285691 - crash logging in to gmail [@ nsQueryInterface::operator()]

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Dan M]

20050310 trunk build (20050309 trunk build does not crash):

Go to gmail.google.com
Fill in name & password
hit return

Keep trying. There's a good chance it'll crash. Reduced testcase coming up.

Stack trace:

nsQueryInterface::operator()
nsCOMPtr_base::assign_from_qi
nsCOMPtr<nsISupports>::operator=
XPCWrappedNative::GetNewOrUsed (see note below)*
XPCConvert::NativeInterface2JSObject
nsXPConnect::WrapNative
nsJSEventListener::HandleEvent
nsEventListenerManager::HandleEventSubType
nsEventListenerManager::HandleEvent
nsGenericElement::HandleDOMEvent
nsHTMLFormElement::HandleDOMEvent
PresShell::HandleDOMEventWithTarget (form submit)
nsHTMLInputElement::HandleDOMEvent
PresShell::HandleDOMEventWithTarget (mouseclick)
nsHTMLInputElement::MaybeSubmitForm
nsHTMLInputElement::HandleDOMEvent (keypress)
PresShell::HandleEventInternal
PresShell::HandleEvent
nsViewManager::HandleEvent
nsViewManager::DispatchEvent
HandleEvent
nsWindow::DispatchEvent
nsWindow::DispatchWindowEvent (keypress)
nsWindow::DispatchKeyEvent
nsWindow::OnKeyDown
nsWindow::ProcessMessage

* at GetNewOrUsed line 229:

        identity = do_QueryInterface(Object);

Object points to some deleted thing.

Similar to bug 285579? The stack traces are different.

I've set the component and cc:s from a guess after looking at the 20050310
checkins. It seems like the checkin for bug 285404 would be the cause. I haven't
verified that.

Comment 1

[Dan M]

Attachment: testcase

This reduced bit from the gmail login page also shows the crash. Click the
username field, type a character, hit return. It won't necessarily crash the
first time, but I've never seen it survive the fifth.

Comment 2

[Dan M]

Annoyingly, every time the above testcase does not crash, Bugzilla takes you to
some distraction page. Just hit Back and try again. And again. It'll crash. The
testcase works equally well when loaded from your own hard disk.

Comment 3

[Dan M]

Not to worry. The patch in bug 285546 also fixes this crash. Reassigning and stuff.

Comment 4

[R.K.Aa.]

*** Bug 285747 has been marked as a duplicate of this bug. ***

Comment 5

[Dan M]

Fixed today with bug 285546