Closed Bug 766624 Opened 8 years ago Closed 8 years ago

crash dereferencing null wrapper with <video></video> [@ nsXPConnectParticipant::TraverseImpl ] [@ WrapperIsNotMainThreadOnly ] [@ GetProto ]

Categories

(Core :: XPConnect, defect)

x86_64
Linux
defect
Not set

Tracking

()

RESOLVED DUPLICATE of bug 752764

People

(Reporter: dbaron, Assigned: mccr8)

References

()

Details

(Keywords: crash)

Steps to reproduce:
 1. load http://software.hixie.ch/utilities/js/live-dom-viewer/
 2. click in the top text field
 3. delete the "..."
 4. type "<video></video>" in its place
 5. close the window and wait a bit, or exit the browser

Actual results:
 crash during cycle collection

Expected results:
 no crash

Reproduced in today's Linux 64 mozilla-central nightly:
https://crash-stats.mozilla.com/report/index/15b4d3d3-0ba1-4e92-944d-311912120620

and in a debug build from within the past few days:

#4  <signal handler called>
#5  GetProto (this=0x0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/xpconnect/src/nsXPConnect.cpp:2910
#6  WrapperIsNotMainThreadOnly (wrapper=0x0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/xpconnect/src/nsXPConnect.cpp:748
#7  nsXPConnect::Traverse (this=0x7ff44425e490, p=0x7ff42ae1bcd0, cb=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/xpconnect/src/nsXPConnect.cpp:784
#8  0x00007ff458949f2a in GCGraphBuilder::Traverse (this=<optimized out>, 
    aPtrInfo=0x3282fa8)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/base/nsCycleCollector.cpp:1743
#9  0x00007ff45894c4ec in nsCycleCollector::MarkRoots (this=0x7ff4440218a0, 
    builder=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/base/nsCycleCollector.cpp:2054
#10 0x00007ff45894fb0f in nsCycleCollector::BeginCollection (
    this=0x7ff4440218a0, aListener=0x0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/base/nsCycleCollector.cpp:2758
#11 0x00007ff45894fedb in BeginCollection (aListener=0x0, this=0x7ff4440218a0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/base/nsCycleCollector.cpp:2716
#12 nsCycleCollector::Collect (this=0x7ff4440218a0, aResults=<optimized out>, 
    aTryCollections=5, aListener=0x0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/base/nsCycleCollector.cpp:2700
Assignee: nobody → continuation
Group: core-security
could be a dupe of bug 752764
Looks like it is fixed by my patch in bug 752764, so I'm calling this a dupe.  Interesting to see that it is something that happens in the wild, though!
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 752764
Yep, I typed this into live-dom-viewer this morning to figure out what happened to the contents of a video element, and crashed my main browser session.
Group: core-security
You need to log in before you can comment on or make changes to this bug.