crash in nsHtml5TreeBuilder::popOnEof

RESOLVED INCOMPLETE

Status

()

--
critical
RESOLVED INCOMPLETE
6 years ago
4 years ago

People

(Reporter: mats, Unassigned)

Tracking

({crash})

Trunk
x86
Windows 7
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

(Reporter)

Description

6 years ago
This bug was filed from the Socorro interface and is 
report bp-d6874ffe-a9fe-46ae-9ae8-ecc9a2121123 .
============================================================= 

nsHtml5TreeBuilder::popOnEof is #151 in 17.0 Top Crash data,
it's #255 in 16.0.2; there are reports for all versions back to 4.0.
It appears to be Windows-only.

Most of the crashes appears to be EXCEPTION_ACCESS_VIOLATION_READ
at address 0xfffffffffffffffc here:
http://hg.mozilla.org/releases/mozilla-beta/annotate/0dbbf9b3175c/parser/html/nsHtml5TreeBuilder.cpp#l3556

nsHtml5TreeBuilder::popOnEof	parser/html/nsHtml5TreeBuilder.cpp:3556
nsHtml5TreeBuilder::eof	parser/html/nsHtml5TreeBuilder.cpp:536
nsHtml5Parser::ParseUntilBlocked	parser/html/nsHtml5Parser.cpp:609
nsHtml5TreeOpExecutor::RunFlushLoop	parser/html/nsHtml5TreeOpExecutor.cpp:536
nspr4.dll@0x8d0f	
timeGetTime	
nsHtml5ExecutorReflusher::Run	parser/html/nsHtml5TreeOpExecutor.cpp:66
nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:624 
[...]
How come there are two stack frames between nsHtml5ExecutorReflusher::Run and  	nsHtml5TreeOpExecutor::RunFlushLoop ? What are the stack frames between mozilla::ipc::MessagePump::Run and nsHtml5ExecutorReflusher::Run about?
> Most of the crashes appears to be EXCEPTION_ACCESS_VIOLATION_READ at address 0xfffffffffffffffc

still true, eg bp-9f801e4e-10fc-4408-b056-33b0b2131113
and incredibly rare ..  in past month 
- only 12 crashes for version 31
- no crashes for version 32
- on crash for version 4.0b3

Without a testcase or obvious cause I'd say this isn't worth keeping open.

Updated

4 years ago
Crash Signature: [@ nsHtml5TreeBuilder::popOnEof()] → [@ nsHtml5TreeBuilder::popOnEof() ]
(Reporter)

Comment 4

4 years ago
(In reply to Wayne Mery (:wsmwk) from comment #3)
> and incredibly rare ..  in past month 
> - only 12 crashes for version 31
> - no crashes for version 32
> - on crash for version 4.0b3
> 
> Without a testcase or obvious cause I'd say this isn't worth keeping open.

Seems reasonable.
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.