741163 - crash in mozilla::dom::bindings::prototypes::XMLHttpRequest::get_onreadystatechange

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Scoobidiver (away)]

It first appeared in 14.0a1/20120331161857 and is currently #12 top crasher over the last day. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4c43cfe73516&tochange=bbe5086163c9
It's likely a regression from bug 740069.

Signature 	nsXHREventTarget::GetListenerAsJSObject(nsDOMEventListenerWrapper*) More Reports Search
UUID	90090330-e43b-4fbe-97e5-ba9ff2120401
Date Processed	2012-04-01 05:52:57
Uptime	825
Install Age	13.8 minutes since version was first installed.
Install Time	2012-04-01 05:39:01
Product	Firefox
Version	14.0a1
Build ID	20120331161857
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 42 stepping 7
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x8
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x6719, AdapterSubsysID: 23071787, AdapterDriverVersion: 8.960.0.0
Has dual GPUs. GPU #2: AdapterVendorID2: 0x8086, AdapterDeviceID2: 0x0122, AdapterSubsysID2: 0000000c, AdapterDriverVersion2: 8.15.10.2669D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	False	
Total Virtual Memory	4294836224
Available Virtual Memory	3657261056
System Memory Use Percentage	18
Available Page File	14537236480
Available Physical Memory	13924802560

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsXHREventTarget::GetListenerAsJSObject 	content/base/src/nsXMLHttpRequest.h:121
1 	xul.dll 	nsXMLHttpRequest::GetOnreadystatechange 	content/base/src/nsXMLHttpRequest.h:275
2 	xul.dll 	mozilla::dom::bindings::prototypes::XMLHttpRequest::get_onreadystatechange 	obj-firefox/dom/bindings/XMLHttpRequestBinding.cpp:555
3 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:513
4 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:560
5 	mozjs.dll 	js::InvokeGetterOrSetter 	js/src/jsinterp.cpp:634
6 	mozjs.dll 	js::Shape::get 	js/src/jsscopeinlines.h:286
7 	mozjs.dll 	js::GetPropertyHelper 	js/src/jsobj.cpp:5087
8 	mozjs.dll 	js::GetPropertyOperation 	js/src/jsinterpinlines.h:264
9 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2576
10 	mozjs.dll 	js::types::TypeSet::addType 	js/src/jsinferinlines.h:1113
11 	mozjs.dll 	js::types::TypeScript::SetThis 	js/src/jsinferinlines.h:709
12 	mozjs.dll 	js::ExecuteKernel 	js/src/jsinterp.cpp:667
13 	mozjs.dll 	js::Execute 	js/src/jsinterp.cpp:709
14 	mozjs.dll 	EvaluateUCScriptForPrincipalsCommon 	js/src/jsapi.cpp:5256
15 	mozjs.dll 	JS_EvaluateUCScriptForPrincipalsVersionOrigin 	js/src/jsapi.cpp:5293
16 	xul.dll 	nsJSContext::EvaluateString 	dom/base/nsJSEnvironment.cpp:1451
17 	xul.dll 	nsScriptLoader::EvaluateScript 	content/base/src/nsScriptLoader.cpp:922
18 	xul.dll 	nsScriptLoader::ProcessRequest 	content/base/src/nsScriptLoader.cpp:814
19 	xul.dll 	nsScriptLoader::ProcessScriptElement 	content/base/src/nsScriptLoader.cpp:760
20 	xul.dll 	nsScriptElement::MaybeProcessScript 	content/base/src/nsScriptElement.cpp:182
21 	xul.dll 	nsHtml5TreeOpExecutor::RunScript 	parser/html/nsHtml5TreeOpExecutor.cpp:779
22 	xul.dll 	nsHtml5TreeOpExecutor::RunFlushLoop 	parser/html/nsHtml5TreeOpExecutor.cpp:583
23 	xul.dll 	nsHtml5ExecutorReflusher::Run 	parser/html/nsHtml5TreeOpExecutor.cpp:97
24 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:656
25 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
26 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:201
27 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:175
28 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:189
29 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:267
30 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:295
31 	xul.dll 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3770
32 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3847
33 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3923
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsXHREventTarget%3A%3AGetListenerAsJSObject%28nsDOMEventListenerWrapper*%29

Comment 1

[Scoobidiver (away)]

More reports also at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Adom%3A%3Abindings%3A%3Aprototypes%3A%3AXMLHttpRequest%3A%3Aget_onreadystatechange

Comment 2

[Scoobidiver (away)]

It's now #1 top crasher in 14.0a1 over the last day.

One comment says: "It only crashes, when i login to my e-mail account on gmx.de".

There are also crashes in mozilla::dom::bindings::prototypes::XMLHttpRequestEventTarget::get_onerror:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Adom%3A%3Abindings%3A%3Aprototypes%3A%3AXMLHttpRequestEventTarget%3A%3Aget_onerror

Comment 3

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

http://hg.mozilla.org/mozilla-central/rev/8b75b4f686e7