Open Bug 749913 Opened 12 years ago Updated 1 year ago

crash in nsINode::GetProperty

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Version:
15 Branch
Platform:
All
Windows 7
Type:
defect

Tracking

()

Tracking Flags:
Tracking Status
firefox48 --- wontfix
firefox49 --- wontfix
firefox-esr45 --- wontfix
firefox50 --- wontfix

People

(Reporter: scoobidiver, Unassigned)

References

Details

(Keywords: crash, regression)

Crash Data

It's a residual signature but there's a spike in crashes starting from 15.0a1/20120426. Crashes happen also after the fix of bug 749182.
The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=75c7378c87b6&tochange=cc5254f9825f
It's likely a regression from bug 740063.

Signature 	nsINode::GetProperty(nsIAtom*, unsigned int*) More Reports Search
UUID	4da757ee-e4d1-4668-9a24-ddb5c2120427
Date Processed	2012-04-27 21:55:07
Uptime	4435
Install Age	1.2 hours since version was first installed.
Install Time	2012-04-27 20:40:47
Product	Firefox
Version	15.0a1
Build ID	20120427030500
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 42 stepping 7
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x0126, AdapterSubsysID: 050e1028, AdapterDriverVersion: 8.15.10.2342
Has dual GPUs. GPU #2: AdapterVendorID2: 0x10de, AdapterDeviceID2: 0x0df4, AdapterSubsysID2: 050e1028, AdapterDriverVersion2: 8.17.12.9610D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True
Total Virtual Memory	4294836224
Available Virtual Memory	3423870976
System Memory Use Percentage	42
Available Page File	12951830528
Available Physical Memory	4888842240

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsINode::GetProperty 	obj-firefox/dist/include/nsINode.h:595
1 	xul.dll 	mozilla::dom::Element::LockedStyleStates 	content/base/src/nsGenericElement.cpp:1403
2 	xul.dll 	mozilla::dom::Element::ClearStyleStateLocks 	content/base/src/nsGenericElement.cpp:1473
3 	xul.dll 	inDOMUtils::ClearPseudoClassLocks 	layout/inspector/src/inDOMUtils.cpp:457
4 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
5 	xul.dll 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:2408
6 	xul.dll 	XPC_WN_CallMethod 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1549
7 	xul.dll 	xpc::XrayWrapper<js::CrossCompartmentWrapper,xpc::ProxyXrayTraits>::getPropertyD 	js/xpconnect/wrappers/XrayWrapper.cpp:1164
8 	mozjs.dll 	JaegerTrampoline 	js/src/methodjit/MethodJIT.cpp:870
9 	mozjs.dll 	js::mjit::EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:1052
10 	mozjs.dll 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:1123
11 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:472
12 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:535
13 	mozjs.dll 	array_readonlyCommon<ArrayForEachBehavior> 	js/src/jsarray.cpp:3301
14 	mozjs.dll 	mozjs.dll@0x18caf 	
15 	mozjs.dll 	array_forEach 	js/src/jsarray.cpp:3338
16 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:519
17 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2757
18 	xul.dll 	XPCConvert::NativeInterface2JSObject 	js/xpconnect/src/XPCConvert.cpp:1066
19 	mozjs.dll 	JSFunction::initBoundFunction 	js/src/jsfun.cpp:760
20 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:519
21 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5416
22 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/xpconnect/src/XPCWrappedJSClass.cpp:1509
23 	xul.dll 	nsXPCWrappedJS::CallMethod 	js/xpconnect/src/XPCWrappedJS.cpp:617
24 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:117
25 	xul.dll 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:877
26 	xul.dll 	nsWindowRoot::PreHandleEvent 	dom/base/nsWindowRoot.cpp:194
27 		@0x2e4dd0af

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsINode%3A%3AGetProperty%28nsIAtom*%2C+unsigned+int*%29
Doesn't seem like bug 740063 would cause this, but nothing in the range jumps out at me.  Except maybe bug 695480.
Crash Signature: [@ nsINode::GetProperty(nsIAtom*, unsigned int*)] → [@ nsINode::GetProperty(nsIAtom*, unsigned int*)] [@ nsINode::GetProperty]
Crash volume for signature 'nsINode::GetProperty':
 - nightly (version 51): 0 crashes from 2016-08-01.
 - aurora  (version 50): 9 crashes from 2016-08-01.
 - beta    (version 49): 21 crashes from 2016-08-02.
 - release (version 48): 23 crashes from 2016-07-25.
 - esr     (version 45): 18 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       0       0       0
 - aurora        1       7       1
 - beta          7       8       3
 - release       4       6       6
 - esr           1       4       0

Affected platforms: Windows, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora
 - beta    #2765
 - release #2545     #1091
 - esr     #5430
status-firefox48: --- → affected
status-firefox49: --- → affected
status-firefox50: --- → affected
status-firefox-esr45: --- → affected
Bot definitely should not care here (I'm sure we want to care about every crash but we cannot)
We will almost never care about the #5430 crash in anything unless it is sec-critical....
status-firefox48: affected → wontfix
status-firefox49: affected → wontfix
status-firefox50: affected → wontfix
status-firefox-esr45: affected → wontfix
Flags: needinfo?(cdenizet)
Flags: needinfo?(cdenizet)
Component: DOM → DOM: Core & HTML
QA Whiteboard: qa-not-actionable
Severity: critical → S2

Old crash, consistently very low volume --> S3
Let me know if we should rate this differently.

Severity: S2 → S3
Crash Signature: [@ nsINode::GetProperty(nsIAtom*, unsigned int*)] [@ nsINode::GetProperty] → [@ nsINode::GetProperty] [@ nsINode::GetProperty]
You need to log in before you can comment on or make changes to this bug.