" in the dropdown next to the search field
4) Click the button that has a green checkbox on it and says "Submit"

ACTUAL RESULTS: Crash

EXPECTED RESULTS: No crash

Breakpad data: http://crash-stats.mozilla.com/report/index/7335e2c0-0d5f-4e25-ba55-c59622090731?p=1

Top of stack:
1  	XUL  	nsHtml5TreeBuilder::markMalformedIfScript  	
2 	XUL 	nsHtml5TreeBuilder::popOnEof 	parser/html/nsHtml5TreeBuilder.cpp:3284
3 	XUL 	nsHtml5TreeBuilder::eof 	parser/html/nsHtml5TreeBuilder.cpp:525
4 	XUL 	nsHtml5Tokenizer::eof 	parser/html/nsHtml5Tokenizer.cpp:3231
5 	XUL 	nsHtml5Parser::DidBuildModel 	parser/html/nsHtml5Parser.cpp:768
6 	XUL 	nsHtml5Parser::Terminate 	parser/html/nsHtml5Parser.cpp:437
7 	XUL 	DocumentViewerImpl::Stop 	layout/base/nsDocumentViewer.cpp:1592

(looks like the key was that I clicked that button before the page finished loading?)

Comment 1

[Henri Sivonen (:hsivonen)]

Likely a dupe of bug 502973.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Seems possible.

Comment 3

[Jesse Ruderman]

Yeah, doesn't crash for me in an up-to-date mozilla-central debug build.