Closed Bug 1092381 Opened 10 years ago Closed 6 years ago

Crash nsCOMPtr_base::assign_from_qi(nsQueryInterface, nsID const&) | nsCOMPtr<nsIObjectLoadingContent>::nsCOMPtr<nsIObjectLoadingContent>(nsQueryInterface) | FreezeElement

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Version:
35 Branch
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WONTFIX

People

(Reporter: suburp212, Unassigned)

Details

(Keywords: crash)

Crash Data

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
Build ID: 20141027150301

Steps to reproduce:

had several tabs of youtube videos and other websites open


Actual results:

total crash of firefox , all data lost, required restart
all details:
https://crash-stats.mozilla.com/report/index/4f91bd9d-8f4d-47fb-ac05-c4d6c2140817


Expected results:

no crash
Crash Signature: nsCOMPtr_base::assign_from_qi(nsQueryInterface, nsID const&) | nsCOMPtr<nsIObjectLoadingContent>::nsCOMPtr<nsIObjectLoadingContent>(nsQueryInterface) | FreezeElement
Depends on: 530567, 531290, 541743, 606421, 614017, 617048, 649282, 1052441
OS: Windows 7 → All
Hardware: x86_64 → x86
Version: 33 Branch → 31 Branch
Is it reproducible?
Crash Signature: nsCOMPtr_base::assign_from_qi(nsQueryInterface, nsID const&) | nsCOMPtr<nsIObjectLoadingContent>::nsCOMPtr<nsIObjectLoadingContent>(nsQueryInterface) | FreezeElement → [@ nsCOMPtr_base::assign_from_qi(nsQueryInterface, nsID const&) | nsCOMPtr<nsIObjectLoadingContent>::nsCOMPtr<nsIObjectLoadingContent>(nsQueryInterface) | FreezeElement ]
No longer depends on: 530567, 531290, 541743, 606421, 614017, 617048, 649282, 1052441
Summary: nsCOMPtr_base::assign_from_qi(nsQueryInterface, nsID const&) | nsCOMPtr<nsIObjectLoadingContent>::nsCOMPtr<nsIObjectLoadingContent>(nsQueryInterface) | FreezeElement → Crash in nsCOMPtr_base::assign_from_qi(nsQueryInterface, nsID const&) | nsCOMPtr<nsIObjectLoadingContent>::nsCOMPtr<nsIObjectLoadingContent>(nsQueryInterface) | FreezeElement
If only I could reload those tabs...
Looks like something free()d this aContent, the crash address is 0x5a5a5a5a.

http://hg.mozilla.org/releases/mozilla-release/annotate/32dddf30405a/layout/base/nsPresShell.cpp#l8069
>   8072  nsCOMPtr<nsIObjectLoadingContent> olc(do_QueryInterface(aContent));

This is low-volume, and there are reports with newer versions, up to 35, without extensions: https://crash-stats.mozilla.com/report/index/fc8ba260-2345-4189-aa29-0e9582141014
Component: Untriaged → Layout
Keywords: crash
Product: Firefox → Core
Summary: Crash in nsCOMPtr_base::assign_from_qi(nsQueryInterface, nsID const&) | nsCOMPtr<nsIObjectLoadingContent>::nsCOMPtr<nsIObjectLoadingContent>(nsQueryInterface) | FreezeElement → Crash nsCOMPtr_base::assign_from_qi(nsQueryInterface, nsID const&) | nsCOMPtr<nsIObjectLoadingContent>::nsCOMPtr<nsIObjectLoadingContent>(nsQueryInterface) | FreezeElement
Version: 31 Branch → 35 Branch
Hmm.  Things sohuld be removing themselves from this hashtable...
Crash Signature: [@ nsCOMPtr_base::assign_from_qi(nsQueryInterface, nsID const&) | nsCOMPtr<nsIObjectLoadingContent>::nsCOMPtr<nsIObjectLoadingContent>(nsQueryInterface) | FreezeElement ] → [@ nsCOMPtr_base::assign_from_qi(nsQueryInterface, nsID const&) | nsCOMPtr<nsIObjectLoadingContent>::nsCOMPtr<nsIObjectLoadingContent>(nsQueryInterface) | FreezeElement ] [@ nsCOMPtr_base::assign_from_qi | nsCOMPtr<T>::nsCOMPtr<T> | FreezeElement ]
Closing because no crash reported since 12 weeks.
Status: UNCONFIRMED → RESOLVED
Closed: 6 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.