[tor-bugs] #16495 [Tor Browser]: Tor Browser 5.0a3 crashes on nytimes.com with security level set to "High"

[Tor Bug Tracker & Wiki]

#16495: Tor Browser 5.0a3 crashes on nytimes.com with security level set to "High"
--------------------------------------------+--------------------------
 Reporter:  gk                              |          Owner:  tbb-team
     Type:  defect                          |         Status:  new
 Priority:  critical                        |      Milestone:
Component:  Tor Browser                     |        Version:
 Keywords:  tbb-5.0a, TorBrowserTeam201507  |  Actual Points:
Parent ID:                                  |         Points:
--------------------------------------------+--------------------------
 If I load nytimes.com on 32bit Linux machines and on Windows it crashes
 right away if I have security slider set to "High". On a test machine I
 get the following stack trace:
 {{{
 Program received signal SIGSEGV, Segmentation fault.
 0xb3d62e2a in nsAttrValue::Type() const ()
     at /home/ubuntu/build/tor-browser/dom/base/nsAttrValue.h:455
 455     /home/ubuntu/build/tor-browser/dom/base/nsAttrValue.h: Datei oder
 Verzeichnis nicht gefunden.
 (gdb) bt
 #0  0xb3d62e2a in nsAttrValue::Type() const ()
     at /home/ubuntu/build/tor-browser/dom/base/nsAttrValue.h:455
 #1  0xb3d62f45 in nsAttrValue::GetAtomCount() const ()
     at /home/ubuntu/build/tor-browser/dom/base/nsAttrValue.cpp:807
 #2  0xb476c61e in RuleHash::EnumerateAllRules(mozilla::dom::Element*,
 ElementDependentRuleProcessorData*, NodeMatchContext&) ()
     at /home/ubuntu/build/tor-
 browser/layout/style/nsCSSRuleProcessor.cpp:677
 #3  0xb476ddb9 in
 nsCSSRuleProcessor::RulesMatching(ElementRuleProcessorData*)
     ()
     at /home/ubuntu/build/tor-
 browser/layout/style/nsCSSRuleProcessor.cpp:2551
 #4  0xb47bff07 in bool
 EnumRulesMatching<ElementRuleProcessorData>(nsIStyleRuleProcessor*, void*)
 ()
     at /home/ubuntu/build/tor-browser/layout/style/nsStyleSet.cpp:719
 #5  0xb47cbbb5 in nsStyleSet::FileRules(bool (*)(nsIStyleRuleProcessor*,
 void*), RuleProcessorData*, mozilla::dom::Element*, nsRuleWalker*) ()
     at /home/ubuntu/build/tor-browser/layout/style/nsStyleSet.cpp:1026
 #6  0xb47d0947 in nsStyleSet::ResolveStyleFor(mozilla::dom::Element*,
 nsStyleContext*, TreeMatchContext&) ()
     at /home/ubuntu/build/tor-browser/layout/style/nsStyleSet.cpp:1265
 #7  0xb481c70e in
 nsCSSFrameConstructor::ResolveStyleContext(nsStyleContext*, nsIContent*,
 nsFrameConstructorState*) ()
     at /home/ubuntu/build/tor-
 browser/layout/base/nsCSSFrameConstructor.cpp:4831
 #8  0x9b98d7f0 in ?? ()
 #9  0x9a308aa0 in ?? ()
 Backtrace stopped: previous frame inner to this frame (corrupt stack?)
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/16495>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online