760769 - crash in nsGenericElement::UnbindFromTree @ nsINode::SubtreeRoot

Status: RESOLVED DUPLICATE of bug 736695

(Core :: DOM: Core & HTML, defect)

Description

[Scoobidiver (away)]

It first appeared in 15.0a1/20120601 and is #7 top crasher in the trunk. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3aa566994890&tochange=73783bf75c4c

One comment says: "After clicking the option to customize the UI the browser crashes."

Although their regression windows differ, it seems to be the 64-bit version of bug 736695.

Signature 	nsINode::SubtreeRoot() More Reports Search
UUID	c5e45685-cb8a-415b-a834-84f342120601
Date Processed	2012-06-01 20:49:34
Uptime	11
Last Crash	26 seconds before submission
Install Age	39 seconds since version was first installed.
Install Time	2012-06-01 20:47:42
Product	Firefox
Version	15.0a1
Build ID	20120601030520
Release Channel	nightly
OS	Windows NT
OS Version	6.2.8400
Build Architecture	amd64
Build Architecture Info	family 6 model 23 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x2c
User Comments	After clicking the option to customize the UI the browser crashes.
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x05e2, AdapterSubsysID: 058510de, AdapterDriverVersion: 9.18.12.9665
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True	
Total Virtual Memory	8796092891136
Available Virtual Memory	8795546488832
System Memory Use Percentage	57
Available Page File	4697726976
Available Physical Memory	1827590144

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsINode::SubtreeRoot 	obj-firefox/dist/include/nsINode.h:744
1 	xul.dll 	nsGenericElement::UnbindFromTree 	content/base/src/nsGenericElement.cpp:3255
2 	xul.dll 	nsINode::DeleteProperty 	content/base/src/nsGenericElement.cpp:208
3 	xul.dll 	nsGenericElement::UnbindFromTree 	content/base/src/nsGenericElement.cpp:3305
4 	xul.dll 	nsRefPtr<nsPresContext>::~nsRefPtr<nsPresContext> 	obj-firefox/xpcom/build/nsCOMPtr.cpp:48
5 	xul.dll 	nsGenericElement::RemoveChildAt 	content/base/src/nsGenericElement.cpp:3803
6 	xul.dll 	nsXULElement::RemoveChildAt 	content/xul/content/src/nsXULElement.cpp:941
7 	xul.dll 	nsNodeUtils::AttributeChanged 	content/base/src/nsNodeUtils.cpp:108
8 	xul.dll 	nsINode::ReplaceOrInsertBefore 	content/base/src/nsGenericElement.cpp:4218
9 	xul.dll 	NS_NewAtom 	xpcom/ds/nsAtomTable.cpp:647
10 	xul.dll 	JSContext::resetCompartment 	js/src/jscntxt.cpp:1037
11 	xul.dll 	nsElementSH::PreCreate 	dom/base/nsDOMClassInfo.cpp:7929
12 	xul.dll 	nsAttrValue::ParseAtom 	content/base/src/nsAttrValue.cpp:1100
13 	xul.dll 	nsNodeUtils::AttributeWillChange 	content/base/src/nsNodeUtils.cpp:97
14 	xul.dll 	XPCCallContext::XPCCallContext 	js/xpconnect/src/XPCCallContext.cpp:33
15 	xul.dll 	SearchTable 	obj-firefox/xpcom/build/pldhash.cpp:400
16 	xul.dll 	XPCCallContext::XPCCallContext 	js/xpconnect/src/XPCCallContext.cpp:33
17 	xul.dll 	nsElementSH::PreCreate 	dom/base/nsDOMClassInfo.cpp:7954
18 	xul.dll 	castNativeFromWrapper 	js/xpconnect/src/XPCQuickStubs.h:427
19 	xul.dll 	XPCCallContext::~XPCCallContext 	js/xpconnect/src/XPCCallContext.cpp:349
20 	xul.dll 	xpc::WrapperFactory::PrepareForWrapping 	js/xpconnect/wrappers/WrapperFactory.cpp:260
21 	xul.dll 	castNativeArgFromWrapper 	js/xpconnect/src/XPCQuickStubs.h:519
22 	xul.dll 	nsINode::ReplaceOrInsertBefore 	obj-firefox/dist/include/nsINode.h:1438
23 	xul.dll 	nsINode::ReplaceChild 	obj-firefox/dist/include/nsINode.h:481
24 	xul.dll 	nsIDOMNode_ReplaceChild 	obj-firefox/js/xpconnect/src/dom_quickstubs.cpp:5421
25 	xul.dll 	XBLResolve 	content/xbl/src/nsXBLBinding.cpp:110
26 	xul.dll 	CallResolveOp 	js/src/jsobj.cpp:4625
27 	xul.dll 	xul.dll@0x19e16f 	
28 	xul.dll 	js::ObjectImpl::nativeLookup 	js/src/vm/ObjectImpl.cpp:265
29 	xul.dll 	JSObject::getGeneric 	js/src/jsobjinlines.h:162
30 	xul.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:310
31 	xul.dll 	JSCompartment::wrap 	js/src/jscompartment.cpp:196
32 	xul.dll 	js::Invoke 	js/src/jsinterp.cpp:358
33 	xul.dll 	js::AutoCompartment::leave 	js/src/jswrapper.cpp:401
34 	xul.dll 	proxy_GetGeneric 	js/src/jsproxy.cpp:1303
35 	xul.dll 	js::Wrapper::call 	js/src/jswrapper.cpp:214
36 	xul.dll 	js::CrossCompartmentWrapper::call 	js/src/jswrapper.cpp:650
37 	xul.dll 	js::detail::HashTable<js::HashMapEntry<JSAtom*,js::DefnOrHeader>,js::HashMap<JSA 	obj-firefox/dist/include/js/HashTable.h:483
38 	xul.dll 	proxy_Call 	js/src/jsproxy.cpp:1647
39 	xul.dll 	JSObject::setGeneric 	js/src/jsobjinlines.h:93
40 	xul.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:303
41 	xul.dll 	js::Interpret 	js/src/jsinterp.cpp:2512

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsINode%3A%3ASubtreeRoot%28%29

Comment 1

[Boris Zbarsky [:bzbarsky]]

Isn't this a duplicate of bug 736695?  Certainly the steps to reproduce in that bug have always crashed for me with this stack.

Comment 2

[Scoobidiver (away)]

(In reply to Boris Zbarsky (:bz) from comment #1)
> Isn't this a duplicate of bug 736695?  Certainly the steps to reproduce in
> that bug have always crashed for me with this stack.
Why are 64-bit builds affected now?