577364 - (Firefox 3.6.x only) firefox crash [@ nsHtml5Parser::ExecuteScript]

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, defect, P5)

Description

[Johannes Pfrang [:johnp]]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.2.7) Gecko/20100701 Firefox/3.6.7
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.2.7) Gecko/20100701 Firefox/3.6.7

Firefox crashed without doing anything unnormal.
Crash report says 
    crash @ nsHtml5Parser::ExecuteScript() | parser/html/nsHtml5Parser.cpp:1302
The Bug exists for me since 3.6.4 and i think it' s fixed for 4.0 Beta 1 (nsHtml5Parser rewritten?), but i didn't test it.

Reproducible: Sometimes




I'm using a lot of Addon Betas, which can be seen in the Crash Reports.

Crash reports(from newest to oldest):

http://crash-stats.mozilla.com/report/index/6d1cf70c-ad27-4dda-8b47-354852100707
http://crash-stats.mozilla.com/report/index/2becc6c1-88e2-4b15-83a1-06a6d2100706
http://crash-stats.mozilla.com/report/index/636ecc8a-2ac9-461e-8eb3-78f622100703
http://crash-stats.mozilla.com/report/index/8ab4f3f9-19df-4685-970b-eb9ca2100629
http://crash-stats.mozilla.com/report/index/b40ae27b-3282-4fc1-ad1d-1bbf82100629
http://crash-stats.mozilla.com/report/index/0d761e34-73b9-4c1f-8168-b2a2a2100624

Comment 1

[timeless]

Signature	nsHtml5Parser::ExecuteScript()
UUID	6d1cf70c-ad27-4dda-8b47-354852100707
Time 	2010-07-07 13:57:06.80814
Uptime	2135
Last Crash	91219 seconds (1.1 days) before submission
Install Age	443710 seconds (5.1 days) since version was first installed.
Product	Firefox
Version	3.6.7
Build ID	20100701024234
Branch	1.9.2
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	AuthenticAMD family 6 model 8 stepping 0
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x0
User Comments	
Processor Notes 	
EMCheckCompatibility	False
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsHtml5Parser::ExecuteScript 	parser/html/nsHtml5Parser.cpp:1302
1 	xul.dll 	nsHtml5Parser::ParseUntilSuspend 	parser/html/nsHtml5Parser.cpp:1228
2 	xul.dll 	xul.dll@0xa4bfbb 	
3 	xul.dll 	nsHtml5Parser::OnDataAvailable 	parser/html/nsHtml5Parser.cpp:672
4 	xul.dll 	nsDocumentOpenInfo::OnDataAvailable 	uriloader/base/nsURILoader.cpp:306
5 	xul.dll 	nsHttpChannel::OnDataAvailable 	netwerk/protocol/http/src/nsHttpChannel.cpp:5391
6 	xul.dll 	nsInputStreamPump::OnStateTransfer 	netwerk/base/src/nsInputStreamPump.cpp:510
7 	xul.dll 	nsBaseAppShell::OnProcessNextEvent 	widget/src/xpwidgets/nsBaseAppShell.cpp:303
8 	xul.dll 	nsOutputStreamReadyEvent::Run 	xpcom/io/nsStreamUtils.cpp:191
9 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:118
10 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:199
11 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:173
12 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:174
13 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:183
14 	nspr4.dll 	nspr4.dll@0xbdcf 	
15 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:120
16 	firefox.exe 	__tmainCRTStartup 	obj-firefox/memory/jemalloc/crtsrc/crtexe.c:591
17 	kernel32.dll 	BaseProcessStart

Comment 2

[Boris Zbarsky [:bzbarsky]]

HTML5 parser isn't supported on 1.9.2 branch and has known crash bugs there.  Can we just disable that pref on that branch, please?  I think Henri has been worried about doing that on the branch for some reason... but I really can't figure out what that reason would be.

Comment 3

[Henri Sivonen (:hsivonen)]

(In reply to comment #2)
> HTML5 parser isn't supported on 1.9.2 branch and has known crash bugs there. 
> Can we just disable that pref on that branch, please?  I think Henri has been
> worried about doing that on the branch for some reason... 

On the contrary, I have been worried about having the old snapshot on the 1.9.2 branch at all. I would prefer to disable the pref on 1.9.2, product driver approvals permitting. See bug 538722.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Ah, ok.  Can we get that patch in?  Ask for reviews?

Comment 5

[Henri Sivonen (:hsivonen)]

Bug 538722 disabled the HTML5 parser on the 1.9.2 branch so that it can't be enabled by flipping a pref.