892582 - crash in nsContentSink::WillParseImpl

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Scoobidiver (away)]

It started spiking in 25.0a1/20130711 ans is currently #1 crasher in this build. The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=04d8c309fe72&tochange=dde4dcd6fa46
It might be a regression from bug 888576 or bug 883313.

Signature 	nsContentSink::WillParseImpl() More Reports Search
UUID 	316e3440-d701-4a83-bc97-b7e992130711
Date Processed	2013-07-11 17:25:24.016543
Uptime	21
Last Crash	3416 seconds before submission
Install Age 	21 since version was first installed.
Install Time 	2013-07-11 17:26:07
Product 	Firefox
Version 	25.0a1
Build ID 	20130711030204
Release Channel 	nightly
OS 	Windows NT
OS Version 	5.2.3790 Service Pack 2
Build Architecture 	x86
Build Architecture Info 	GenuineIntel family 6 model 30 stepping 5 | 8
Crash Reason 	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address 	0x154
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x0645, AdapterSubsysID: 5ad3107d, AdapterDriverVersion: 6.14.13.1422
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers+ 
Adapter Vendor ID 	0x10de
Adapter Device ID 	0x0645
Total Virtual Memory 	4294836224
Available Virtual Memory 	3234459648
System Memory Use Percentage 	29
Available Page File 	5665628160
Available Physical Memory 	5991653376

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsContentSink::WillParseImpl() 	content/base/src/nsContentSink.cpp
1 	xul.dll 	nsHtml5TreeOpExecutor::RunFlushLoop() 	parser/html/nsHtml5TreeOpExecutor.cpp
2 	xul.dll 	FlushTimerCallback(nsITimer *,void *) 	parser/html/nsHtml5TreeOpExecutor.cpp
3 	xul.dll 	nsTimerImpl::Fire() 	xpcom/threads/nsTimerImpl.cpp
4 	xul.dll 	nsThread::ProcessNextEvent(bool,bool *) 	xpcom/threads/nsThread.cpp
5 	xul.dll 	NS_ProcessPendingEvents(nsIThread *,unsigned int) 	obj-firefox/xpcom/build/nsThreadUtils.cpp
6 	xul.dll 	nsWindow::DispatchPendingEvents() 	widget/windows/nsWindow.cpp
7 	xul.dll 	nsWindow::ProcessMessage(unsigned int,unsigned int &,long &,long *) 	widget/windows/nsWindow.cpp
8 	xul.dll 	nsWindow::WindowProcInternal(HWND__ *,unsigned int,unsigned int,long) 	widget/windows/nsWindow.cpp
9 	xul.dll 	CallWindowProcCrashProtected 	xpcom/base/nsCrashOnException.cpp
10 	xul.dll 	nsWindow::WindowProc(HWND__ *,unsigned int,unsigned int,long) 	widget/windows/nsWindow.cpp
11 	user32.dll 	InternalCallWinProc 	
12 	user32.dll 	UserCallWinProcCheckWow 	
13 	user32.dll 	DispatchMessageWorker 	
14 	user32.dll 	DispatchMessageW 	
15 	xul.dll 	nsAppShell::ProcessNextNativeEvent(bool) 	widget/windows/nsAppShell.cpp
16 	xul.dll 	nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal *,bool,unsigned int) 	widget/xpwidgets/nsBaseAppShell.cpp
17 	xul.dll 	nsThread::ProcessNextEvent(bool,bool *) 	xpcom/threads/nsThread.cpp
18 	xul.dll 	NS_ProcessNextEvent(nsIThread *,bool) 	obj-firefox/xpcom/build/nsThreadUtils.cpp
19 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) 	ipc/glue/MessagePump.cpp
20 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
21 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
22 	xul.dll 	nsBaseAppShell::Run() 	widget/xpwidgets/nsBaseAppShell.cpp
23 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp
24 	xul.dll 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp
25 	xul.dll 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
26 	xul.dll 	XREMain::XRE_main(int,char * * const,nsXREAppData const *) 	toolkit/xre/nsAppRunner.cpp
27 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp
28 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp
29 	firefox.exe 	NS_internal_main(int,char * *) 	browser/app/nsBrowserApp.cpp
30 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
31 	firefox.exe 	__tmainCRTStartup 	f:/dd/vctools/crt_bld/self_x86/crt/src/crtexe.c
32 	kernel32.dll 	BaseProcessStart 	

More reports at:
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=nsContentSink%3A%3AWillParseImpl%28%29

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

I wouldn't be very surprised if bug 789919 made this kind of crash happen more often.
But if the bug has been there before, it isn't really bug 789919's fault.

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Hmm, so this is a null-pointer crash. (null+offset)

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

...so sounds very much like
https://bugzilla.mozilla.org/show_bug.cgi?id=676790#c6

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Attachment: add a null pointer check, for now

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 774427 [details] [diff] [review]
add a null pointer check, for now

r=me

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

https://hg.mozilla.org/mozilla-central/rev/b44898282f21

Need to fix the bug in a bit better way in html parser.
Bug 676790 can be used for that. Fix should be still rather simple.

Comment 7

[Tracy Walker [:tracy]]

(In reply to Olli Pettay [:smaug] from comment #6)
> https://hg.mozilla.org/mozilla-central/rev/b44898282f21
> 
> Need to fix the bug in a bit better way in html parser.
> Bug 676790 can be used for that. Fix should be still rather simple.

Alex, in this case, would you want to also track bug 676790?

Comment 8

[Tracy Walker [:tracy]]

The volume here is low, so per stability meeting, no need to track.

Comment 9

[u279076]

I see no instances of this signature in Socorro for Firefox 25 in the last 7 days. Marking verified fixed.