675506 - crash nsGenericHTMLElement::AfterSetAttr

Status: RESOLVED DUPLICATE of bug 675437

(Firefox :: General, defect)

Description

[Brian Carpenter [:geeknik]]

This bug was filed from the Socorro interface and is 
report bp-e89343d8-3612-48b9-a43d-cf8102110731 .
============================================================= 

Every visit to http://pipes.yahoo.com/pipes/pipe.run?_id=6cc33ec11340418ec7c3cb5025327fff&_render=rss results in an instant crash, even in safe mode. Clicking on the link in my bookmarks or pasting it into the address bar makes no difference either.

Comment 1

[Brian Carpenter [:geeknik]]

Attachment: windbg log

Comment 2

[Thomas Ahlblom]

Reproduced:
Mozilla/5.0 (X11; Linux x86_64; rv:8.0a1) Gecko/20110731 Firefox/8.0a1
bp-b4a3c5a8-24ac-4401-8b43-612ec2110731
[@ nsContentUtils::IsEventAttributeName ] 

WFM:
Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.2.19) Gecko/20110707 Firefox/3.6.19
Mozilla/5.0 (X11; Linux x86_64; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Mozilla/5.0 (X11; Linux x86_64; rv:6.0) Gecko/20100101 Firefox/6.0
Mozilla/5.0 (X11; Linux x86_64; rv:7.0a2) Gecko/20110731 Firefox/7.0a2

Comment 3

[Thomas Ahlblom]

Last good nightly: 2011-07-29
First bad nightly: 2011-07-30

Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=cef1817c3b13&tochange=e9be8677a7ae

Comment 4

[(mostly gone) XtC4UaLL [:xtc4uall]]

Probably a Dupe of Bug 675437, esp. if the Regrange of Bug 675437 Comment 2 fits.
MI-Hourlys are here: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-win32/?C=M;O=D

Comment 5

[Thomas Ahlblom]

Local track down using Linux:

The first bad revision is:
changeset:   73538:8fb752f5e1fa
user:        Henri Sivonen <[e-mail]>
date:        Fri Jul 29 14:48:04 2011 +0300
summary:     Bug 482909 part 2 - Implement an HTML/SVG/MathML sanitizer independently of parsers or serializers. r=bzbarsky.

And that is within the regression range of bug 675437 comment 2.

Comment 6

[Robert Kaiser]

Henri, this looks like another one of the RSS bug 675437, right?

Comment 7

[Henri Sivonen (:hsivonen)]

Looks like a duplicate of bug 675437, yeah. Let's see if this crash goes away when the fix for bug 675437 makes it to m-c and to Nightly.

Comment 8

[Brian Carpenter [:geeknik]]

8/3/11 build of Nightly does not crash anymore, so I will mark this as a duplicate of bug 675437.