981413 - crash in nsHtml5TreeOperation::CreateElement(int, nsIAtom*, nsHtml5HtmlAttributes*, mozilla::dom::FromParser, nsHtml5DocumentBuilder*)

Status: RESOLVED DUPLICATE of bug 981279

(Core :: DOM: HTML Parser, defect)

Description

[Ludovic Hirlimann [:Usul]]

This bug was filed from the Socorro interface and is 
report bp-2524c02f-6a7e-456f-8f2a-0b71f2140309.
=============================================================
0 	XUL 	nsHtml5TreeOperation::CreateElement(int, nsIAtom*, nsHtml5HtmlAttributes*, mozilla::dom::FromParser, nsHtml5DocumentBuilder*) 	parser/html/nsHtml5TreeOperation.h
1 	XUL 	nsHtml5TreeBuilder::createElement(int, nsIAtom*, nsHtml5HtmlAttributes*) 	parser/html/nsHtml5TreeBuilderCppSupplement.h
2 	XUL 	nsHtml5TreeBuilder::appendVoidElementToCurrentMayFoster(nsHtml5ElementName*, nsHtml5HtmlAttributes*) 	parser/html/nsHtml5TreeBuilder.cpp
3 	XUL 	nsHtml5TreeBuilder::startTag(nsHtml5ElementName*, nsHtml5HtmlAttributes*, bool) 	parser/html/nsHtml5TreeBuilder.cpp
4 	XUL 	nsHtml5Tokenizer::emitCurrentTagToken(bool, int) 	parser/html/nsHtml5Tokenizer.cpp
5 	XUL 	int nsHtml5Tokenizer::stateLoop<nsHtml5SilentPolicy>(int, char16_t, int, char16_t*, bool, int, int) 	parser/html/nsHtml5Tokenizer.cpp
6 	XUL 	nsHtml5Tokenizer::tokenizeBuffer(nsHtml5UTF16Buffer*) 	parser/html/nsHtml5Tokenizer.cpp
7 	XUL 	nsHtml5StringParser::Tokenize(nsAString_internal const&, nsIDocument*, bool) 	parser/html/nsHtml5StringParser.cpp
8 	XUL 	nsContentUtils::ConvertToPlainText(nsAString_internal const&, nsAString_internal&, unsigned int, unsigned int) 	content/base/src/nsContentUtils.cpp
9 	XUL 	Tokenizer::tokenize(char const*) 	mailnews/extensions/bayesian-spam-filter/src/nsBayesianFilter.cpp
10 	XUL 	TokenStreamListener::OnDataAvailable(nsIRequest*, nsISupports*, nsIInputStream*, unsigned long long, unsigned int) 	mailnews/extensions/bayesian-spam-filter/src/nsBayesianFilter.cpp
11 	XUL 	nsMimeBaseEmitter::Write(nsACString_internal const&, unsigned int*) 	mailnews/mime/emitters/nsMimeBaseEmitter.cpp
12 	XUL 	nsMimeHtmlDisplayEmitter::WriteBody(nsACString_internal const&, unsigned int*) 	mailnews/mime/emitters/nsMimeHtmlEmitter.cpp
13 	XUL 	mime_output_fn 	mailnews/mime/src/mimemoz2.cpp
14 	XUL 	mime_multipart_related_output_fn 	mailnews/mime/src/mimemrel.cpp
15 	XUL 	MimeOptions_write(MimeDisplayOptions*, nsCString&, char const*, int, bool) 	mailnews/mime/src/mimei.cpp
16 	XUL 	MimeObject_write(MimeObject*, char const*, int, bool) 	mailnews/mime/src/mimei.cpp
17 	XUL 	MimeInlineText_convert_and_parse_line 	mailnews/mime/src/mimetext.cpp
18 	XUL 	mime_LineBuffer 	mailnews/mime/src/mimebuf.cpp
19 	XUL 	MimeInlineText_parse_decoded_buffer 	mailnews/mime/src/mimetext.cpp
20 	XUL 	MimeDecoderWrite(MimeDecoderData*, char const*, int, int*) 	mailnews/mime/src/mimeenc.cpp
21 	XUL 	MimeLeaf_parse_buffer 	mailnews/mime/src/mimeleaf.cpp
22 	XUL 	MimeMultipart_parse_child_line 	mailnews/mime/src/mimemult.cpp
23 	XUL 	MimeMultipart_parse_line 	mailnews/mime/src/mimemult.cpp
24 	XUL 	mime_LineBuffer 	mailnews/mime/src/mimebuf.cpp
25 	XUL 	MimeObject_parse_buffer 	mailnews/mime/src/mimeobj.cpp
26 	XUL 	MimeMultipartRelated_parse_eof 	mailnews/mime/src/mimemrel.cpp
27 	XUL 	MimeContainer_parse_eof 	mailnews/mime/src/mimecont.cpp
28 	XUL 	MimeMessage_parse_eof 	mailnews/mime/src/mimemsg.cpp
29 	XUL 	mime_display_stream_complete 	mailnews/mime/src/mimemoz2.cpp
30 	XUL 	nsStreamConverter::OnStopRequest(nsIRequest*, nsISupports*, tag_nsresult) 	mailnews/mime/src/nsStreamConverter.cpp
31 	XUL 	nsImapCacheStreamListener::OnStopRequest(nsIRequest*, nsISupports*, tag_nsresult) 	mailnews/imap/src/nsImapProtocol.cpp
32 	XUL 	nsInputStreamPump::OnStateStop() 	netwerk/base/src/nsInputStreamPump.cpp
33 	XUL 	nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) 	netwerk/base/src/nsInputStreamPump.cpp
34 	XUL 	nsInputStreamReadyEvent::Run() 	xpcom/io/nsStreamUtils.cpp
35 	XUL 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
36 	XUL 	NS_ProcessPendingEvents(nsIThread*, unsigned int) 	xpcom/glue/nsThreadUtils.cpp
37 	XUL 	nsBaseAppShell::NativeEventCallback() 	widget/xpwidgets/nsBaseAppShell.cpp
38 	XUL 	nsAppShell::ProcessGeckoEvents(void*) 	widget/cocoa/nsAppShell.mm
39 	CoreFoundation 	CoreFoundation@0x7f731 	
40 	CoreFoundation 	CoreFoundation@0x70ea2 	
41 	CoreFoundation 	CoreFoundation@0x7062f 	
42 	libmozglue.dylib 	je_realloc 	memory/mozjemalloc/jemalloc.c
43 	CoreFoundation 	CoreFoundation@0x700b5 	
44 	HIToolbox 	HIToolbox@0x2ea0d 	
45 	HIToolbox 	HIToolbox@0x2e685 	
46 	HIToolbox 	HIToolbox@0x2e5bc 	
47 	AppKit 	AppKit@0x243de 	
48 	AppKit 	AppKit@0xa506d8 	
49 	AppKit 	AppKit@0xa50795 	
50 	AppKit 	AppKit@0xa50779 	
51 	AppKit 	AppKit@0xa5075e 	
52 	XUL 	PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) 	layout/base/nsPresShell.cpp
53 	AppKit 	AppKit@0x23a2b 	
54 	CoreFoundation 	CoreFoundation@0x63abb 	
55 	CoreFoundation 	CoreFoundation@0x78fd2 	
56 	libobjc.A.dylib 	libobjc.A.dylib@0x5080 	
57 	AppKit 	AppKit@0x23947 	
58 	AppKit 	AppKit@0x3bb703 	
59 	AppKit 	AppKit@0x3bb6d0 	
60 	AppKit 	AppKit@0x3bb6f0 	
61 	libobjc.A.dylib 	libobjc.A.dylib@0x5080 	
62 	AppKit 	AppKit@0x1c8f38 	
63 	AppKit 	AppKit@0xa575f8 	
64 	AppKit 	AppKit@0x1c8f00

Comment 1

[Ludovic Hirlimann [:Usul]]

is this a dup of 981279 ?

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

I think so.