1236718 - startup crash in nsDocument::MozExitPointerLock

Status: RESOLVED DUPLICATE of bug 1218473

(Core :: DOM: Core & HTML, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

This bug was filed from the Socorro interface and is 
report bp-f53ee9c1-4029-4655-9fbd-79ca52160104.
=============================================================

Firefox Aurora 45.0a2 20160104 32 bit on Windows 8.1 64 bit

Graphic drivers:
Intel HD Graphic drivers 10.18.14.4332 (cpu i7-4700MQ): This is a version not yet distributed over Windows Update but only over Intel's website, as far as I know: https://downloadcenter.intel.com/download/25588/Intel-Graphics-Driver-for-Windows-7-8-1-15-36-28-4332-
Nvidia 361.43 (graphics card 765M)

I update Aurora earlier today and I launched after the update, but now I always get a startup crash:

 0 		@0xd224000
1 	xul.dll	nsDocument::MozExitPointerLock()
2 	xul.dll	nsDocument::OnPageHide(bool, mozilla::dom::EventTarget*)
3 	xul.dll	nsDocumentViewer::PageHide(bool)
4 	xul.dll	nsDocShell::FirePageHideNotification(bool)
5 	xul.dll	nsDocShell::CreateContentViewer(nsACString_internal const&, nsIRequest*, nsIStreamListener**)
6 	xul.dll	nsDSURIContentListener::DoContent(nsACString_internal const&, bool, nsIRequest*, nsIStreamListener**, bool*)
7 	xul.dll	nsDocumentOpenInfo::TryContentListener(nsIURIContentListener*, nsIChannel*)
8 	xul.dll	nsDocumentOpenInfo::DispatchContent(nsIRequest*, nsISupports*)
9 	xul.dll	nsDocumentOpenInfo::OnStartRequest(nsIRequest*, nsISupports*)
10 	xul.dll	nsJARChannel::OnStartRequest(nsIRequest*, nsISupports*)
11 	xul.dll	nsInputStreamPump::OnStateStart()
12 	xul.dll	nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*)
13 	xul.dll	nsInputStreamReadyEvent::Run()
14 	xul.dll	nsThread::ProcessNextEvent(bool, bool*)
15 	xul.dll	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)
16 	xul.dll	MessageLoop::RunHandler()
17 	xul.dll	nsThreadManager::GetMainThread(nsIThread**)
18 	xul.dll	nsBaseAppShell::Run()
19 	xul.dll	nsAppStartup::Run()
20 	xul.dll	XREMain::XRE_mainRun()
21 	xul.dll	XREMain::XRE_main(int, char** const, nsXREAppData const*)
22 	xul.dll	XRE_main
23 	dbghelp.dll	CreateCDiaEnumFixupData2(CDiaSession*, IDiaEnumDebugStreamData**)

More crashes:
https://crash-stats.mozilla.com/report/index/0cbc06fa-433d-48ca-8b37-4e7402160104

Nightly 46.0a1 20160103 also perma-crashes on startup, but with, [@ `anonymous namespace''::CreateWindowExWHook ] (bug 1218473?), e.g.
https://crash-stats.mozilla.com/report/index/acb1268c-f30a-4108-8fc1-1a5d42160104
https://crash-stats.mozilla.com/report/index/44024678-70bf-4182-863c-f414f2160104
https://crash-stats.mozilla.com/report/index/6c33c427-9103-45b4-b2ba-13d672160104

Comment 1

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

And with startup crash I mean that also already launching the profile manager crashes the application.

Comment 2

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

This is definitely a security bug ... mccr8 can you investigate what might be going on?

Comment 3

[Andrew McCreight [:mccr8]]

Would you mind using mozregression to try to figure out what caused this? http://mozilla.github.io/mozregression/ If it fact it isn't some driver that updated on your machine recently.

Comment 4

[Andrew McCreight [:mccr8]]

Aaron, could this be bug 1218473 (as the reporter points out)? The last few signatures certainly look like it, and the reporter has a dual Intel/Nvidia GPU.

Comment 5

[Andrew McCreight [:mccr8]]

FWIW, it looks like from bug 1218473 that some workaround just landed on m-c today, so Sebastien you could see if it goes away in another Nightly or two.

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Unfortunately, I can't reproduce the issue anymore because I downgraded and upgraded the Intel driver after waiting 2 hours for information requests in #gfx - needed Aurora working for localization.

Each tested Nightly build of the first days gave a different crash signature, so these might be duplicates:
20160101 - Bug 1236338 - startup crash in bsearch
20160103 - Bug 1218473 - [@ `anonymous namespace''::CreateWindowExWHook ]
20160105 - Bug 1237240 - crash [@ mozilla::dom::BroadcastChannelBinding::GetConstructorObjectHandle]

Comment 7

[(No longer employed by Mozilla) Aaron Klotz]

(In reply to Andrew McCreight [:mccr8] from comment #4)
> Aaron, could this be bug 1218473 (as the reporter points out)? The last few
> signatures certainly look like it, and the reporter has a dual Intel/Nvidia
> GPU.

That's exactly what the problem is. FWIW, if you look at the call site at frame #1, then look at the disassembly for the original target of the call, if the next function in the disassembly is CreateWindowHookExW, then it is a dup of bug 1218473.