675536 - crash [@ nsContentUtils::IsEventAttributeName] when viewing RSS feed

Status: RESOLVED DUPLICATE of bug 675437

(Core :: General, defect)

Description

[Daniel Holbert [:dholbert]]

This bug was filed from the Socorro interface and is 
report bp-fb02cbca-e4f0-48e0-a8de-0fb772110731 .
============================================================= 

STEPS TO REPRODUCE:
 1. Load http://planet.mozilla.org/rss20.xml  (or any other RSS feed, I think)

ACTUAL RESULTS:
 Immediate crash [@ nsContentUtils::IsEventAttributeName]
 bp-fb02cbca-e4f0-48e0-a8de-0fb772110731

The first bad nightly is
Mozilla/5.0 (X11; Linux i686; rv:8.0a1) Gecko/20110730 Firefox/8.0a1

Regression pushlog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=cef1817c3b13&tochange=e9be8677a7ae

Comment 1

[Daniel Holbert [:dholbert]]

(In reply to comment #0)
> This bug was filed from the Socorro interface and is 
> report bp-fb02cbca-e4f0-48e0-a8de-0fb772110731 .
> ============================================================= 
> 
> STEPS TO REPRODUCE:
>  1. Load http://planet.mozilla.org/rss20.xml  (or any other RSS feed, I
> think)

Doesn't affect all RSS feeds, actually -- e.g. this loads fine (no crash):
  http://feeds.bbci.co.uk/news/rss.xml

Comment 2

[Daniel Holbert [:dholbert]]

nsTreeSanitizer::Sanitize is in the crash stack.  That is entirely new code that was added during the regression pushlog (cset below) -- assuming this is a regression from that change.

> 8fb752f5e1fa	Henri Sivonen — Bug 482909 part 2 - Implement an HTML/SVG/MathML sanitizer independently of parsers or serializers. r=bzbarsky.
http://hg.mozilla.org/mozilla-central/rev/8fb752f5e1fa

Comment 3

[Daniel Holbert [:dholbert]]

Ah, and it looks like this is already filed as bug 675437.  /me updates crash signatures on that bug so that it'll get linked from my crash reports.