95698 - mfcEmbed/testEmbed crash (assert) on startup in htmlparser

Status: VERIFIED WORKSFORME

(Core Graveyard :: Embedding: APIs, defect)

Description

[David Epstein]

using 0.9.3+ 20010816 full build

mozilla.exe works fine, but mfcEmbed doesn't start up from the /bin directory.
Here are the 2 asserts I've seen on different occassions (pressing Ignore
doesn't allow app to continue; instead we get a "memory could not be read" error):

"NS_ENSURE_TRUE(NS_SUCCEEDED(result)) failed: '(!((result) & 0x800...))', file
/mozilla/htmlparser/src/nsHTMLTokens.cpp line 1986"

or

"NS_ENSURE_TRUE(NS_SUCCEEDED(result)) failed: '(!((result) & 0x800...))', file
/mozilla/htmlparser/src/nsScanner.cpp line 1254"


Here's the call stack for the nsHTMLTokens.cpp assert:

nsDebug::Assertion(const char * 0x0194218c, const char * 0x01942170, const char
* 0x01942138, int 1986) line 290 + 13 bytes
nsDebug::WarnIfFalse(const char * 0x0194218c, const char * 0x01942170, const
char * 0x01942138, int 1986) line 396 + 21 bytes
CEntityToken::ConsumeEntity(unsigned short 38, nsString & {...}, nsScanner &
{...}) line 1986 + 38 bytes
CEntityToken::Consume(unsigned short 114, nsScanner & {...}, int 4130) line 1886
+ 21 bytes
nsHTMLTokenizer::ConsumeEntity(unsigned short 38, CToken * & 0x028afca0,
nsScanner & {...}) line 852 + 31 bytes
nsHTMLTokenizer::ConsumeToken(nsScanner & {...}, int & 0) line 492 + 24 bytes
nsParser::Tokenize(int 0) line 2799 + 28 bytes
nsParser::ResumeParse(int 1, int 0) line 2084 + 12 bytes
nsParser::OnDataAvailable(nsParser * const 0x01f23c78, nsIRequest * 0x01ec1130,
nsISupports * 0x00000000, nsIInputStream * 0x01f52330, unsigned int 0, unsigned
int 16384) line 2690 + 19 bytes
nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const 0x01ed0540,
nsIRequest * 0x01ec1130, nsISupports * 0x00000000, nsIInputStream * 0x01f52330,
unsigned int 0, unsigned int 16384) line 241 + 46 bytes
nsStreamListenerTee::OnDataAvailable(nsStreamListenerTee * const 0x01f52380,
nsIRequest * 0x01ec1130, nsISupports * 0x00000000, nsIInputStream * 0x01ed2a30,
unsigned int 0, unsigned int 16384) line 56 + 51 bytes
nsHttpChannel::OnDataAvailable(nsHttpChannel * const 0x01ec1134, nsIRequest *
0x01ed23b0, nsISupports * 0x00000000, nsIInputStream * 0x01ed2a30, unsigned int
0, unsigned int 16384) line 2186 + 57 bytes
nsOnDataAvailableEvent::HandleEvent() line 178 + 70 bytes
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x01f30954) line 65
PL_HandleEvent(PLEvent * 0x01f30954) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x010ebae0) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x005e01cc, unsigned int 49455, unsigned int 0,
long 17742560) line 1071 + 9 bytes
USER32! 77e71820()
010e


Here's the call stack for the nsScanner.cpp assert:

nsDebug::Assertion(const char * 0x01943cb4, const char * 0x01943c98, const char
* 0x01943c64, int 1254) line 290 + 13 bytes
nsDebug::WarnIfFalse(const char * 0x01943cb4, const char * 0x01943c98, const
char * 0x01943c64, int 1254) line 396 + 21 bytes
nsScanner::ReadUntil(nsReadingIterator<unsigned short> & {...},
nsReadingIterator<unsigned short> & {...}, const nsReadEndCondition & {...}, int
0) line 1254 + 39 bytes
CTextToken::Consume(unsigned short 0, nsScanner & {...}, int 4130) line 552 + 23
bytes
nsHTMLTokenizer::ConsumeText(CToken * & 0x00000000, nsScanner & {...}) line 936
+ 27 bytes
nsHTMLTokenizer::ConsumeToken(nsScanner & {...}, int & 0) line 502 + 19 bytes
nsParser::Tokenize(int 0) line 2799 + 28 bytes
nsParser::ResumeParse(int 0, int 0) line 2084 + 12 bytes
nsParser::Parse(const nsAString & {...}, void * 0x00000001, const nsString &
{...}, int 0, int 1, nsDTDMode eDTDMode_autodetect) line 1944 + 15 bytes
nsHTMLDocument::WriteCommon(const nsAString & {...}, int 0) line 2337 + 201 bytes
nsHTMLDocument::ScriptWriteCommon(int 0) line 2434 + 19 bytes
nsHTMLDocument::Write(nsHTMLDocument * const 0x01f21404) line 2461
XPTC_InvokeByIndex(nsISupports * 0x01f21404, unsigned int 19, unsigned int 0,
nsXPTCVariant * 0x0012e270) line 139
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode
CALL_METHOD) line 1884 + 42 bytes
XPC_WN_CallMethod(JSContext * 0x01e99630, JSObject * 0x00fec508, unsigned int 1,
long * 0x028f612c, long * 0x0012e4a8) line 1252 + 14 bytes
js_Invoke(JSContext * 0x01e99630, unsigned int 1, unsigned int 0) line 807 + 23
bytes
js_Interpret(JSContext * 0x01e99630, long * 0x0012f2bc) line 2699 + 15 bytes
js_Execute(JSContext * 0x01e99630, JSObject * 0x00feb970, JSScript * 0x03093230,
JSStackFrame * 0x00000000, unsigned int 0, long * 0x0012f2bc) line 986 + 13 bytes
JS_EvaluateUCScriptForPrincipals(JSContext * 0x01e99630, JSObject * 0x00feb970,
JSPrincipals * 0x01f2aaa0, const unsigned short * 0x0012f41c, unsigned int 20,
const char * 0x03093430, unsigned int 522, long * 0x0012f2bc) line 3302 + 25 bytes
nsJSContext::EvaluateString(nsJSContext * const 0x01e98670, const nsAString &
{...}, void * 0x00feb970, nsIPrincipal * 0x01f2aa9c, const char * 0x03093430,
unsigned int 522, const char * 0x012b869c, nsAString & {...}, int * 0x0012f328)
line 618 + 85 bytes
nsScriptLoader::EvaluateScript(nsScriptLoadRequest * 0x03093590, const
nsAFlatString & {...}) line 571
nsScriptLoader::ProcessRequest(nsScriptLoadRequest * 0x03093590) line 483 + 22 bytes
nsScriptLoader::ProcessScriptElement(nsScriptLoader * const 0x01f2ab10,
nsIDOMHTMLScriptElement * 0x03093828, nsIScriptLoaderObserver * 0x0309382c) line
426 + 15 bytes
nsHTMLScriptElement::SetDocument(nsHTMLScriptElement * const 0x03093800,
nsIDocument * 0x01f212c0, int 0, int 1) line 140
nsGenericHTMLContainerElement::AppendChildTo(nsGenericHTMLContainerElement *
const 0x03093a30, nsIContent * 0x03093800, int 0, int 0) line 3781
HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode & {...}) line 5010
HTMLContentSink::AddLeaf(HTMLContentSink * const 0x01f2fe90, const nsIParserNode
& {...}) line 3433 + 12 bytes
CNavDTD::AddLeaf(const nsIParserNode * 0x02847688) line 3754 + 22 bytes
CNavDTD::HandleScriptToken(const nsIParserNode * 0x02847688) line 2214 + 12 bytes
CNavDTD::OpenContainer(const nsCParserNode * 0x02847688, nsHTMLTag
eHTMLTag_script, int 1, nsEntryStack * 0x00000000) line 3405 + 12 bytes
CNavDTD::HandleDefaultStartToken(CToken * 0x028e05d0, nsHTMLTag eHTMLTag_script,
nsCParserNode * 0x02847688) line 1291 + 20 bytes
CNavDTD::HandleStartToken(CToken * 0x028e05d0) line 1701 + 22 bytes
CNavDTD::HandleToken(CNavDTD * const 0x01f52070, CToken * 0x00000000, nsIParser
* 0x01f23ce0) line 870 + 12 bytes
CNavDTD::BuildModel(CNavDTD * const 0x01f52070, nsIParser * 0x01f23ce0,
nsITokenizer * 0x01f53c40, nsITokenObserver * 0x00000000, nsIContentSink *
0x01f2fe90) line 506 + 20 bytes
nsParser::BuildModel() line 2219 + 34 bytes
nsParser::ResumeParse(int 1, int 0) line 2085 + 11 bytes
nsParser::OnDataAvailable(nsParser * const 0x01f23ce8, nsIRequest * 0x01ec10f0,
nsISupports * 0x00000000, nsIInputStream * 0x01f52490, unsigned int 16384,
unsigned int 16384) line 2690 + 19 bytes
nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const 0x01ed0500,
nsIRequest * 0x01ec10f0, nsISupports * 0x00000000, nsIInputStream * 0x01f52490,
unsigned int 16384, unsigned int 16384) line 241 + 46 bytes
nsStreamListenerTee::OnDataAvailable(nsStreamListenerTee * const 0x01f524e0,
nsIRequest * 0x01ec10f0, nsISupports * 0x00000000, nsIInputStream * 0x01ed29f0,
unsigned int 16384, unsigned int 16384) line 56 + 51 bytes
nsHttpChannel::OnDataAvailable(nsHttpChannel * const 0x01ec10f4, nsIRequest *
0x01ed2370, nsISupports * 0x00000000, nsIInputStream * 0x01ed29f0, unsigned int
16384, unsigned int 16384) line 2186 + 57 bytes
nsOnDataAvailableEvent::HandleEvent() line 178 + 70 bytes
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x01f6b154) line 65
PL_HandleEvent(PLEvent * 0x01f6b154) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x010ebae0) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x0127028a, unsigned int 49455, unsigned int 0,
long 17742560) line 1071 + 9 bytes
USER32! 77e71820()
010ebae0()

Comment 1

[Chase Tingley]

Two comments stand out from bug 95614:

dbaron:
> Tor and I both saw parser crashes related to an uninitialized iterator in
> CTextToken::Consume within a few minutes of starting to use today's build.

harishd:

> The old patch (attachment id=45504) uses the NS_ENSURE_SUCCESS macro which 
> will assert. A failure result code from nsScanner::Peek() does not indicate 
> an exceptional condition, just that we've reached the end of the current 
> buffer. Hence, an assertion is incorrect and the macro shouldn't be used.

I remember seeing an assertion which I believe was similar to this just before
my linux trunk build went kaput due to the blocker earlier today.  I *think*
that the fix for that bug should take care of this as well.

Comment 2

[David Epstein]

This didn't happen on the 0.9.3+ Nightly trunk build 20010817.

Comment 3

[Chak Nanga]

Marking this WORKSFORME - per David's comments above that it works ok in 0.9.3+
Nightly trunk build 20010817.

Comment 4

[David Epstein]

Looks like fix to bug 95614 fixed this as well. mfcEmbed launches fine in both
the debug and optimized builds. Tested against debug build 20010820 and nightly
trunk build 20010822.