Closed Bug 555462 Opened 10 years ago Closed 10 years ago

[html5] Heap corruption crash [@ nsHtml5TreeBuilder::ensureBufferSpace] with textarea

Categories

(Core :: HTML: Parser, defect, P1, critical)

defect

Tracking

()

VERIFIED FIXED

People

(Reporter: martijn.martijn, Assigned: hsivonen)

References

Details

(Keywords: crash, testcase, Whiteboard: [sg:critical])

Crash Data

Attachments

(2 files)

Attached file testcase
I'm getting a crash with the testcase after a couple of reloads:

http://crash-stats.mozilla.com/report/index/422d2439-2580-44bf-b997-83a1f2100327
0  	mozcrt19.dll  	arena_dalloc_small  	 obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:4104
1 	mozcrt19.dll 	arena_dalloc 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:4227
2 	mozcrt19.dll 	free 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:6017
3 	plds4.dll 	PL_FinishArenaPool 	nsprpub/lib/ds/plarena.c:324
4 	xul.dll 	RuleHash::~RuleHash 	layout/style/nsCSSRuleProcessor.cpp:496
5 	xul.dll 	RuleCascadeData::~RuleCascadeData 	layout/style/nsCSSRuleProcessor.cpp:735
6 	xul.dll 	nsJARURI::FormatSpec 	modules/libjar/nsJARURI.cpp:116
7 	xul.dll 	DocumentViewerImpl::Show 	layout/base/nsDocumentViewer.cpp:1901
8 	xul.dll 	DocumentViewerImpl::QueryInterface 	layout/base/nsDocumentViewer.cpp:574
9 	xul.dll 	nsCOMPtr_base::assign_from_qi 	obj-firefox/xpcom/build/nsCOMPtr.cpp:96
10 	xul.dll 	DocumentViewerImpl::GetPresContext 	layout/base/nsDocumentViewer.cpp:1788
11 	xul.dll 	nsPresContext::EnsureVisible 	layout/base/nsPresContext.cpp:1630
12 	xul.dll 	PresShell::UnsuppressAndInvalidate 	layout/base/nsPresShell.cpp:4414
13 	xul.dll 	nsTimerImpl::Release 	xpcom/threads/nsTimerImpl.cpp:94
14 	xul.dll 	PresShell::UnsuppressPainting 	layout/base/nsPresShell.cpp:4450
15 	xul.dll 	PresShell::UnsuppressPainting 	layout/base/nsPresShell.cpp:4463
16 	xul.dll 	DocumentViewerImpl::LoadComplete 	layout/base/nsDocumentViewer.cpp:1069

But I seem to be getting different stacks.

In a debug build, I get a complaint of heap corruption. I get this stack, when I hit the retry button:
 	msvcr90d.dll!_free_dbg_nolock(void * pUserData=0x09ec7560, int nBlockUse=1)  Line 1371 + 0x3b bytes	C++
 	msvcr90d.dll!_free_dbg(void * pUserData=0x09ec7560, int nBlockUse=1)  Line 1258 + 0xd bytes	C++
 	msvcr90d.dll!free(void * pUserData=0x09ec7560)  Line 49 + 0xb bytes	C++
>	mozalloc.dll!moz_free(void * ptr=0x09ec7560)  Line 69 + 0xa bytes	C++
 	xul.dll!operator delete[](void * ptr=0x09ec7560)  Line 258 + 0x9 bytes	C++
 	xul.dll!jArray<unsigned short,int>::release()  Line 56 + 0x1a bytes	C++
 	xul.dll!nsHtml5TreeBuilder::ensureBufferSpace(int addedLength=22)  Line 204	C++
 	xul.dll!nsHtml5Tokenizer::ensureBufferSpace(int addedLength=22)  Line 386	C++
 	xul.dll!nsHtml5Tokenizer::tokenizeBuffer(nsHtml5UTF16Buffer * buffer=0x091fd6d0)  Line 359	C++
 	xul.dll!nsHtml5StreamParser::ParseAvailableData()  Line 806 + 0x1e bytes	C++
 	xul.dll!nsHtml5StreamParser::DoDataAvailable(unsigned char * aBuffer=0x0932f3b0, unsigned int aLength=5142)  Line 649	C++
 	xul.dll!nsHtml5DataAvailable::Run()  Line 669	C++
 	xul.dll!nsThread::ProcessNextEvent(int mayWait=1, int * result=0x08cffa88)  Line 527 + 0x19 bytes	C++
 	xul.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x03620ad0, int mayWait=1)  Line 250 + 0x16 bytes	C++
 	xul.dll!nsThread::ThreadFunc(void * arg=0x03620ad0)  Line 254 + 0xb bytes	C++
 	nspr4.dll!_PR_NativeRunThread(void * arg=0x037c6dd0)  Line 426 + 0xf bytes	C
 	nspr4.dll!pr_root(void * arg=0x037c6dd0)  Line 122 + 0xf bytes	C
 	msvcr90d.dll!_callthreadstartex()  Line 348 + 0xf bytes	C
 	msvcr90d.dll!_threadstartex(void * ptd=0x023b1ff0)  Line 331	C
 	kernel32.dll!76af1194() 	
 	[Frames below may be incorrect and/or missing, no symbols loaded for kernel32.dll]	
 	ntdll.dll!774eb3f5() 	
 	ntdll.dll!774eb3c8() 	

So it seems html5 parser related. And indeed, if I turn off html5 parsing, then I don't seem to get a crash.
Weird, apparently, it's no problem online, only when loading the testcase locally.
Does the problem go away if you backout the two changesets mentioned above?
I'm unable to reproduce this either locally or online in an opt build on Linux x86_64.
Sorry, I have no idea to back out http://hg.mozilla.org/mozilla-central/rev/a0f0fde99844 in my local tree at this point.
I ran a debug build on Linux x86_64 in valgrind. When loading the test case from bugzilla, the result was clean. When loading locally, I got:

Program ./firefox-bin (pid = 10172) received signal 11.
Stack:
UNKNOWN [/lib/libpthread.so.0 +0x0000F190]
memset+0x00000040 [/lib/libc.so.6 +0x000810E0]
UNKNOWN [./libplds4.so +0x00001753]
PL_FinishArenaPool+0x00000024 [./libplds4.so +0x000018C5]
UNKNOWN [./libxul.so +0x00B703FB]
UNKNOWN [./libxul.so +0x00B77BBA]
UNKNOWN [./libxul.so +0x00B763F5]
UNKNOWN [./libxul.so +0x00B716C4]
UNKNOWN [./libxul.so +0x00B718ED]
UNKNOWN [./libxul.so +0x009DDD0C]
UNKNOWN [./libxul.so +0x009DD3AD]
UNKNOWN [./libxul.so +0x00A09CF4]
UNKNOWN [./libxul.so +0x00A09275]
UNKNOWN [./libxul.so +0x009A63CA]
UNKNOWN [./libxul.so +0x009E1FAB]
UNKNOWN [./libxul.so +0x009E0335]
UNKNOWN [./libxul.so +0x009DC4AF]
UNKNOWN [./libxul.so +0x009D22B6]
UNKNOWN [./libxul.so +0x009D3279]
UNKNOWN [./libxul.so +0x00A01F25]
UNKNOWN [./libxul.so +0x00A13CA6]
UNKNOWN [./libxul.so +0x00A13F23]
UNKNOWN [./libxul.so +0x009CFA45]
UNKNOWN [./libxul.so +0x0148A1A0]
UNKNOWN [./libxul.so +0x01489B75]
UNKNOWN [./libxul.so +0x014BB614]
UNKNOWN [./libxul.so +0x014BA226]
UNKNOWN [./libxul.so +0x014B9D41]
UNKNOWN [./libxul.so +0x014B98EF]
UNKNOWN [./libxul.so +0x00749FB4]
UNKNOWN [./libxul.so +0x00D0A5BD]
UNKNOWN [./libxul.so +0x00D0A398]
UNKNOWN [./libxul.so +0x00CFF82C]
UNKNOWN [./libxul.so +0x00D19A48]
UNKNOWN [./libxul.so +0x01AF1953]
UNKNOWN [./libxul.so +0x01A810A4]
UNKNOWN [./libxul.so +0x019C5A08]
MessageLoop::RunInternal()+0x00000079 [./libxul.so +0x01B6BDF1]
MessageLoop::RunHandler()+0x00000018 [./libxul.so +0x01B6BD76]
UNKNOWN [./libxul.so +0x01B6BD07]
UNKNOWN [./libxul.so +0x0186959D]
UNKNOWN [./libxul.so +0x0158254D]
XRE_main+0x00002A81 [./libxul.so +0x005F64D9]
UNKNOWN [./firefox-bin +0x000021F2]
__libc_start_main+0x000000FD [/lib/libc.so.6 +0x0001EABD]
UNKNOWN [./firefox-bin +0x00001CD9]
Sleeping for 300 seconds.
Type 'gdb ./firefox-bin 10172' to attach your debugger to this thread.

(gdb) bt
#0  0x00007f7ee4079f51 in nanosleep () from /lib/libc.so.6
#1  0x00007f7ee4079da0 in __sleep (seconds=<value optimized out>)
    at ../sysdeps/unix/sysv/linux/sleep.c:138
#2  0x00007f7ee898b6cf in ah_crap_handler (signum=11)
    at /opt/Projects/mozilla-html5/toolkit/xre/nsSigHandlers.cpp:164
#3  0x00007f7ee89902c5 in nsProfileLock::FatalSignalHandler (signo=11, 
    info=0x7fff920451f0, context=0x7fff920450c0) at nsProfileLock.cpp:221
#4  <signal handler called>
#5  memset () at ../sysdeps/x86_64/memset.S:65
#6  0x00007f7ee7905753 in FreeArenaList (pool=0x7f7ec1a068e0, 
    head=0x7f7ec1a068e0, reallyFree=1)
    at /opt/Projects/mozilla-html5/nsprpub/lib/ds/plarena.c:284
#7  0x00007f7ee79058c5 in PL_FinishArenaPool (pool=0x7f7ec1a068e0)
    at /opt/Projects/mozilla-html5/nsprpub/lib/ds/plarena.c:324
#8  0x00007f7ee8ef73fb in ~RuleHash (this=0x7f7ec1a06800, 
    __in_chrg=<value optimized out>)
    at /opt/Projects/mozilla-html5/layout/style/nsCSSRuleProcessor.cpp:496
#9  0x00007f7ee8efebba in ~RuleCascadeData (this=0x7f7ec1a06800, 
    __in_chrg=<value optimized out>)
    at /opt/Projects/mozilla-html5/layout/style/nsCSSRuleProcessor.cpp:735
#10 0x00007f7ee8efd3f5 in nsCSSRuleProcessor::ClearRuleCascades (
    this=0x7f7ec13c5240)
    at /opt/Projects/mozilla-html5/layout/style/nsCSSRuleProcessor.cpp:2453
---Type <return> to continue, or q <return> to quit---
#11 0x00007f7ee8ef86c4 in ~nsCSSRuleProcessor (this=0x7f7ec13c5240, 
    __in_chrg=<value optimized out>)
    at /opt/Projects/mozilla-html5/layout/style/nsCSSRuleProcessor.cpp:854
#12 0x00007f7ee8ef88ed in nsCSSRuleProcessor::Release (this=0x7f7ec13c5240)
    at /opt/Projects/mozilla-html5/layout/style/nsCSSRuleProcessor.cpp:857
#13 0x00007f7ee8d64d0c in ~nsCOMPtr (this=0x7f7eca5d1720, 
    __in_chrg=<value optimized out>) at ../../dist/include/nsCOMPtr.h:510
#14 0x00007f7ee8d643ad in ~nsStyleSet (this=0x7f7eca5d16e0, 
    __in_chrg=<value optimized out>)
    at /opt/Projects/mozilla-html5/layout/base/../style/nsStyleSet.h:80
#15 0x00007f7ee8d90cf4 in ~PresShell (this=0x7f7ec1a03000, 
    __in_chrg=<value optimized out>)
    at /opt/Projects/mozilla-html5/layout/base/nsPresShell.cpp:1553
#16 0x00007f7ee8d90275 in PresShell::Release (this=0x7f7ec1a03000)
    at /opt/Projects/mozilla-html5/layout/base/nsPresShell.cpp:1530
#17 0x00007f7ee8d2d3ca in nsCOMPtr<nsIPresShell>::assign_assuming_AddRef (
    this=0x7f7ec4046330, newPtr=0x0) at ../../dist/include/nsCOMPtr.h:495
#18 0x00007f7ee8d68fab in nsCOMPtr<nsIPresShell>::assign_with_AddRef (
    this=0x7f7ec4046330, rawPtr=0x0) at ../../dist/include/nsCOMPtr.h:1181
#19 0x00007f7ee8d67335 in nsCOMPtr<nsIPresShell>::operator= (
    this=0x7f7ec4046330, rhs=0x0) at ../../dist/include/nsCOMPtr.h:640
#20 0x00007f7ee8d634af in DocumentViewerImpl::DestroyPresShell (
    this=0x7f7ec40462c0)
---Type <return> to continue, or q <return> to quit---
    at /opt/Projects/mozilla-html5/layout/base/nsDocumentViewer.cpp:4230
#21 0x00007f7ee8d592b6 in DocumentViewerImpl::Destroy (this=0x7f7ec40462c0)
    at /opt/Projects/mozilla-html5/layout/base/nsDocumentViewer.cpp:1615
#22 0x00007f7ee8d5a279 in DocumentViewerImpl::Show (this=0x7f7ec4046540)
    at /opt/Projects/mozilla-html5/layout/base/nsDocumentViewer.cpp:1901
#23 0x00007f7ee8d88f25 in nsPresContext::EnsureVisible (this=0x7f7ec14d7000)
    at /opt/Projects/mozilla-html5/layout/base/nsPresContext.cpp:1630
#24 0x00007f7ee8d9aca6 in PresShell::UnsuppressAndInvalidate (
    this=0x7f7ec407dc00)
    at /opt/Projects/mozilla-html5/layout/base/nsPresShell.cpp:4414
#25 0x00007f7ee8d9af23 in PresShell::UnsuppressPainting (this=0x7f7ec407dc00)
    at /opt/Projects/mozilla-html5/layout/base/nsPresShell.cpp:4463
#26 0x00007f7ee8d56a45 in DocumentViewerImpl::LoadComplete (
    this=0x7f7ec4046540, aStatus=0)
    at /opt/Projects/mozilla-html5/layout/base/nsDocumentViewer.cpp:1069
#27 0x00007f7ee98111a0 in nsDocShell::EndPageLoad (this=0x7f7ecfd12800, 
    aProgress=0x7f7ecfd12828, aChannel=0x7f7ec15f53c0, aStatus=0)
    at /opt/Projects/mozilla-html5/docshell/base/nsDocShell.cpp:5746
#28 0x00007f7ee9810b75 in nsDocShell::OnStateChange (this=0x7f7ecfd12800, 
    aProgress=0x7f7ecfd12828, aRequest=0x7f7ec15f53c0, aStateFlags=131088, 
    aStatus=0) at /opt/Projects/mozilla-html5/docshell/base/nsDocShell.cpp:5624
#29 0x00007f7ee9842614 in nsDocLoader::FireOnStateChange (this=0x7f7ecfd12800, 
    aProgress=0x7f7ecfd12828, aRequest=0x7f7ec15f53c0, aStateFlags=131088, 
---Type <return> to continue, or q <return> to quit---
    aStatus=0)
    at /opt/Projects/mozilla-html5/uriloader/base/nsDocLoader.cpp:1314
#30 0x00007f7ee9841226 in nsDocLoader::doStopDocumentLoad (
    this=0x7f7ecfd12800, request=0x7f7ec15f53c0, aStatus=0)
    at /opt/Projects/mozilla-html5/uriloader/base/nsDocLoader.cpp:926
#31 0x00007f7ee9840d41 in nsDocLoader::DocLoaderIsEmpty (this=0x7f7ecfd12800, 
    aFlushLayout=1)
    at /opt/Projects/mozilla-html5/uriloader/base/nsDocLoader.cpp:802
#32 0x00007f7ee98408ef in nsDocLoader::OnStopRequest (this=0x7f7ecfd12800, 
    aRequest=0x7f7ec13b0b00, aCtxt=0x0, aStatus=0)
    at /opt/Projects/mozilla-html5/uriloader/base/nsDocLoader.cpp:697
#33 0x00007f7ee8ad0fb4 in nsLoadGroup::RemoveRequest (this=0x7f7ed21358a0, 
    request=0x7f7ec13b0b00, ctxt=0x0, aStatus=0)
    at /opt/Projects/mozilla-html5/netwerk/base/src/nsLoadGroup.cpp:680
#34 0x00007f7ee90915bd in nsDocument::DoUnblockOnload (this=0x7f7ec13df000)
    at /opt/Projects/mozilla-html5/content/base/src/nsDocument.cpp:7105
#35 0x00007f7ee9091398 in nsDocument::UnblockOnload (this=0x7f7ec13df000, 
    aFireSync=1)
    at /opt/Projects/mozilla-html5/content/base/src/nsDocument.cpp:7052
#36 0x00007f7ee908682c in nsDocument::DispatchContentLoadedEvents (
    this=0x7f7ec13df000)
    at /opt/Projects/mozilla-html5/content/base/src/nsDocument.cpp:4024
#37 0x00007f7ee90a0a48 in nsRunnableMethod<nsDocument, void>::Run (
---Type <return> to continue, or q <return> to quit---
    this=0x7f7ec4614bb0) at ../../../dist/include/nsThreadUtils.h:282
#38 0x00007f7ee9e78953 in nsThread::ProcessNextEvent (this=0x7f7edeb52700, 
    mayWait=0, result=0x7fff920467ac)
    at /opt/Projects/mozilla-html5/xpcom/threads/nsThread.cpp:527
#39 0x00007f7ee9e080a4 in NS_ProcessNextEvent_P (thread=0x7f7edeb52700, 
    mayWait=0) at nsThreadUtils.cpp:250
#40 0x00007f7ee9d4ca08 in mozilla::ipc::MessagePump::Run (this=0x7f7ed951b680, 
    aDelegate=0x7f7ed950d6a0)
    at /opt/Projects/mozilla-html5/ipc/glue/MessagePump.cpp:118
#41 0x00007f7ee9ef2df1 in MessageLoop::RunInternal (this=0x7f7ed950d6a0)
    at /opt/Projects/mozilla-html5/ipc/chromium/src/base/message_loop.cc:216
#42 0x00007f7ee9ef2d76 in MessageLoop::RunHandler (this=0x7f7ed950d6a0)
    at /opt/Projects/mozilla-html5/ipc/chromium/src/base/message_loop.cc:199
#43 0x00007f7ee9ef2d07 in MessageLoop::Run (this=0x7f7ed950d6a0)
    at /opt/Projects/mozilla-html5/ipc/chromium/src/base/message_loop.cc:173
#44 0x00007f7ee9bf059d in nsBaseAppShell::Run (this=0x7f7ed588bda0)
    at /opt/Projects/mozilla-html5/widget/src/xpwidgets/nsBaseAppShell.cpp:174
#45 0x00007f7ee990954d in nsAppStartup::Run (this=0x7f7ed5c23060)
    at /opt/Projects/mozilla-html5/toolkit/components/startup/src/nsAppStartup.cpp:182
#46 0x00007f7ee897d4d9 in XRE_main (argc=4, argv=0x7fff92047148, 
    aAppData=0x7f7edeb270f0)
    at /opt/Projects/mozilla-html5/toolkit/xre/nsAppRunner.cpp:3548
---Type <return> to continue, or q <return> to quit---
#47 0x00000000004021f2 in main (argc=4, argv=0x7fff92047148)
    at /opt/Projects/mozilla-html5/browser/app/nsBrowserApp.cpp:158
Current language:  auto
The current source language is "auto; currently c".
I'll experiment with reverting various pieces of the changesets mentioned above.
OS: Windows 7 → All
Hardware: x86 → All
Ok, after backing out http://hg.mozilla.org/mozilla-central/rev/a0f0fde99844 , I don't get a heap corruption anymore, so I guess this is a regression from bug 483209.
Blocks: 483209
Yeah, the right fix here is to back out http://hg.mozilla.org/mozilla-central/rev/a0f0fde99844 and then re-land the only desirable part of that changeset (the limit of 200 on the tree builder stack size.)

I'll back it out as soon as I have a time slot that permits me to stick around for long enough to watch the tree go green afterwards.
Attaching the diff that undoes the bad changeset without a merge node.
Assignee: nobody → hsivonen
Status: NEW → ASSIGNED
Blocks: 489820
Pushed
http://hg.mozilla.org/mozilla-central/rev/6b4e4692c3d0

This should probably get a crash test along the lines of
document.write("<textarea><");
document.write("very long string");
Flags: in-testsuite?
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Whiteboard: [sg:critical]
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a5pre) Gecko/20100419 Minefield/3.7a5pre
Status: RESOLVED → VERIFIED
Crash Signature: [@ nsHtml5TreeBuilder::ensureBufferSpace]
Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/8ee1903fad58
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.