I think this has happened to me a couple of times and seems related to using facebook. Shark gives a call stack of: 98.3% 98.3% nsHtml5TreeBuilder::startTag(nsHtml5ElementName*, nsHtml5HtmlAttributes*, int) 0.0% 98.3% nsHtml5Tokenizer::emitCurrentTagToken(int, int) 0.0% 98.3% nsHtml5Tokenizer::stateLoop(int, unsigned short, int, unsigned short*, int, int, int) 0.0% 98.3% nsHtml5Tokenizer::tokenizeBuffer(nsHtml5UTF16Buffer*) 0.0% 98.3% nsHtml5StreamParser::ParseAvailableData() 0.0% 98.3% nsHtml5StreamParserContinuation::Run() 0.0% 98.3% nsThread::ProcessNextEvent(int, int*) 0.0% 98.3% NS_ProcessNextEvent_P(nsIThread*, int)
Do you mean spinning as in infinite loop or spinning that eventually stops?
I've never seen it stop, but I haven't waited more than a couple minutes.
For now, I'll assume this is an infinite loop, because finite but long spinning in that method makes no sense.
Happened again when logging out of facebook. Same stack.
Here's a reproducible, though not minimal, test case: http://people.mozilla.org/~jmuizelaar/html5/600.html The test case comes from an ad iframe on facebook.
Oops sorry about the keyword. Great to have a test case already!
The test case doesn't appear to spin in startTag but instead it returns to the event loop without completing the load.
It still spins in startTag for me and Joe Drew with trunk. I can try to reduce the test case further if it doesn't work for you.
I've reduced the test case at http://people.mozilla.org/~jmuizelaar/html5/600.html further. The problem seems related to document.write()
The problem here is that the tokenizer emits a start tag token for iframe when the tree builder is in the NS_HTML5TREE_BUILDER_TEXT mode. It should be impossible for the tokenizer to emit a start tag token in that case. The document.write()-related state choreography must be faulty somehow.
Created attachment 431849 [details] [diff] [review] Fix
Created attachment 431864 [details] [diff] [review] More defensive fix
Created attachment 431866 [details] [diff] [review] Crashtest Thanks for catching this!