1356755 - Crash in nsINode::Slots with NotifyDocumentTree on the stack

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[(no longer active)]

[Tracking Requested - why for this release]: crasher.

This bug was filed from the Socorro interface and is 
report bp-0e97692b-eb36-43f4-811c-592340170414.
=============================================================

Missing null check.  mDoc can be null, and we can crash in a few different ways every once in a while: <https://crash-stats.mozilla.com/signature/?product=Firefox&signature=nsINode%3A%3ASlots&date=%3E%3D2017-04-08T04%3A45%3A00.000Z&date=%3C2017-04-15T04%3A45%3A00.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=-date&page=1#reports>

Comment 1

[(no longer active)]

Attachment: Don't pass a null pointer to NotifyDocumentTree()

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/7c9e059fe6da
Don't pass a null pointer to NotifyDocumentTree(); r=qdot

Comment 3

[(no longer active)]

Comment on attachment 8858477 [details] [diff] [review]
Don't pass a null pointer to NotifyDocumentTree()

Approval Request Comment
[Feature/Bug causing the regression]: Bug 508482
[User impact if declined]: Crash
[Is this code covered by automated tests?]: No, there is no test case for the crash.
[Has the fix been verified in Nightly?]: No, but it's a simple null check.
[Needs manual test from QE? If yes, steps to reproduce]: No.
[List of other uplifts needed for the feature/fix]: None.
[Is the change risky?]: No.
[Why is the change risky/not risky?]: Simple null check.
[String changes made/needed]: None.

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/7c9e059fe6da

Comment 5

[Gerry Chang [:gchang]]

Track 54+ as crash.

Comment 6

[Gerry Chang [:gchang]]

Comment on attachment 8858477 [details] [diff] [review]
Don't pass a null pointer to NotifyDocumentTree()

Fix a crash. Aurora54+.

Comment 7

[Marcia Knous [:marcia]]

Tracking 55+. I assume this will be a won't fix for 53 as we are already well in RC.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 8858477 [details] [diff] [review]
Don't pass a null pointer to NotifyDocumentTree()

I'm going to go out on a limb that the ESR45 request was actually meant for ESR52.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/d68c89ad6e51

Comment 10

[Liz Henry (:lizzard) (relman/hg->git project)]

Too late to land this in 53. This is also a very low frequency crash, 3 crashes each on release and ESR in a week.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 8858477 [details] [diff] [review]
Don't pass a null pointer to NotifyDocumentTree()

Per comment 10.

Comment 12

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8858477 [details] [diff] [review]
Don't pass a null pointer to NotifyDocumentTree()

There were 0 instances of this crash on ESR52 in the past 7 days, however since the patch is super simple, it doesn't hurt to uplift it. ESR52.2+

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr52/rev/4a3fce67b52d

Comment 14

[Marco Castelluccio [:marco]]

The signature changed because of bug 1356756.