91538 - Crash loading pages - N610 [@ HTMLContentSink::ProcessMETATag]

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Dave Barrowman]

Build: 20010719, Windows 98

When I try to open the sidebar tab, the product crashes.  

Here is the talkback info:

Incident ID 33103623
Stack Signature HTMLContentSink::ProcessMETATag 151e3f79
Bug ID
Trigger Time 2001-07-19 14:16:59
User Comments phonebook tab
Build ID 2001071905
Product ID Netscape6.10
Platform ID Win32
Stack Trace
HTMLContentSink::ProcessMETATag
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 4525]
HTMLContentSink::AddLeaf
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 3390]
CNavDTD::AddLeaf [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 3796]
CNavDTD::AddHeadLeaf [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 3855]
CNavDTD::HandleStartToken
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 1750]
CNavDTD::HandleToken [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 924]
CNavDTD::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 549]
nsParser::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 2222]
nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 2086]
nsParser::OnDataAvailable
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 2696]
nsDocumentOpenInfo::OnDataAvailable
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 236]
nsStreamListenerTee::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp, line 57]
nsHttpChannel::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 2227]
nsOnDataAvailableEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerProxy.cpp, line 188]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
KERNEL32.DLL + 0x24407 (0xbff94407)
0x00688b5e

Comment 1

[Dave Barrowman]

Another talkback report:

Incident ID 33103416
Stack Signature HTMLContentSink::ProcessMETATag 151e3f79
Bug ID
Trigger Time 2001-07-19 14:12:10
User Comments Crash loading Phonebook Sidebar tab
Build ID 2001071905
Product ID   Netscape6.10
Platform ID Win32
Stack Trace
HTMLContentSink::ProcessMETATag
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 4525]
HTMLContentSink::AddLeaf
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp,
line 3390]
CNavDTD::AddLeaf [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 3796]
CNavDTD::AddHeadLeaf [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 3855]
CNavDTD::HandleStartToken
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 1750]
CNavDTD::HandleToken [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 924]
CNavDTD::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp,
line 549]
nsParser::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 2222]
nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 2086]
nsParser::OnDataAvailable
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 2696]
nsDocumentOpenInfo::OnDataAvailable
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 236]
nsStreamListenerTee::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp, line 57]
nsHttpChannel::OnDataAvailable
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 2227]
nsOnDataAvailableEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerProxy.cpp, line 188]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
KERNEL32.DLL + 0x24407 (0xbff94407)
0x00688b5e 

Comment 2

[matt]

Can you please post the url and also the place where i can add this tab.
thanks

Comment 3

[lchiang]

matt: 
http://rocknroll/users/michaell/publish/addpanel/addpanel.html

Perhaps this bug needs to be in bugscape as these are Netscape internal links;
however, the bug itself probably is in open source code and the test case we
have here is internal.

Comment 4

[lchiang]

sujay - can you go back a week or so to see if this particular sidebar tab was
working at that time?

Comment 5

[sol]

I crash consistently when I attempt to access this tab

Comment 6

[Blake Ross]

This isn't sidebar-specific; just go to
http://rocknroll/users/michaell/publish/addpanel/phonebook.html and you'll crash
too. --> parser

Comment 7

[sujay]

I tried adding the sidebar tab in a build from one week ago 7/12 build.
It worked fine.

Comment 8

[Blake Ross]

I just came across a crash loading popularcategories.com with this same stack
trace (it obviously worked in pr1 since a user reported a problem with the page
layout).

Harish, can you look into this today?

Comment 9

[harishd]

sure, will take a look right away.

Comment 10

[Blake Ross]

Gagan, could this be related to your fix for bug 90288?

Sujay, can you try a branch build from the 17th or 18th?

Comment 11

[harishd]

Blake: I bet it's related to gagan's change. I have a build without his change
and it doesn't crash.

Comment 12

[Blake Ross]

Yep -- we also have lots of crashes with this trace that started just today:

http://climate/reports/searchstacksignature.cfm?stacksig=HTMLContentSink%3A%3AProcessMETATag

Comment 13

[Gagan]

taking over... my bad...

Comment 14

[sujay]

installed 7/18 branch build on windows..

visited both URLs listed in this bug report:

http://www.popularcategories.com
http://rocknroll/users/michaell/publish/addpanel/phonebook.html

no crash at either URLs.

Comment 15

[Doug Turner (:dougt)]

based on the patch gagan emailed me, sr=

Comment 16

[bsharma]

Verified on 2001-07-17-branch build on WinNT for both above mentioned url's and
there is no crash.

Changing status to WFM.

Comment 17

[harishd]

r=harishd. But we need to figure out why mParser was null.

Comment 18

[Gagan]

nope its not a WFM... reopening applied the following patch that dougt and 
harishd reviewed--

-              if (NS_SUCCEEDED(mParser->GetChannel(getter_AddRefs(channel))) &&
-                      channel) {
+              if (mParser &&
+                  NS_SUCCEEDED(mParser->GetChannel(getter_AddRefs(channel))))
+      

Comment 19

[Gagan]

fix checked in to the branch.

Comment 20

[Gagan]

Even though the crash is now gone... I am concerned as to why the mParser came 
up null. That should never have happened (according to harishd) investigating 
this may bring out some interesting things...

Comment 21

[bsharma]

Verified on 2001-07-19-branch build on WinNT.

I created a new profile.
When loading both above url as 'open link in new window' the url's loads fine.

But, when I directly click on them then url http://www.popularcategories.com
loads fine but url
http://rocknroll/users/michaell/publish/addpanel/phonebook.html crashes.

Comment 22

[harishd]

I figured out the real reason why mParser was null. 

The document contains META tag with charset=utf-8. In the process of reloading
the  the document, with utf-8 charset, we terminate the current document load (
hence  released the parser ). However, unwinding off the stack we failed to
check if the current document was still valid or not and proceeded with
processing the META tag. Will file a bug on myself on this issue.

Comment 23

[Blake Ross]

*** Bug 91556 has been marked as a duplicate of this bug. ***

Comment 24

[Bradley Baetz (:bbaetz)]

*** Bug 91582 has been marked as a duplicate of this bug. ***

Comment 25

[harishd]

*** Bug 91597 has been marked as a duplicate of this bug. ***

Comment 26

[Jay Patel [:jay]]

Adding N610 and topcrash keyword for future reference.  This regression made the
crash the #1 topcrasher on today's N610 branch Talkback topcrash reports.

Comment 27

[lchiang]

gagan - was this fixed to the trunk too?  

bindu - pls go through the dup bugs and try those URLs on the branch build to
make sure loading ok.  Thanks.

Comment 28

[Gagan]

this wouldn't have occured on the trunk since my changes (from which this 
regressed) were only for the branch.

Comment 29

[bsharma]

Here is the result of these url's and the dup bugs url's:

Verified on 2001-07-19-branch build on WinNT.

Bug 91538: url http://www.popularcategories.com loads fine but url
http://rocknroll/users/michaell/publish/addpanel/phonebook.html crashes.

Bug 91556: url http://www.va-oakland.com/caproperty.html loads fine.

Bug 91582: url http://www.jp.aol.com/ crashes.

Bug 91597: url http://babel/tests/Browser/WinIntegration/WinInteg_test.html
loads fine.

Comment 30

[Jon Rubin]

These all loaded fine for me on 2001-07-20-branch build on Win98.

Comment 31

[selmer (gone)]

putting whiteboard back to PDT+ so I can tell this went on branch in my uber-query.

Comment 32

[John Morrison]

with the 2001097-21-nn-0.9.2 branch candidate builds, none of the URLs noted
above by bsharma crash the browser on mac, linux or win32. [If we were crashing
why didn't we reopen this bug?]

Comment 33

[sujay]

also verified the phonebook tab in sidebar. that doesn't crash anymore
in 7/23 branch build.

Comment 34

[Chris Petersen]

*** Bug 91565 has been marked as a duplicate of this bug. ***