Closed Bug 585943 Opened 11 years ago Closed 11 years ago

Crash [@ nsHtml5TreeOperation::Init][@ TouchBadMemory][@ nsHtml5TreeBuilder::appendElement(nsIContent**, nsIContent**) ] on OOM

Categories

(Core :: DOM: HTML Parser, defect, P2)

x86
All
defect

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- final+

People

(Reporter: bc, Assigned: hsivonen)

References

()

Details

(Keywords: crash, Whiteboard: [hardblocker])

Crash Data

Attachments

(2 files)

1. http://redtaggy.com/
2. crash trunk mac/windows

related socorro signature:
nsHtml5TreeBuilder::appendElement(nsIContent**, nsIContent**) 

various assertions depending on the phase of the moon.

ASSERTION: Tree op allocation failed.: 'treeOp' /work/mozilla/builds/2.0.0/mozilla/parser/html/nsHtml5TreeBuilderCppSupplement.h

ASSERTION: bad method name: 'Error' /work/mozilla/builds/2.0.0/mozilla/js/src/xpconnect/src/xpcwrappednativeinfo.cpp
Severity: normal → critical
blocking2.0: --- → ?
We should fix this for final, and by fix I mean make sure we crash in a safe way if we're OOM.
blocking2.0: ? → final+
All the nsTArrays in the HTML5 parser need to become infallible, but bug 550611 isn't ready yet.
Depends on: 550611
Priority: -- → P2
Whiteboard: Waiting for bug 550611
Assignee: nobody → hsivonen
Whiteboard: Waiting for bug 550611
Depends on: 610823
Whiteboard: [waiting for bug 610823]
bug 550611 is fixed now. Henri, can you work on a patch to make all nsTArray's in the parser explicitly use the infallible version?
(In reply to comment #4)
> bug 550611 is fixed now. Henri, can you work on a patch to make all nsTArray's
> in the parser explicitly use the infallible version?

OK.
Status: NEW → ASSIGNED
Whiteboard: [waiting for bug 610823]
Whiteboard: hardblocker
Whiteboard: hardblocker → [hardblocker]
Can this be considered fixed now that bug 610823 is fixed? That is, is it necessary to use the explicitly infallible versions now?
IMO yes.
Marking fixed per previous comments.
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Crash Signature: [@ nsHtml5TreeOperation::Init] [@ TouchBadMemory] [@ nsHtml5TreeBuilder::appendElement(nsIContent**, nsIContent**) ]
You need to log in before you can comment on or make changes to this bug.