528832 - TopCrash [@nsPresContext::MediaFeatureValuesChanged(int) ]

Status: RESOLVED FIXED

(Core :: Layout, defect, P2)

Description

[Carsten Book [:Tomcat]]

topcrash #19 for 1.9.2 from the Crash Stats:

http://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A3.6b2&query_search=signature&query_type=exact&query=&date=&range_value=1&range_unit=weeks&do_query=1&signature=nsPresContext%3A%3AMediaFeatureValuesChanged%28int%29

Windows only Crash - some are start up crashes, some not

Comment 1

[Jordan Gutterman]

Just looking at the stack seems to point at bug 522149 which added the line in frame 1 between beta 1 and 2.

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I pulled the minidump for
http://crash-stats.mozilla.com/report/index/96495f53-77ae-40e0-8bf1-b34042091116
and confirmed that the problem is that mShell is null.  (Amusingly, nsPresContext::mShell and nsIPresShell::mStyleSet are at the same offset, 0xc.)

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

I suppose I could null-check at the caller, but I may as well null-check inside here.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 412737 [details] [diff] [review]
patch

We really need to get these object lifetimes sorted.  :(

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Yeah. The PresShell/PresContext merge would be a good way to make sure this never happens...

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

http://hg.mozilla.org/mozilla-central/rev/57421445a25d

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/643642555a29