Closed Bug 1222 Opened 26 years ago Closed 26 years ago

Parser Crash: Purify reported FMR and IPR

Categories

(Core :: DOM: HTML Parser, defect, P1)

x86
Windows NT
defect

Tracking

()

VERIFIED WORKSFORME

People

(Reporter: troy, Assigned: troy)

References

()

Details

Here's the Purify information: [E] FMR: Free memory read in nsParser::Tokenize(void) {1 occurrence} Reading 4 bytes from 0x05568118 (4 bytes at 0x05568118 illegal) Address 0x05568118 is at the beginning of a 92 byte block Address 0x05568118 points to a C++ new block in heap 0x03ac0000 Thread ID: 0xb1 Error location nsParser::Tokenize(void) [nsParser.cpp:863] } else { if(theToken) => delete theToken; mParserContext->mScanner->RewindToMark(); } } nsParser::ResumeParse(void) [nsParser.cpp:582] nsParser::OnDataAvailable(nsIURL *,nsIInputStream *,int) [nsParser.cpp:794] nsDocumentBindInfo::OnDataAvailable(nsIURL *,nsIInputStream *,int) [nsDocLoader.cpp:1390] OnDataAvailableProxyEvent::HandleEvent(void) [nsNetThread.cpp:575] StreamListenerProxyEvent::HandlePLEvent(PLEvent *) [nsNetThread.cpp:421] PL_HandleEvent [plevent.c:395] PL_ProcessPendingEvents [plevent.c:357] md_EventReceiverProc [plevent.c:675] TranslateMessageEx [user32.dll] DispatchMessageA [USER32.dll] nsNativeViewerApp::Run(void) [nsWinMain.cpp:52] main [nsWinMain.cpp:95] mainCRTStartup [crtexe.c:338] _onexitbegin [viewer.exe] Allocation location new(UINT) [new.cpp:23] nsCTokenRecycler::CreateTokenOfType(eHTMLTokenTypes,nsHTMLTag,nsString const&) [CNavDTD.cpp:198] CNavDTD::ConsumeText(nsString const&,CScanner&,CToken *&) [CNavDTD.cpp:3367] CNavDTD::ConsumeToken(CToken *&) [CNavDTD.cpp:3458] nsParser::Tokenize(void) [nsParser.cpp:850] nsParser::ResumeParse(void) [nsParser.cpp:582] nsParser::OnDataAvailable(nsIURL *,nsIInputStream *,int) [nsParser.cpp:794] nsDocumentBindInfo::OnDataAvailable(nsIURL *,nsIInputStream *,int) [nsDocLoader.cpp:1390] OnDataAvailableProxyEvent::HandleEvent(void) [nsNetThread.cpp:575] StreamListenerProxyEvent::HandlePLEvent(PLEvent *) [nsNetThread.cpp:421] PL_HandleEvent [plevent.c:395] PL_ProcessPendingEvents [plevent.c:357] md_EventReceiverProc [plevent.c:675] TranslateMessageEx [user32.dll] DispatchMessageA [USER32.dll] Free location delete(void *) [dbgdel.cpp:35] CTextToken::`scalar deleting destructor'(UINT) [raptorhtmlpars.dll] CNavDTD::ConsumeText(nsString const&,CScanner&,CToken *&) [CNavDTD.cpp:3374] CNavDTD::ConsumeToken(CToken *&) [CNavDTD.cpp:3458] nsParser::Tokenize(void) [nsParser.cpp:850] nsParser::ResumeParse(void) [nsParser.cpp:582] nsParser::OnDataAvailable(nsIURL *,nsIInputStream *,int) [nsParser.cpp:794] nsDocumentBindInfo::OnDataAvailable(nsIURL *,nsIInputStream *,int) [nsDocLoader.cpp:1390] OnDataAvailableProxyEvent::HandleEvent(void) [nsNetThread.cpp:575] StreamListenerProxyEvent::HandlePLEvent(PLEvent *) [nsNetThread.cpp:421] PL_HandleEvent [plevent.c:395] PL_ProcessPendingEvents [plevent.c:357] md_EventReceiverProc [plevent.c:675] TranslateMessageEx [user32.dll] DispatchMessageA [USER32.dll] [E] IPR: Invalid pointer read in nsParser::Tokenize(void) {1 occurrence} Reading 4 bytes from 0xaeaeaeae (4 bytes at 0xaeaeaeae illegal) Address 0xaeaeaeae points into invalid memory Thread ID: 0xb1 Error location nsParser::Tokenize(void) [nsParser.cpp:863] } else { if(theToken) => delete theToken; mParserContext->mScanner->RewindToMark(); } } nsParser::ResumeParse(void) [nsParser.cpp:582] nsParser::OnDataAvailable(nsIURL *,nsIInputStream *,int) [nsParser.cpp:794] nsDocumentBindInfo::OnDataAvailable(nsIURL *,nsIInputStream *,int) [nsDocLoader.cpp:1390] OnDataAvailableProxyEvent::HandleEvent(void) [nsNetThread.cpp:575] StreamListenerProxyEvent::HandlePLEvent(PLEvent *) [nsNetThread.cpp:421] PL_HandleEvent [plevent.c:395] PL_ProcessPendingEvents [plevent.c:357] md_EventReceiverProc [plevent.c:675] TranslateMessageEx [user32.dll] DispatchMessageA [USER32.dll] nsNativeViewerApp::Run(void) [nsWinMain.cpp:52] main [nsWinMain.cpp:95] mainCRTStartup [crtexe.c:338] _onexitbegin [viewer.exe]
Status: NEW → ASSIGNED
Assignee: rickg → troy
Status: ASSIGNED → NEW
I'm changing the status of this bug to reassign (back to Troy). I'm unable to reproduce the problem, and I'm hoping that he can shed more light on the conditions that led to this failure. I suspect that many more steps are required.
Status: NEW → RESOLVED
Closed: 26 years ago
Resolution: --- → WORKSFORME
Rick, if you wait nearly a month to look at the problem and then decide you can't reproduce it, just mark it as WORKSFORME
Status: RESOLVED → VERIFIED
verified worksforme
You need to log in before you can comment on or make changes to this bug.