542268 - [HTML5] frame construction stack overflow on radiofly.ws

Status: RESOLVED WORKSFORME

(Core :: DOM: HTML Parser, defect, P2)

Description

[Black_Ps`]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)

Crash when loading a page,this is the first time is crashing usually it hangs,can somebody check the problem out? 

bp-e839b811-c74f-4a6f-a53e-6a3ff2100126 , i think it's ad addon problem but witch one?


Thanks. 

Reproducible: Always

Comment 1

[(mostly gone) XtC4UaLL [:xtc4uall]]

Well, you can disable your extensions one-by-one to find the culprit. then install that extension to a new separate profile and verify it's causing the crash in double-checking sense.

Comment 2

[Black_Ps`]

First of all i`m using Firefox/3.6  and not 3.5 , and it's not an addon problem i have enable HTML 5 Parsing and i did try to visit a page and the browser has crushed.


Thanks.

Comment 3

[(mostly gone) XtC4UaLL [:xtc4uall]]

what page?

Comment 4

[Black_Ps`]

http://www.radiofly.ws/filme.html

Comment 5

[(mostly gone) XtC4UaLL [:xtc4uall]]

confirming for 3.6. a local copy of that page does not trigger the crash. also today's trunk nightly is not affected.

Signature	nsRuleNode::GetStyleData(nsStyleStructID, nsStyleContext*, int)
UUID	d4a9a175-5a93-4710-b8ed-f787b2100126
Time 	2010-01-26 16:05:58.774749
Uptime	19
Last Crash	74 seconds before submission
Product	Firefox
Version	3.6
Build ID	20100115144158
Branch	1.9.2
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 15 model 2 stepping 9
Crash Reason	EXCEPTION_STACK_OVERFLOW
Crash Address	0x10125fe4
User Comments	Bug 542268 (safe-mode)
Processor Notes 	This dump is too long and has triggered the automatic truncation routine

Crashing Thread
Frame 	Module 	Signature 	Source
0 	xul.dll 	nsRuleNode::GetStyleData(nsStyleStructID,nsStyleContext*,int) 	layout/style/nsRuleNode.cpp:5744
1 	xul.dll 	nsRuleNode::WalkRuleTree(nsStyleStructID,nsStyleContext*,nsRuleData*,nsCSSStruct*) 	layout/style/nsRuleNode.cpp:1926
2 	xul.dll 	nsRuleNode::GetStyleData(nsStyleStructID,nsStyleContext*,int) 	layout/style/nsStyleStructList.h:89
3 	xul.dll 	nsRuleNode::WalkRuleTree(nsStyleStructID,nsStyleContext*,nsRuleData*,nsCSSStruct*) 	layout/style/nsRuleNode.cpp:1926

...

99 	xul.dll 	nsRuleNode::WalkRuleTree(nsStyleStructID,nsStyleContext*,nsRuleData*,nsCSSStruct*) 	layout/style/nsRuleNode.cpp:1926
100 	xul.dll 	nsRuleNode::GetStyleData(nsStyleStructID,nsStyleContext*,int) 	layout/style/nsStyleStructList.h:89
5225 	xul.dll 	nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&,nsCSSFrameConstructor::FrameConstructionItemList&,nsIFrame*,nsFrameItems&) 	layout/base/nsCSSFrameConstructor.cpp:9609
5226 	xul.dll 	nsCSSFrameConstructor::ConstructInline(nsFrameConstructorState&,nsCSSFrameConstructor::FrameConstructionItem&,nsIFrame*,nsStyleDisplay const*,nsFrameItems&,nsIFrame**) 	layout/base/nsCSSFrameConstructor.cpp:10821
5227 	xul.dll 	nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&,nsFrameConstructorState&,nsIFrame*,nsFrameItems&) 	layout/base/nsCSSFrameConstructor.cpp:3933
5228 	xul.dll 	nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&,nsCSSFrameConstructor::FrameConstructionItemList::Iterator&,nsIFrame*,nsFrameItems&) 	layout/base/nsCSSFrameConstructor.cpp:5644
5229 	xul.dll 	nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&,nsCSSFrameConstructor::FrameConstructionItemList&,nsIFrame*,nsFrameItems&) 	layout/base/nsCSSFrameConstructor.cpp:9609
5230 	xul.dll 	nsCSSFrameConstructor::ConstructInline(nsFrameConstructorState&,nsCSSFrameConstructor::FrameConstructionItem&,nsIFrame*,nsStyleDisplay const*,nsFrameItems&,nsIFrame**) 	layout/base/nsCSSFrameConstructor.cpp:10821

...

5300 	xul.dll 	nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&,nsCSSFrameConstructor::FrameConstructionItemList::Iterator&,nsIFrame*,nsFrameItems&) 	layout/base/nsCSSFrameConstructor.cpp:5644
5301 	xul.dll 	nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&,nsIContent*,nsStyleContext*,nsIFrame*,int,nsFrameItems&,int,PendingBinding*) 	layout/base/nsCSSFrameConstructor.cpp:9717
5302 	xul.dll 	nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState&,nsStyleDisplay const*,nsIContent*,nsIFrame*,nsIFrame*,nsStyleContext*,nsIFrame**,nsFrameItems&,int,PendingBinding*) 	layout/base/nsCSSFrameConstructor.cpp:10771
5303 	xul.dll 	nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&,nsFrameConstructorState&,nsIFrame*,nsFrameItems&) 	layout/base/nsCSSFrameConstructor.cpp:3933
5304 		@0x4e4547f 	
5305 	xul.dll 	nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&,nsIContent*,nsStyleContext*,nsIFrame*,int,nsFrameItems&,int,PendingBinding*) 	layout/base/nsCSSFrameConstructor.cpp:9717
5306 	xul.dll 	nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState&,nsStyleDisplay const*,nsIContent*,nsIFrame*,nsIFrame*,nsStyleContext*,nsIFrame**,nsFrameItems&,int,PendingBinding*) 	layout/base/nsCSSFrameConstructor.cpp:10771
5307 	xul.dll 	nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&,nsFrameConstructorState&,nsIFrame*,nsFrameItems&) 	layout/base/nsCSSFrameConstructor.cpp:3933
5308 		@0x4e4547f 	
5309 	xul.dll 	PresShell::ContentAppended(nsIDocument*,nsIContent*,int) 	layout/base/nsPresShell.cpp:5039
5310 	xul.dll 	nsNodeUtils::ContentAppended(nsIContent*,int) 	content/base/src/nsNodeUtils.cpp:134
5311 	xul.dll 	nsHtml5PendingNotification::Fire() 	parser/html/nsHtml5PendingNotification.h:60
5312 	xul.dll 	nsHtml5TreeBuilder::FlushPendingAppendNotifications() 	parser/html/nsHtml5TreeBuilderHSupplement.h:118
5313 	xul.dll 	nsHtml5TreeBuilder::Flush() 	parser/html/nsHtml5TreeBuilderCppSupplement.h:482
5314 	xul.dll 	nsHtml5TreeBuilder::MaybeFlush() 	parser/html/nsHtml5TreeBuilderHSupplement.h:79
5315 	xul.dll 	nsHtml5Parser::ContinueInterruptedParsing() 	parser/html/nsHtml5Parser.cpp:246
5316 	xul.dll 	nsHtml5Parser::HandleParserContinueEvent(nsHtml5ParserContinueEvent*) 	parser/html/nsHtml5Parser.cpp:864
5317 	xul.dll 	nsHtml5ParserContinueEvent::Run() 	parser/html/nsHtml5Parser.cpp:82
5318 	xul.dll 	nsThread::ProcessNextEvent(int,int*) 	xpcom/threads/nsThread.cpp:527
5319 	xul.dll 	nsBaseAppShell::Run() 	widget/src/xpwidgets/nsBaseAppShell.cpp:170
5320 	xul.dll 	nsAppStartup::Run() 	toolkit/components/startup/src/nsAppStartup.cpp:182
5321 	nspr4.dll 	PR_GetEnv 	
5322 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:120
5323 	firefox.exe 	__tmainCRTStartup 	obj-firefox/memory/jemalloc/crtsrc/crtexe.c:591
5324 	kernel32.dll 	BaseProcessStart

Comment 6

[Boris Zbarsky [:bzbarsky]]

Hmm.  I can't reproduce (on Mac, though).

Do you only see the problem with the html5 parser (which is _very_ broken in 3.6) enabled?

Comment 7

[(mostly gone) XtC4UaLL [:xtc4uall]]

ugh, yes html5 is enabled for me when crashing. shame on me for not thinking of this.
that said, it's crashing today's trunk build with html5 enabled too:
bp-6fad6da2-34f1-4f0a-a345-cf33c2100126 [@ CSSStyleRuleImpl::MapRuleInfoInto(nsRuleData*) ]

Comment 8

[Boris Zbarsky [:bzbarsky]]

OK.  I can definitely not reproduce this on trunk, on mac.

Can you try loading the page in a display:none iframe (so as to avoid that layout part that crashes) and comparing the DOM generated by the HTML5 parser to the one the normal parser generates?   How do they differ?

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Should we just disable the HTML5 parser pref on 1.9.2 ?

Comment 10

[Boris Zbarsky [:bzbarsky]]

I think we've been considering that, yes.

Comment 11

[Timothy Nikkel (:tnikkel)]

Crashes latest nightly on Windows for me, but debug Linux build doesn't show any problem.

Comment 12

[Henri Sivonen (:hsivonen)]

Looks similar to bug 507119.

(In reply to comment #9)
> Should we just disable the HTML5 parser pref on 1.9.2 ?

I think we should or, failing that, at minimum I think we should rename the pref on 1.9.2 to html5.obsolete.enable so that enabling the parser on trunk and sharing the profile with release builds doesn't end up enabling the parser on the release branch. See the discussion in bug 538722.

Comment 13

[Boris Zbarsky [:bzbarsky]]

> but debug Linux build doesn't show any problem.

Yeah, I think Windows tends to have a lower stack limit than OSX or Linux.

Comment 14

[Henri Sivonen (:hsivonen)]

I expect a patch I just landed to fix this. Worth testing in tomorrow's Windows nightly.

Comment 15

[Henri Sivonen (:hsivonen)]

WFM on XP. Maybe the site changed? In any case, the fix for bug 561874 should fix this one, too.

Comment 16

[Henri Sivonen (:hsivonen)]

Or maybe the fix from March fixed this and the fix for bug 561874 just doesn't regress this.