Closed Bug 53935 Opened 25 years ago Closed 25 years ago

Crash viewing long page

Categories

(Core :: DOM: HTML Parser, defect, P1)

x86
All
defect

Tracking

()

VERIFIED FIXED

People

(Reporter: bugzilla, Assigned: rickg)

References

()

Details

(Keywords: crash, Whiteboard: [rtm++][Fix in hand])

Attachments

(4 files)

Build ID: just pulled I crash in GKHTML.DLL viewing the URL (don't ask why I was there :P) will try in a debug build asap.
I get a crash in kernel32.dll on http://www.palosverdes.com/rpv/munidatabase/rpv/index.cfm after hitting "search" (2000 092212), but I'm not getting it on 2000 092408. http://www.ex-mozilla.org/date.html does crash for me, in gkhtml.dll, on 2000 092408.
It's asserting in HandleAttributeToken(), which will only happen in a debug build. I'll dig into the page later today to find out why.
Status: NEW → ASSIGNED
Min test case: <table> <body> <a href="foo">foo</a> </body> <FONT SIZE="+2"> Crash me!</FONT> Requesting nsbeta3+ status because it's a very simple testcase, and an even easier fix.
Keywords: nsbeta3
OS: Windows 98 → All
Priority: P3 → P1
Whiteboard: [nsbeta3+]
Target Milestone: --- → M18
*spam* adding crash keyword...
Keywords: crash
PDT marking nsbeta3-, nominate for rtm if appropriate.
Whiteboard: [nsbeta3+] → [nsbeta3-]
We simply *cant* ship with this. Please approve for RTM.
Keywords: nsbeta3rtm
Whiteboard: [nsbeta3-] → [rtm]
Whiteboard: [rtm]
fix in hand. Marking RTM.
Whiteboard: [RTM] -- fix in hand.
[RTM] in the status whiteboard doesn't mean anything. It should either be [RTM+] (if you're allowed to + bugs), or the `rtm' keyword (in the keyword field) to nominate it to be fixed for RTM.
Whiteboard: [RTM] -- fix in hand. → [RTM+] -- fix in hand.
marking ++ for review.
Whiteboard: [RTM+] -- fix in hand. → [RTM++] -- fix in hand.
This is caused by a logic error in HandleOmittedTags() and/or HandleSavedTokens(). The <table> is getting closed in HandleSavedTokens() when it's autoclosing the stack to the marked position in order to deal with the misplaced stuff. That would be fine, so long as it gets pushed back later (it doesnt). We also fail to capture an attribute token before jumping into HandleSavedTokens(), which later gets handled normally, which is why we assert. Overall -- this code is *scary* -- please review.
Assignee: rickg → harishd
Status: ASSIGNED → NEW
Whiteboard: [RTM++] -- fix in hand. → [RTM+]
Darn, it definitely looks scary!!! I'll take a look into this. Thanx Rickg for the reduced case.
Status: NEW → ASSIGNED
Whiteboard: [RTM+] → [RTM+][Fix in hand]
PDT marking [rtm need info] until code reviews are available. If the patch is scary, can we validate it on the trunk before applying to the RTM branch?
Whiteboard: [RTM+][Fix in hand] → [RTM need info][Fix in hand]
PDT: The code was scary before the patch not after the patch.
a=buster. recommend for rtm++. I talked at length with harish about this, and it seems like a significant stability win. We did a detailed code review, and the changes look good.
Marking rtm+ to get back onto the PDT radar.
Whiteboard: [RTM need info][Fix in hand] → [rtm+][Fix in hand]
The patch looks fine to me.
PDT marking [rtm++]
Whiteboard: [rtm+][Fix in hand] → [rtm++][Fix in hand]
Fix is in the branch & trunk. Marking fixed.
Status: ASSIGNED → RESOLVED
Closed: 25 years ago
Resolution: --- → FIXED
Works (very slowly) on the trunk build but not on the branch build. tested on: trunk build - 2000-10-12-09-Mtrunk : win32 branch builds- 2000-10-12-13-MN6 : win32 2000-10-12-09-MN6 : linux 2000-10-11-10-MN6 : mac attaching talkback reports from windows crash and from linux crash
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Attached file linux talkback report
This is a different stack trace altogether. That is, the bug is not the same anymore. BlockFrame = buster :-) Reassigning to buster and ccing waterson.
Assignee: harishd → buster
Status: REOPENED → NEW
Assignee: buster → rickg
the reported crash has nothing to do with this bug. Resetting this bug to rickg and fixed, filing another bug for the newly discovered problem.
this bug really is fixed
Status: NEW → RESOLVED
Closed: 25 years ago25 years ago
Resolution: --- → FIXED
verified
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: