636318 - Firefox 4.0b12 crash in nsHTTPCompressConv::do_OnDataAvailable

Status: RESOLVED DUPLICATE of bug 573078

(Core :: DOM: HTML Parser, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-dca86805-9c0d-40ed-bb87-899a52110223 .
============================================================= 

Culled from Bughunter. This crash is present in the last several betas - http://tinyurl.com/4tsms2j to the crash reports in the last week. I can crash fairly easily with the site in the URL using B12 on Mac (Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b12) Gecko/20100101 Firefox/4.0b12 and Win XP using Mozilla/5.0 (Windows NT 5.1; rv:2.0b12pre) Gecko/20110223 Firefox/4.0b12pre. On the latest Mac trunk I don't crash but I have to force quit.

Frame 	Module 	Signature [Expand] 	Source
0 	libmozalloc.dylib 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:64
1 	libmozalloc.dylib 	mozalloc_handle_oom 	memory/mozalloc/mozalloc_oom.cpp:54
2 	libmozalloc.dylib 	moz_xmalloc 	memory/mozalloc/mozalloc.cpp:100
3 	XUL 	nsHtml5StreamParser::OnDataAvailable 	
4 	XUL 	nsHTTPCompressConv::do_OnDataAvailable 	netwerk/streamconv/converters/nsHTTPCompressConv.cpp:375
5 	XUL 	nsHTTPCompressConv::OnDataAvailable 	netwerk/streamconv/converters/nsHTTPCompressConv.cpp:319
6 	XUL 	nsStreamListenerTee::OnDataAvailable 	netwerk/base/src/nsStreamListenerTee.cpp:111
7 	XUL 	nsHttpChannel::OnDataAvailable 	netwerk/protocol/http/nsHttpChannel.cpp:4111
8 	XUL 	nsInputStreamPump::OnStateTransfer 	netwerk/base/src/nsInputStreamPump.cpp:510
9 	XUL 	nsInputStreamPump::OnInputStreamReady 	netwerk/base/src/nsInputStreamPump.cpp:400
10 	XUL 	nsInputStreamReadyEvent::Run 	xpcom/io/nsStreamUtils.cpp:112
11 	XUL 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:633
12 	XUL 	NS_ProcessPendingEvents_P 	nsThreadUtils.cpp:200
13 	XUL 	nsBaseAppShell::NativeEventCallback 	widget/src/xpwidgets/nsBaseAppShell.cpp:132
14 	XUL 	nsAppShell::ProcessGeckoEvents 	widget/src/cocoa/nsAppShell.mm:399
15 	CoreFoundation 	__CFRunLoopDoSources0 	
16 	CoreFoundation 	__CFRunLoopRun 	
17 	CoreFoundation 	CFRunLoopRunSpecific 	
18 	CoreFoundation 	CFRunLoopRunInMode 	
19 	HIToolbox 	HIToolbox@0x34e03 	
20 	HIToolbox 	HIToolbox@0x34af4 	
21 	HIToolbox 	HIToolbox@0x34a3d 	
22 	AppKit 	_DPSNextEvent 	
23 	AppKit 	-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 	
24 	AppKit 	-[NSApplication run] 	
25 	XUL 	nsAppShell::Run 	widget/src/cocoa/nsAppShell.mm:746
26 	XUL 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:220
27 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3766
28 	firefox-bin 	main 	browser/app/nsBrowserApp.cpp:158
29 	firefox-bin 	firefox-bin@0xa05 	
30 		@0x1

Comment 1

[Nico Kümmel [:kitzu]]

extracted from the source:
<!-- quick hack to guess at proper favicons. this doesn't work if they are using their own<link>to specify the favicon instead of just having /favicon.ico exist. --><link rel="icon" href="http://phreakocious.net/favicon.ico" type="image/x-icon">

Comment 2

[Logan Rosen [:Logan]]

https://crash-stats.mozilla.com/report/index/c823bbea-af87-4783-832b-0521b2110503

Comment 3

[Marcia Knous [:marcia]]

https://crash-stats.mozilla.com/report/list?signature=mozalloc_abort%20|%20mozalloc_handle_oom%20|%20moz_xmalloc is currently happening primarily on Mac with a handful of Linux crashes. Currently this signature ranks as #8 top Mac browser crash.

Comment 4

[Marcia Knous [:marcia]]

mozalloc_abort(char const* const) | mozalloc.dll@0x106f still occurs across all versions up to 7.0.1 - 471 crashes in the last week. The other signature listed in this bug is not seen in crash stats recently. There are also 3 other bugs that have this signature.

If I run the test case in a VM on Windows XP using Firefox 7.0.1, I still get the crash -> https://crash-stats.mozilla.com/report/index/bp-3a8ccb96-8a06-4c4f-b298-3b1172111010.

Comment 5

[Patrick McManus [:mcmanus]]

dup of bug 573078 which is closed and targetted for FF 10.