578215 - Browser crashes when opening http://html5test.com/ [@ CallQueryInterface<nsISupports, nsXPCOMCycleCollectionParticipant>(nsISupports*, nsXPCOMCycleCollectionParticipant**) ]

Status: RESOLVED FIXED

(Core :: Graphics: Canvas2D, defect, P1)

Description

[bomfog]

User-Agent:       Mozilla/5.0 (Windows; Windows NT 6.0; en-US; rv:2.0b2pre) Gecko/20100712 Minefield/4.0b2pre Firefox/3.6
Build Identifier: Mozilla/5.0 (Windows; Windows NT 6.0; en-US; rv:2.0b2pre) Gecko/20100712 Minefield/4.0b2pre Firefox/3.6

Page flashes for a fraction of a second, then browser crashes

Reproducible: Always

Steps to Reproduce:
1.Download a zip build, 20100712090037 03782d915403 or later 
2.Unzip and start the browser
3.Open the page http://html5test.com/
Actual Results:  
Browser crashes

Expected Results:  
Page opens, no crash

Last good build: 20100712073718 58eb7d767d6f

Crashes with fresh profile, safe-mode

Some crash reports (Hourlies, so may not help much):
bp-3960e94c-f33f-4547-bdff-cc0022100712
bp-f9b2d2b9-7e16-4997-9495-2096b2100712
bp-093a46e3-cbf4-474a-9f64-3a65f2100712
...

[@ xul.dll@0x45fcf2]
[@ xul.dll@0x4698f9]
EXCEPTION_ACCESS_VIOLATION

Comment 1

[Tyler Downer [He/Him]]

WFM with Mozilla/5.0 (Windows; Windows NT 6.1; WOW64; en-US; rv:2.0b2pre) Gecko/20100712 Minefield/4.0b2pre

Comment 2

[Heinrich Witt]

Same problem here:
http://crash-stats.mozilla.com/report/index/bp-0faa6a6e-d42a-4547-8bb7-832872100712

Mozilla/5.0 (Windows; Windows NT 6.1; WOW64; en-US; rv:2.0b2pre) Gecko/20100711 Minefield/4.0b2pre ID:20100712164810

Comment 3

[Jim Jeffery not reading bug-mail 1/2/11]

Today's nightly crashes: 

http://crash-stats.mozilla.com/report/index/bp-c89a1e4a-3ec9-4f69-b82b-a61762100713

Comment 4

[Jim Jeffery not reading bug-mail 1/2/11]

Possible regression window, from another user at mozillazine forums:

broken -- 20100712090245 42e56a8bb77a

Last good build -- 20100712073718 58eb7d767d6f

I have not verified this range.

Comment 5

[aja+bugzilla]

This one's on XP trunk nightly, restoring tab with http://beta.html5test.com

http://crash-stats.mozilla.com/report/index/bp-a8df3cd4-139d-4518-b196-ec6a12100713

Comment 6

[Jim Jeffery not reading bug-mail 1/2/11]

Regression range in comment #4 is valid: 
Suspect patches: 
https://bugzilla.mozilla.org/show_bug.cgi?id=401788
https://bugzilla.mozilla.org/show_bug.cgi?id=578032

I would say bug 401788 is likely the bad-guy here.

Comment 7

[Peter Van der Beken [:peterv]]

The patch in bug 401788 made GetContextHelper return NS_OK without returning a helper. In nsHTMLCanvasElement::GetContext we then call CallQueryInterface on the helper (CallQI doesn't handle null).

Comment 8

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Attachment: Patch

Comment 12

[Benoit Jacob [:bjacob] (mostly away)]

Notice that bug 578465 contains a different patch for the same bug. We need whoever wrote this code (Vlad?) to decide on The Right Fix (tm).

Comment 13

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

The patch here is probably the right thing to do

Comment 14

[Martijn Wargers (dead)]

Attachment: testcase

I'm getting this crash with this testcase.

Comment 15

[Steve Scott (pxbugz)]

Mozilla/5.0 (Windows; Windows NT 6.1; WOW64; en-US; rv:2.0b2pre) Gecko/20100715 Minefield/4.0b2pre

I'm getting a different crash to the other comments here.

From beta.html5test.com http://crash-stats.mozilla.com/report/index/0fb26d17-2871-400b-97a6-4a2af2100715

and from comment #14 testcase http://crash-stats.mozilla.com/report/index/32ac4521-acf8-471d-9946-a9d852100715

Comment 16

[Benoit Jacob [:bjacob] (mostly away)]

Hey! The patch here is checkin-needed, why doesn't someone check it in? Shall I do it?

Comment 17

[Benoit Jacob [:bjacob] (mostly away)]

Auxiliary question: why doesn't  Ms2ger have commit rights? Wouldn't it make everyone's life easier?

Comment 18

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Sorry, thought this had already been checked in

http://hg.mozilla.org/mozilla-central/rev/ce439bd24549