766624 - crash dereferencing null wrapper with <video></video> [@ nsXPConnectParticipant::TraverseImpl ] [@ WrapperIsNotMainThreadOnly ] [@ GetProto ]

Status: RESOLVED DUPLICATE of bug 752764

(Core :: XPConnect, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Steps to reproduce:
 1. load http://software.hixie.ch/utilities/js/live-dom-viewer/
 2. click in the top text field
 3. delete the "..."
 4. type "<video></video>" in its place
 5. close the window and wait a bit, or exit the browser

Actual results:
 crash during cycle collection

Expected results:
 no crash

Reproduced in today's Linux 64 mozilla-central nightly:
https://crash-stats.mozilla.com/report/index/15b4d3d3-0ba1-4e92-944d-311912120620

and in a debug build from within the past few days:

#4  <signal handler called>
#5  GetProto (this=0x0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/xpconnect/src/nsXPConnect.cpp:2910
#6  WrapperIsNotMainThreadOnly (wrapper=0x0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/xpconnect/src/nsXPConnect.cpp:748
#7  nsXPConnect::Traverse (this=0x7ff44425e490, p=0x7ff42ae1bcd0, cb=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/js/xpconnect/src/nsXPConnect.cpp:784
#8  0x00007ff458949f2a in GCGraphBuilder::Traverse (this=<optimized out>, 
    aPtrInfo=0x3282fa8)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/base/nsCycleCollector.cpp:1743
#9  0x00007ff45894c4ec in nsCycleCollector::MarkRoots (this=0x7ff4440218a0, 
    builder=...)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/base/nsCycleCollector.cpp:2054
#10 0x00007ff45894fb0f in nsCycleCollector::BeginCollection (
    this=0x7ff4440218a0, aListener=0x0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/base/nsCycleCollector.cpp:2758
#11 0x00007ff45894fedb in BeginCollection (aListener=0x0, this=0x7ff4440218a0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/base/nsCycleCollector.cpp:2716
#12 nsCycleCollector::Collect (this=0x7ff4440218a0, aResults=<optimized out>, 
    aTryCollections=5, aListener=0x0)
    at /home/dbaron/builds/ssd/mozilla-central/mozilla/xpcom/base/nsCycleCollector.cpp:2700

Comment 1

[Andrew McCreight [:mccr8]]

could be a dupe of bug 752764

Comment 2

[Andrew McCreight [:mccr8]]

Looks like it is fixed by my patch in bug 752764, so I'm calling this a dupe.  Interesting to see that it is something that happens in the wild, though!

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Yep, I typed this into live-dom-viewer this morning to figure out what happened to the contents of a video element, and crashed my main browser session.