636164 - Crash [@ EditTxn::QueryInterface(nsID const&, void**) ]

Status: RESOLVED DUPLICATE of bug 636074

(Core :: DOM: Editor, defect)

Description

[Scoobidiver (away)]

It is a new crash signature that first appeared in 4.0b12pre/20110221.
It is #3 top crasher in 4.0b12pre/20110222 on 64-bit Windows.

Signature	EditTxn::QueryInterface(nsID const&, void**)
UUID	d6be4cf2-23c7-481b-8d20-b4fd52110223
Time 	2011-02-23 01:52:48.865477
Uptime	2017
Last Crash	2020 seconds (33.7 minutes) before submission
Install Age	30211 seconds (8.4 hours) since version was first installed.
Product	Firefox
Version	4.0b12pre
Build ID	20110222030201
Branch	2.0
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
CPU	amd64
CPU Info	family 6 model 37 stepping 5
Crash Reason	EXCEPTION_ACCESS_VIOLATION_WRITE
Crash Address	0xf
App Notes 	AdapterVendorID: 1002, AdapterDeviceID: 68c1, AdapterDriverVersion: 8.771.1.0

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	EditTxn::QueryInterface 	editor/libeditor/base/EditTxn.cpp:47
1 	xul.dll 	nsEditor::CreateTxnForDeleteInsertionPoint 	editor/libeditor/base/nsEditor.cpp:4829
2 	xul.dll 	nsRange::GetCollapsed 	content/base/src/nsRange.cpp:570
3 	xul.dll 	nsEditor::CreateTxnForDeleteSelection 	
4 	xul.dll 	nsEditor::DeleteSelectionImpl 	editor/libeditor/base/nsEditor.cpp:4280
5 	xul.dll 	nsAutoTrackDOMPoint::nsAutoTrackDOMPoint 	editor/libeditor/base/nsSelectionState.h:159
6 	xul.dll 	nsHTMLEditRules::WillDeleteSelection 	editor/libeditor/html/nsHTMLEditRules.cpp:2374
7 	xul.dll 	AbortIfOffMainThreadIfCheckFast 	xpcom/base/nsCycleCollector.cpp:1194
8 	xul.dll 	NS_IsMainThread_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:138
9 	xul.dll 	nsRuleNode::ComputeMarginData 	layout/style/nsRuleNode.cpp:4885
10 	xul.dll 	AbortIfOffMainThreadIfCheckFast 	xpcom/base/nsCycleCollector.cpp:1194
11 	xul.dll 	nsCycleCollectingAutoRefCnt::decr 	obj-firefox/dist/include/nsISupportsImpl.h:211
12 	xul.dll 	nsGenericElement::Release 	content/base/src/nsGenericElement.cpp:4503
13 	xul.dll 	AbortIfOffMainThreadIfCheckFast 	xpcom/base/nsCycleCollector.cpp:1194
14 	xul.dll 	nsIAtom::Equals 	obj-firefox/dist/include/nsIAtom.h:60
15 	xul.dll 	NS_IsMainThread_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:138
16 	xul.dll 	NS_IsMainThread_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:138
17 	xul.dll 	AbortIfOffMainThreadIfCheckFast 	xpcom/base/nsCycleCollector.cpp:1194
18 	xul.dll 	nsGenericElement::QueryInterface 	content/base/src/nsGenericElement.cpp:4498
19 	xul.dll 	nsHTMLEditRules::WillDoAction 	editor/libeditor/html/nsHTMLEditRules.cpp:673
20 	xul.dll 	nsEditor::GetSelection 	editor/libeditor/base/nsEditor.cpp:577
21 	xul.dll 	nsPlaintextEditor::DeleteSelection 	editor/libeditor/text/nsPlaintextEditor.cpp:784
22 	xul.dll 	AbortIfOffMainThreadIfCheckFast 	xpcom/base/nsCycleCollector.cpp:1194
23 	xul.dll 	nsDOMEvent::Release 	content/events/src/nsDOMEvent.cpp:190
24 	xul.dll 	nsEditor::GetNativeKeyEvent 	editor/libeditor/base/nsEditor.cpp:5325
25 	xul.dll 	nsEditor::HandleKeyPressEvent 	editor/libeditor/base/nsEditor.cpp:5104
26 	xul.dll 	nsHTMLEditor::HandleKeyPressEvent 	editor/libeditor/html/nsHTMLEditor.cpp:674
27 	xul.dll 	nsCycleCollectingAutoRefCnt::incr 	obj-firefox/dist/include/nsISupportsImpl.h:161
28 	xul.dll 	nsRefPtr<mozilla::dom::Element>::~nsRefPtr<mozilla::dom::Element> 	obj-firefox/dist/include/nsAutoPtr.h:969
29 	xul.dll 	nsDOMEvent::QueryInterface 	content/events/src/nsDOMEvent.cpp:187
30 	xul.dll 	nsDOMEventRTTearoff::LastRelease 	content/base/src/nsGenericElement.cpp:1987
31 	xul.dll 	nsDOMUIEvent::QueryInterface 	content/events/src/nsDOMUIEvent.cpp:126
32 	xul.dll 	nsDOMEventRTTearoff::Release 	content/base/src/nsGenericElement.cpp:1936
33 	xul.dll 	nsDOMKeyboardEvent::QueryInterface 	content/events/src/nsDOMKeyboardEvent.cpp:75
34 	xul.dll 	nsCOMPtr_base::assign_from_qi 	obj-firefox/xpcom/build/nsCOMPtr.cpp:98
35 	xul.dll 	nsCOMPtr<nsIDOMKeyEvent>::nsCOMPtr<nsIDOMKeyEvent> 	obj-firefox/dist/include/nsCOMPtr.h:595
36 	xul.dll 	nsEditorEventListener::KeyPress 	editor/libeditor/base/nsEditorEventListener.cpp:362
37 	xul.dll 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:1219
38 	xul.dll 	NS_IsMainThread_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:138
39 	xul.dll 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:364
40 	xul.dll 	nsGenericElement::Release 	content/base/src/nsGenericElement.cpp:4503
41 	xul.dll 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:395
42 	xul.dll 	nsCycleCollectingAutoRefCnt::incr 	obj-firefox/dist/include/nsISupportsImpl.h:161
43 	xul.dll 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:628

The regression window could be:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3017b3459639&tochange=338a48d9f603

More reports at:
https://crash-stats.mozilla.com/report/list?product=Firefox&range_value=4&range_unit=weeks&signature=EditTxn%3A%3AQueryInterface%28nsID%20const%26%2C%20void**%29

Comment 1

[(no longer active)]

This could have been fixed with bug 636074.  Need to watch over it in the next few days.

Comment 2

[(no longer active)]

The last crash with this signature is on this build: 20110223030201.  Therefore I'm marking this as a dupe of bug 636074.