819745 - crash in mozilla::dom::CallbackFunction::CallbackFunction

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Scoobidiver (away)]

It first showed up in 20.0a1/20121208 and is currently #5 top crasher in this build. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=739f20de3c1e&tochange=b7fab17d30b7
The suspected culprits are bug 816376 and bug 818219.

Signature 	mozilla::dom::CallbackFunction::CallbackFunction(mozilla::dom::CallbackFunction*) More Reports Search
UUID	f9807224-7fd3-442b-8f8e-4f6262121209
Date Processed	2012-12-09 06:24:39
Uptime	23
Last Crash	41 seconds before submission
Install Age	12.0 hours since version was first installed.
Install Time	2012-12-08 18:22:26
Product	Firefox
Version	20.0a1
Build ID	20121208030937
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 15 stepping 13
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x8
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x2a42, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.15.10.2302
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True
Adapter Vendor ID	0x8086
Adapter Device ID	0x2a42
Total Virtual Memory	4294836224
Available Virtual Memory	3739635712
System Memory Use Percentage	35
Available Page File	6708097024
Available Physical Memory	2650066944

Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::dom::CallbackFunction::CallbackFunction 	obj-firefox/dist/include/mozilla/dom/CallbackFunction.h:97
1 	xul.dll 	mozilla::dom::OnErrorEventHandlerNonNull::OnErrorEventHandlerNonNull 	obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:134
2 	xul.dll 	nsGenericHTMLElement::SetOnerror 	obj-firefox/dist/include/nsEventNameList.h:395
3 	xul.dll 	mozilla::dom::HTMLElementBinding::set_onerror 	obj-firefox/dom/bindings/HTMLElementBinding.cpp:1921
4 	xul.dll 	mozilla::dom::HTMLElementBinding::genericSetter 	obj-firefox/dom/bindings/HTMLElementBinding.cpp:4842
5 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:369
6 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:417
7 	mozjs.dll 	js::Shape::set 	js/src/jsscopeinlines.h:313
8 	mozjs.dll 	js::baseops::SetPropertyHelper 	js/src/jsobj.cpp:4584
9 	mozjs.dll 	js::types::TypeObject::markUnknown 	js/src/jsinfer.cpp:3459
10 		@0x36beb7 	
11 		@0xffffff85 	
12 	nspr4.dll 	PR_ExitMonitor 	nsprpub/pr/src/threads/prmon.c:100
13 	xul.dll 	nsBlockFrame::DoReflowInlineFrames 	layout/generic/nsBlockFrame.cpp:3521
14 	xul.dll 	NS_EscapeURL 	xpcom/io/nsEscape.cpp:444

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Adom%3A%3ACallbackFunction%3A%3ACallbackFunction%28mozilla%3A%3Adom%3A%3ACallbackFunction*%29

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Correctly handle body.onerror = null.

Comment 2

[Chris Peterson [:cpeterson]]

I hit this crash when running the "cross_fuzz" fuzzer test.

Comment 3

[Boris Zbarsky [:bzbarsky]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/8233f3cfd7e8

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/8233f3cfd7e8