614762 - crash [@ nsRefPtr<nsPluginArray>::assign_assuming_AddRef(nsPluginArray*) | nsRefPtr<nsAccessible>::StartAssignment() | mozilla::layers::DeviceManagerD3D9::CreateVertexBuffer() ]

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Scoobidiver (away)]

This is a new crash signature. Crashes first appeared in today's build.
It is a regression from bug 614111.

Signature	nsRefPtr<nsPluginArray>::assign_assuming_AddRef(nsPluginArray*) | nsRefPtr<nsAccessible>::StartAssignment() | mozilla::layers::DeviceManagerD3D9::CreateVertexBuffer()
UUID	49f8d2f4-ad0b-43a7-b187-f519e2101124
Time 	2010-11-24 15:22:03.735094
Uptime	2346
Last Crash	4889 seconds (1.4 hours) before submission
Install Age	5202 seconds (1.4 hours) since version was first installed.
Product	Firefox
Version	4.0b8pre
Build ID	20101124042634
Branch	2.0
OS	Windows NT
OS Version	6.1.7600
CPU	x86
CPU Info	AuthenticAMD family 15 model 4 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x10
App Notes 	AdapterVendorID: 10de, AdapterDeviceID: 0343
Tcpip MSAFD [TCP/IP] : 2 : 1 :
Tcpip MSAFD [UDP/IP] : 2 : 2 : %SystemRoot%\system32\mswsock.dll
Tcpip MSAFD [RAW/IP] : 2 : 3 :
MSAFD Tcpip [TCP/IPv6] : 2 : 1 : %SystemRoot%\system32\mswsock.dll
MSAFD Tcpip [UDP/IPv6] : 2 : 2 :
MSAFD Tcpip [RAW/IPv6] : 2 : 3 : %SystemRoot%\system32\mswsock.dll
Provedor de Serviço de TCPv6 de RSVP : 2 : 1 :
Provedor de Serviço de TCP de RSVP : 2 : 1 : %SystemRoot%\system32\mswsock.dll
Provedor de Serviço de UDPv6 de RSVP : 2 : 2 :
Provedor de Serviço de UDP de RSVP : 2 : 2 : %SystemRoot%\system32\mswsock.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip_{EBF2A8B8-4542-411F-851A-2BD79575BEF6}] SEQPACKET 1 : 2 : 5 :
MSAFD NetBIOS [\Device\NetBT_Tcpip_{EBF2A8B8-4542-411F-851A-2BD79575BEF6}] DATAGRAM 1 : 2 : 2 : %SystemRoot%\system32\mswsock.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{23005D46-9C08-46EF-A56E-11299F17E816}] SEQPACKET 3 : 2 : 5 :
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{23005D46-9C08-

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsRefPtr<nsPluginArray>::assign_assuming_AddRef 	obj-firefox/dist/include/nsAutoPtr.h:957
1 	xul.dll 	nsRefPtr<nsAccessible>::StartAssignment 	obj-firefox/dist/include/nsAutoPtr.h:1179
2 	xul.dll 	mozilla::layers::DeviceManagerD3D9::CreateVertexBuffer 	gfx/layers/d3d9/DeviceManagerD3D9.cpp:624
3 	xul.dll 	mozilla::layers::DeviceManagerD3D9::VerifyReadyForRendering 	gfx/layers/d3d9/DeviceManagerD3D9.cpp:544
4 	xul.dll 	mozilla::layers::SwapChainD3D9::PrepareForRendering 	gfx/layers/d3d9/DeviceManagerD3D9.cpp:121
5 	xul.dll 	mozilla::layers::LayerManagerD3D9::Render 	gfx/layers/d3d9/LayerManagerD3D9.cpp:278
6 	xul.dll 	mozilla::layers::LayerManagerD3D9::EndTransaction 	gfx/layers/d3d9/LayerManagerD3D9.cpp:163
7 	xul.dll 	nsDisplayList::PaintForFrame 	layout/base/nsDisplayList.cpp:476
8 	xul.dll 	nsLayoutUtils::PaintFrame 	layout/base/nsLayoutUtils.cpp:1442
9 	xul.dll 	PresShell::Paint 	layout/base/nsPresShell.cpp:6112
10 	user32.dll 	IsWindow 	
11 	xul.dll 	nsViewManager::Refresh 	view/src/nsViewManager.cpp:413
12 	xul.dll 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:912
13 		@0x2c4c82b 	
14 	xul.dll 	nsTArray_base<nsTArrayDefaultAllocator>::ShiftData 	obj-firefox/dist/include/nsTArray-inl.h:179
15 	xul.dll 	nsPresContext::Release 	layout/base/nsPresContext.cpp:335
16 	xul.dll 	nsEventStateManager::PostHandleEvent 	content/events/src/nsEventStateManager.cpp:3302
17 		@0x8071c7 	
18 	xul.dll 	nsWindow::DealWithPopups 	widget/src/windows/nsWindow.cpp:8269
19 	ntdll.dll 	KiUserCallbackDispatcher 	
20 	xul.dll 	nsWindow::DealWithPopups 	widget/src/windows/nsWindow.cpp:8269
21 	user32.dll 	InflateRect 	
22 	user32.dll 	NtUserCallHwndLock 	
23 	user32.dll 	UpdateWindow 	
24 	xul.dll 	nsWindow::WindowProcInternal 	widget/src/windows/nsWindow.cpp:4399
25 	xul.dll 	nsWindow::WindowProc 	widget/src/windows/nsWindow.cpp:4351
26 	user32.dll 	InternalCallWinProc 	
27 	user32.dll 	UserCallWinProcCheckWow 	
28 	user32.dll 	DispatchMessageWorker 	
29 	user32.dll 	DispatchMessageW 	
30 	xul.dll 	nsBaseAppShell::OnProcessNextEvent 	widget/src/xpwidgets/nsBaseAppShell.cpp:303
31 	xul.dll 	nsTArray_base<nsTArrayDefaultAllocator>::ShiftData 	obj-firefox/dist/include/nsTArray-inl.h:169
32 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
33 	xul.dll 	xul.dll@0xb15e77 	

More reports at:
http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=nsRefPtr%3CnsPluginArray%3E%3A%3Aassign_assuming_AddRef%28nsPluginArray*%29%20|%20nsRefPtr%3CnsAccessible%3E%3A%3AStartAssignment%28%29%20|%20mozilla%3A%3Alayers%3A%3ADeviceManagerD3D9%3A%3ACreateVertexBuffer%28%29

Comment 1

[Scoobidiver (away)]

It is #11 top crasher in today's build.

Comment 2

[Bas Schouten (:bas.schouten)]

Attachment: Null autoptr instead of release

A very silly coding mistake on my part. Thanks for bringing this to my attention, this should block beta8 release!

Comment 3

[Joe Drew (not getting mail)]

Yeah, this does block beta 8.

Comment 4

[Bas Schouten (:bas.schouten)]

http://hg.mozilla.org/mozilla-central/rev/714c80b45cbc

Comment 5

[[e-mail]]

We used to have a type called an nsDerivedSafe<T> that protected against you doing that, but bsmedberg removed it in changeset 2cdac4c2a023.