637269 - Crash in nsHtml5TreeBuilder::appendToCurrentNodeAndPushFormattingElementMayFoster @ mozalloc_abort(char const* const) | mozalloc.dll@0x10..

Status: RESOLVED WORKSFORME

(Core :: DOM: HTML Parser, defect)

Description

[Scoobidiver (away)]

It is a new crash signature in the trunk.
As there are many kinds of crash signatures behind this generic one, I am not
able to know its crasher rank.

Signature	mozalloc_abort(char const* const) | mozalloc.dll@0x106f
UUID	1ac7ba17-0fec-4ab7-9ecc-7386f2110227
Time 	2011-02-27 23:23:35.484927
Uptime	127
Last Crash	128 seconds before submission
Install Age	59502 seconds (16.5 hours) since version was first installed.
Product	Firefox
Version	4.0b12
Build ID	20110222210221
Branch	2.0
OS	Windows NT
OS Version	6.1.7600
CPU	x86
CPU Info	GenuineIntel family 6 model 15 stepping 13
Crash Reason	EXCEPTION_BREAKPOINT
Crash Address	0x73f81a39
App Notes 	AdapterVendorID: 10de, AdapterDeviceID: 0611, AdapterDriverVersion: 8.15.11.8171

Frame 	Module 	Signature [Expand] 	Source
0 	mozalloc.dll 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:77
1 	mozalloc.dll 	mozalloc.dll@0x106f 	
2 	xul.dll 	nsHtml5TreeBuilder::appendToCurrentNodeAndPushFormattingElementMayFoster 	parser/html/nsHtml5TreeBuilder.cpp:3529
3 	xul.dll 	nsHtml5TreeBuilder::startTag 	parser/html/nsHtml5TreeBuilder.cpp:1024
4 	xul.dll 	nsHtml5Tokenizer::addAttributeWithValue 	parser/html/nsHtml5Tokenizer.cpp:343
5 	mozcrt19.dll 	arena_malloc_small 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:3792
6 	mozcrt19.dll 	arena_malloc_small 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:3792
7 	xul.dll 	nsHtml5Parser::ParseHtml5Fragment 	parser/html/nsHtml5Parser.cpp:535
8 	xul.dll 	nsGenericHTMLElement::SetInnerHTML 	content/html/content/src/nsGenericHTMLElement.cpp:772
9 	xul.dll 	nsIDOMNSHTMLElement_SetInnerHTML 	obj-firefox/js/src/xpconnect/src/dom_quickstubs.cpp:20698
10 	mozjs.dll 	js::Shape::set 	js/src/jsscopeinlines.h:282
11 	mozjs.dll 	js_SetPropertyHelper 	js/src/jsobj.cpp:5658
12 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4461
13 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:653
14 	mozjs.dll 	js::Execute 	js/src/jsinterp.cpp:1014
15 	mozjs.dll 	EvaluateUCScriptForPrincipalsCommon 	js/src/jsapi.cpp:5059
16 	mozjs.dll 	JS_EvaluateUCScriptForPrincipalsVersion 	js/src/jsapi.cpp:5075
17 	xul.dll 	nsJSContext::EvaluateString 	dom/base/nsJSEnvironment.cpp:1457

More reports at:
https://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=mozalloc_abort%28char%20const*%20const%29%20|%20mozalloc.dll%400x106f

Comment 1

[Henri Sivonen (:hsivonen)]

(In reply to comment #0)
> 0     mozalloc.dll     mozalloc_abort     memory/mozalloc/mozalloc_abort.cpp:77
> 1     mozalloc.dll     mozalloc.dll@0x106f     
> 2     xul.dll    
> nsHtml5TreeBuilder::appendToCurrentNodeAndPushFormattingElementMayFoster    
> parser/html/nsHtml5TreeBuilder.cpp:3529
> 3     xul.dll     nsHtml5TreeBuilder::startTag    
> parser/html/nsHtml5TreeBuilder.cpp:1024
> 4     xul.dll     nsHtml5Tokenizer::addAttributeWithValue    
> parser/html/nsHtml5Tokenizer.cpp:343
> 5     mozcrt19.dll     arena_malloc_small    
> obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:3792
> 6     mozcrt19.dll     arena_malloc_small    
> obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:3792
> 7     xul.dll     nsHtml5Parser::ParseHtml5Fragment    
> parser/html/nsHtml5Parser.cpp:535

This stack looks bogus. jemalloc seems to call addAttributeWithValue. addAttributeWithValue seems to call startTag. Neither makes sense.

However, if the actual crash location at mozalloc_abort is correct, this is a plain OOM abort with the infallible malloc.

Comment 2

[Scoobidiver (away)]

In the crash reports I checked, I haven't seen the stack trace in comment 0.
I close it as WFM.