1011303 - crash in mozilla::dom::DocumentFragment::QueryInterface(nsID const&, void**)

Status: RESOLVED DUPLICATE of bug 805406

(Core :: DOM: Core & HTML, defect)

Description

[juan becerra [:juanb]]

This bug was filed from the Socorro interface and is 
report bp-56137d9c-f069-4707-b1e3-a1f962140509.
=============================================================

Not sure where to file this.

Filed while looking at the top crashers for nightly 32a2. Mostly happening on Windows 7. One comment mentioned "tried running katamari js on a webpage and it went kaboom", but other than that there isn't much to go on.

More comments can be found here:

https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozilla%3A%3Adom%3A%3ADocumentFragment%3A%3AQueryInterface%28nsID+const%26%2C+void%2A%2A%29

0 	xul.dll 	mozilla::dom::DocumentFragment::QueryInterface(nsID const &,void * *) 	
1 	xul.dll 	gfxFontGroup::~gfxFontGroup() 	
2 	xul.dll 	[thunk]:mozilla::dom::XULDocument::CreateAttribute`adjustor{644}' (nsAString_internal const &,nsIDOMAttr * *) 	
3 	xul.dll 	mozilla::net::nsHttpHandler::NewURI(nsACString_internal const &,char const *,nsIURI *,nsIURI * *) 	
4 	xul.dll 	mozilla::layers::Layer::GetTransform() 	
5 	xul.dll 	nsDOMCSSAttributeDeclaration::QueryInterface(nsID const &,void * *) 	
6 	xul.dll 	nsCharTraits<wchar_t>::move(wchar_t *,wchar_t const *,unsigned int) 	
7 	xul.dll 	nsDOMCSSAttributeDeclaration::QueryInterface(nsID const &,void * *) 	
8 	xul.dll 	nsDOMCSSAttributeDeclaration::QueryInterface(nsID const &,void * *) 	
9 	xul.dll 	nsPrincipal::`vector deleting destructor'(unsigned int) 	
10 	xul.dll 	BuildTextRunsScanner::BreakSink::SetBreaks(unsigned int,unsigned int,unsigned char *) 	
11 	xul.dll 	nsCSSValue::SetStringValue(nsString const &,nsCSSUnit) 	
12 	xul.dll 	nsCSSValue::SetStringValue(nsString const &,nsCSSUnit) 	
13 	xul.dll 	mozilla::dom::DocumentFragment::QueryInterface(nsID const &,void * *) 	
14 	xul.dll 	mozilla::dom::DocumentFragment::QueryInterface(nsID const &,void * *) 	
15 	xul.dll 	mozilla::dom::DocumentFragment::QueryInterface(nsID const &,void * *) 	
16 	xul.dll 	mozilla::FileLocation::GetURIString(nsACString_internal &) 	
17 	xul.dll 	gfxFontGroup::~gfxFontGroup() 	
18 	xul.dll 	gfxFontGroup::~gfxFontGroup() 	
19 	user32.dll 	InternalCallWinProc 	
20 	user32.dll 	GetRealWindowOwner 	
21 	user32.dll 	DispatchClientMessage 	
22 	user32.dll 	__fnDWORD 	
23 	ntdll.dll 	KiUserCallbackDispatcher 	
24 	ntdll.dll 	KiUserApcDispatcher 	
25 	user32.dll 	DispatchMessageW 	
26 	xul.dll 	mozilla::dom::Event::ConstructorInit(mozilla::dom::EventTarget *,nsPresContext *,mozilla::WidgetEvent *) 	
27 	xul.dll 	mozilla::dom::Event::ConstructorInit(mozilla::dom::EventTarget *,nsPresContext *,mozilla::WidgetEvent *) 	
28 	xul.dll 	mozilla::dom::Event::ConstructorInit(mozilla::dom::EventTarget *,nsPresContext *,mozilla::WidgetEvent *) 	
29 	xul.dll 	nsDisplayItem::RecomputeVisibility(nsDisplayListBuilder *,nsRegion *) 	
30 	xul.dll 	mozilla::ipc::BackgroundChildImpl::~BackgroundChildImpl() 	
31 	xul.dll 	std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >(wchar_t const *,unsigned int) 	
32 	xul.dll 	std::_List_val<sigslot::_connection_base2<mozilla::NrIceCtx *,mozilla::NrIceCtx::ConnectionState,sigslot::single_threaded> *,std::allocator<sigslot::_connection_base2<mozilla::NrIceCtx *,mozilla::NrIceCtx::ConnectionState,sigslot::single_threaded> *> >::_List_val<sigslot::_connection_base2<mozilla::NrIceCtx *,mozilla::NrIceCtx::ConnectionState,sigslot::single_threaded> *,std::allocator<sigslot::_connection_base2<mozilla::NrIceCtx *,mozilla::NrIceCtx::ConnectionState,sigslot::single_threaded> *> >(std::allocator<sigslot::_connection_base2<mozilla::NrIceCtx *,mozilla::NrIceCtx::ConnectionState,sigslot::single_threaded> *>) 	
33 	xul.dll 	mozilla::dom::WantsQueryInterface<nsScreen>::Enabled(JSContext *,JSObject *) 	
34 	xul.dll 	nsRefPtr<mozilla::net::SeerDNSListener>::assign_assuming_AddRef(mozilla::net::SeerDNSListener *) 	
35 	xul.dll 	google::protobuf::io::CodedOutputStream::WriteVarint32FallbackToArrayInline(unsigned int,unsigned char *) 	
36 	xul.dll 	mozilla::widget::TaskbarTabPreview::DetachFromNSWindow() 	
37 	xul.dll 	nsContainerFrame::InsertFrames(mozilla::layout::FrameChildListID,nsIFrame *,nsFrameList &) 	
38 	xul.dll 	nsDNSRecord::ReportUnusable(unsigned short) 	
39 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp
40 	firefox.exe 	NS_internal_main(int,char * *) 	browser/app/nsBrowserApp.cpp
41 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
42 	firefox.exe 	__tmainCRTStartup 	f:/dd/vctools/crt_bld/self_x86/crt/src/crtexe.c:552
43 	kernel32.dll 	kernel32.dll@0x173e 	
44 	ntdll.dll 	__RtlUserThreadStart 	
45 	ntdll.dll 	_RtlUserThreadStart

Comment 1

[Boris Zbarsky [:bzbarsky]]

That stack looks pretty completely busted.  None of those methods call each other...

Comment 2

[(Away)]

More fallout from the symbol problems in bug 1003085. This was PushClipsToDT for the 5/08 and 5/09 builds.