814917 - crash in nsHtml5TreeBuilder::popOnEof

Status: RESOLVED INCOMPLETE

(Core :: DOM: HTML Parser, defect)

Description

[Mats Palmgren (inactive)]

This bug was filed from the Socorro interface and is 
report bp-d6874ffe-a9fe-46ae-9ae8-ecc9a2121123 .
============================================================= 

nsHtml5TreeBuilder::popOnEof is #151 in 17.0 Top Crash data,
it's #255 in 16.0.2; there are reports for all versions back to 4.0.
It appears to be Windows-only.

Most of the crashes appears to be EXCEPTION_ACCESS_VIOLATION_READ
at address 0xfffffffffffffffc here:
http://hg.mozilla.org/releases/mozilla-beta/annotate/0dbbf9b3175c/parser/html/nsHtml5TreeBuilder.cpp#l3556

nsHtml5TreeBuilder::popOnEof	parser/html/nsHtml5TreeBuilder.cpp:3556
nsHtml5TreeBuilder::eof	parser/html/nsHtml5TreeBuilder.cpp:536
nsHtml5Parser::ParseUntilBlocked	parser/html/nsHtml5Parser.cpp:609
nsHtml5TreeOpExecutor::RunFlushLoop	parser/html/nsHtml5TreeOpExecutor.cpp:536
nspr4.dll@0x8d0f	
timeGetTime	
nsHtml5ExecutorReflusher::Run	parser/html/nsHtml5TreeOpExecutor.cpp:66
nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:624 
[...]

Comment 1

[Henri Sivonen (:hsivonen)]

How come there are two stack frames between nsHtml5ExecutorReflusher::Run and  	nsHtml5TreeOpExecutor::RunFlushLoop ? What are the stack frames between mozilla::ipc::MessagePump::Run and nsHtml5ExecutorReflusher::Run about?

Comment 2

[Wayne Mery (:wsmwk)]

> Most of the crashes appears to be EXCEPTION_ACCESS_VIOLATION_READ at address 0xfffffffffffffffc

still true, eg bp-9f801e4e-10fc-4408-b056-33b0b2131113

Comment 3

[Wayne Mery (:wsmwk)]

and incredibly rare ..  in past month 
- only 12 crashes for version 31
- no crashes for version 32
- on crash for version 4.0b3

Without a testcase or obvious cause I'd say this isn't worth keeping open.

Comment 4

[Mats Palmgren (inactive)]

(In reply to Wayne Mery (:wsmwk) from comment #3)
> and incredibly rare ..  in past month 
> - only 12 crashes for version 31
> - no crashes for version 32
> - on crash for version 4.0b3
> 
> Without a testcase or obvious cause I'd say this isn't worth keeping open.

Seems reasonable.