606421 - crash [@ nsDOMConstructor::Create(unsigned short const*, nsDOMClassInfoData const*, nsGlobalNameStruct const*, nsPIDOMWindow*, nsDOMConstructor**) ][@ nsQueryInterface::operator() ][@ nsContentUtils::CanCallerAccess ][@ nsContentUtils::CanCallerAccess(ns

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Scoobidiver (away)]

It is a residual crash signature that exists in 3.6 and 4.0b6 build at a very low rank as a crasher.
From 4.0b8pre/20101013 build, there is a spike in crashes.
It is #90 top crasher in 4.0b8pre for the last week.

Crash reasons are various : EXCEPTION_ACCESS_VIOLATION_WRITE, EXCEPTION_ACCESS_VIOLATION_EXEC, EXCEPTION_ACCESS_VIOLATION_READ.

Signature	nsDOMConstructor::Create(unsigned short const*, nsDOMClassInfoData const*, nsGlobalNameStruct const*, nsPIDOMWindow*, nsDOMConstructor**)
UUID	4a36c4bb-ae1c-4dc9-bbfe-191b62101021
Time 	2010-10-21 17:38:36.334096
Uptime	3136
Last Crash	128817 seconds (1.5 days) before submission
Install Age	39049 seconds (10.8 hours) since version was first installed.
Product	Firefox
Version	4.0b8pre
Build ID	20101021042123
Branch	2.0
OS	Windows NT
OS Version	6.1.7600
CPU	x86
CPU Info	GenuineIntel family 6 model 23 stepping 6
Crash Reason	EXCEPTION_ACCESS_VIOLATION_EXEC
Crash Address	0xfffffffffff6f7f8
App Notes 	AdapterVendorID: 10de, AdapterDeviceID: 0622

Frame 	Module 	Signature [Expand] 	Source
0 		@0xfff6f7f8 	
1 	xul.dll 	nsDOMConstructor::Create 	dom/base/nsDOMClassInfo.cpp:5820
2 	xul.dll 	ResolvePrototype 	dom/base/nsDOMClassInfo.cpp:6094
3 	xul.dll 	nsDOMClassInfo::PostCreatePrototype 	dom/base/nsDOMClassInfo.cpp:4734
4 	xul.dll 	XPCWrappedNativeProto::Init 	js/src/xpconnect/src/xpcwrappednativeproto.cpp:143
5 	xul.dll 	XPCWrappedNativeProto::GetNewOrUsed 	js/src/xpconnect/src/xpcwrappednativeproto.cpp:264
6 	xul.dll 	XPCWrappedNative::GetNewOrUsed 	js/src/xpconnect/src/xpcwrappednative.cpp:541
7 	xul.dll 	XPCConvert::NativeInterface2JSObject 	js/src/xpconnect/src/xpcconvert.cpp:1291
8 	xul.dll 	XPCConvert::NativeData2JS 	js/src/xpconnect/src/xpcconvert.cpp:492
9 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1588
10 	xul.dll 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:571
11 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114
12 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141
13 	xul.dll 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:1112

The "regression" range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=2593c8c8af8b&tochange=f6e81dd5a125

More reports at:
http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=nsDOMConstructor%3A%3ACreate%28unsigned%20short%20const*%2C%20nsDOMClassInfoData%20const*%2C%20nsGlobalNameStruct%20const*%2C%20nsPIDOMWindow*%2C%20nsDOMConstructor**%29

Comment 1

[Scoobidiver (away)]

With the combinaison of all the nsDOMConstructor::Create signatures, it is #30 top crasher in 4.0b8pre for the last week.

Comment 2

[Johnny Stenback (:jst)]

Blocking, and over to mrbkap.

Comment 3

[Dave Garrett]

I've been getting a similar stack trace from nsDOMConstructor::Create down on my main beta 7 profile randomly, though the top for me usually goes up to nsQueryInterface::operator nsCOMPtr or linux-gate.so@0x422.

Firefox 4.0 beta 7 crash on Linux:
bp-2f5818e6-5b0d-400a-a78e-9cc982101111
0 	linux-gate.so 	linux-gate.so@0x422 	
1 	libc-2.11.1.so 	libc-2.11.1.so@0x2da81 	
2 	libstdc++.so.6.0.13 	libstdc++.so.6.0.13@0xbf52e 	
3 	libstdc++.so.6.0.13 	libstdc++.so.6.0.13@0xbd464 	
4 	libstdc++.so.6.0.13 	libstdc++.so.6.0.13@0xbd4a1 	
5 	libstdc++.so.6.0.13 	libstdc++.so.6.0.13@0xbe154 	
6 	libxul.so 	nsQueryInterface::operator 	nsCOMPtr.cpp:47
7 	libxul.so 	nsCOMPtr_base::assign_from_qi 	nsCOMPtr.cpp:96
8 	libxul.so 	nsContentUtils::CanCallerAccess 	nsCOMPtr.h:595
9 	libxul.so 	nsDOMConstructor::Create 	dom/base/nsDOMClassInfo.cpp:5810
10 	libxul.so 	ResolvePrototype 	dom/base/nsDOMClassInfo.cpp:6087
11 	libxul.so 	nsDOMClassInfo::PostCreatePrototype 	dom/base/nsDOMClassInfo.cpp:4727
12 	libxul.so 	XPCWrappedNativeProto::Init 	js/src/xpconnect/src/xpcwrappednativeproto.cpp:143
13 	libxul.so 	XPCWrappedNativeProto::GetNewOrUsed 	js/src/xpconnect/src/xpcwrappednativeproto.cpp:264
14 	libxul.so 	XPCWrappedNative::GetNewOrUsed 	js/src/xpconnect/src/xpcwrappednative.cpp:541
15 	libxul.so 	XPCConvert::NativeInterface2JSObject 	js/src/xpconnect/src/xpcconvert.cpp:1290
16 	libxul.so 	XPCConvert::NativeData2JS 	js/src/xpconnect/src/xpcconvert.cpp:490
17 	libxul.so 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcprivate.h:3255
18 	libxul.so 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:577
19 	libxul.so 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp:95
20 	libxul.so 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:1112
21 	libxul.so 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:1208
22 	libxul.so 	nsEventTargetChainItem::HandleEvent 	content/events/src/nsEventListenerManager.h:146
...
...

Both stacks are dying in the same general spot and I think the Linux stack is just giving more info than the frame 0 in comment 0. I'm pretty sure they're the same crash.

Comment 5

[Rob Campbell [:rc] (:robcee)]

I have a full stack trace from OS X in bug 611896, now duped to this bug.

Comment 6

[Johnny Stenback (:jst)]

This is not critical for beta8, moving to beta9.

Comment 7

[chris hofmann]

now #19 on beta7 and would be higher with counts from the combined signatures.

Comment 8

[Johnny Stenback (:jst)]

mrbkap and I believe bug 612383 is the same bug as this one, duping...

Comment 10

[Scott A.]

(In reply to comment #8)
> mrbkap and I believe bug 612383 is the same bug as this one, duping...

(In reply to comment #9)
> *** Bug 612383 has been marked as a duplicate of this bug. ***

Big contradiction here, which one is the duplicate?

Comment 11

[timeless]

scott: duplicate is a reflexive relationship. since this bug is older, it seems jst chose to leave this bug as the live one.

Comment 12

[LegNeato]

As per today's meeting, beta 9 will be a time-based release. Marking these all betaN+. Please move it back to beta9+ if you believe it MUST be in the next beta (ie: trunk is in an unshippable state without this)

Comment 13

[chris hofmann]

I don't see this showing up in beta 8 data.  

http://crash-stats.mozilla.com/report/list?signature=nsDOMConstructor%3A%3ACreate%28unsigned%20short%20const*%2C%20nsDOMClassInfoData%20const*%2C%20nsGlobalNameStruct%20const*%2C%20nsPIDOMWindow*%2C%20nsDOMConstructor**%29

I wonder if its fixed there?

Comment 14

[LegNeato]

Fixing fields my automated script accidentally blanked. Apologies for the bugspam

Comment 15

[Johnny Stenback (:jst)]

I don't see it either, marking WORKSFORME.