830275 - crash in mozilla::dom::HTMLTableElementBinding::set_tHead

Status: RESOLVED DUPLICATE of bug 828180

(Core :: DOM: Core & HTML, defect)

Description

[Scoobidiver (away)]

It's #1 top browser crasher on Mac OS X in 20.0a2. It first showed up in 21.0a1/20130108 and 20.0a2/20130111. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=605ae260b7c8&tochange=5bb309998e70

Signature 	mozilla::dom::HTMLTableElementBinding::set_tHead More Reports Search
UUID	4873a907-f2d9-4309-a381-20b522130111
Date Processed	2013-01-11 19:06:31
Uptime	3307
Install Age	3.9 hours since version was first installed.
Install Time	2013-01-11 09:56:32
Product	Firefox
Version	21.0a1
Build ID	20130110030939
Release Channel	nightly
OS	Mac OS X
OS Version	10.8.2 12C2034
Build Architecture	amd64
Build Architecture Info	family 6 model 58 stepping 9
Crash Reason	EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash Address	0x18
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x 166GL Context? GL Context+ GL Layers? GL Layers+ 

Processor Notes 	/data/socorro/stackwalk/bin/exploitable: ERROR: unable to analyze dump
EMCheckCompatibility	True

Frame 	Module 	Signature 	Source
0 	XUL 	mozilla::dom::HTMLTableElementBinding::set_tHead 	dist/include/nsCOMPtr.h:764
1 	XUL 	mozilla::dom::HTMLTableElementBinding::genericSetter 	HTMLTableElementBinding.cpp:989
2 	XUL 	js::InvokeKernel 	jscntxtinlines.h:373
3 	XUL 	js::Invoke 	jsinterp.h:112
4 	XUL 	js::InvokeGetterOrSetter 	jsinterp.cpp:512
5 	XUL 	js::Shape::set 	jsscopeinlines.h:315
6 	XUL 	js::baseops::SetPropertyHelper 	jsobj.cpp:3686
7 	XUL 	js::Interpret 	jsobjinlines.h:97
8 	XUL 	js::RunScript 	jsinterp.cpp:348
9 	XUL 	js::InvokeKernel 	jsinterp.cpp:406
10 	XUL 	js::Invoke 	jsinterp.h:112
11 	XUL 	JS_CallFunctionValue 	jsapi.cpp:5806
12 	XUL 	nsXPCWrappedJSClass::CallMethod 	XPCWrappedJSClass.cpp:1432
13 	XUL 	nsXPCWrappedJS::CallMethod 	XPCWrappedJS.cpp:580
14 	XUL 	PrepareAndDispatch 	xptcstubs_x86_64_darwin.cpp:122
15 	XUL 	SharedStub 	
16 	XUL 	xptiInterfaceEntry::GetEntryForParam 	xptiInterfaceInfo.cpp:292
17 	XUL 	nsEventListenerManager::HandleEventInternal 	nsEventListenerManager.cpp:922
18 	XUL 	nsEventTargetChainItem::HandleEvent 	nsEventListenerManager.h:278
19 	XUL 	nsEventTargetChainItem::HandleEventTargetChain 	nsEventDispatcher.cpp:310
20 	XUL 	nsEventDispatcher::Dispatch 	nsEventDispatcher.cpp:678
21 	XUL 	nsDocumentViewer::PageHide 	nsDocumentViewer.cpp:1297
22 	XUL 	nsDocShell::FirePageHideNotification 	nsDocShell.cpp:1633
23 	XUL 	nsDocShell::CreateContentViewer 	nsDocShell.cpp:7791
24 	XUL 	nsDSURIContentListener::DoContent 	nsDSURIContentListener.cpp:122
25 	XUL 	nsDocumentOpenInfo::TryContentListener 	nsURILoader.cpp:658
26 	XUL 	nsDocumentOpenInfo::DispatchContent 	nsURILoader.cpp:360
27 	XUL 	nsDocumentOpenInfo::OnStartRequest 	nsURILoader.cpp:252
28 	XUL 	mozilla::net::nsHttpChannel::CallOnStartRequest 	nsHttpChannel.cpp:960
29 	XUL 	mozilla::net::nsHttpChannel::ContinueProcessNormal 	nsHttpChannel.cpp:1456
30 	XUL 	mozilla::net::nsHttpChannel::ProcessNormal 	nsHttpChannel.cpp:1391
31 	XUL 	mozilla::net::nsHttpChannel::ProcessResponse 	nsHttpChannel.cpp:1304
32 	XUL 	mozilla::net::nsHttpChannel::OnStartRequest 	nsHttpChannel.cpp:4864
33 	XUL 	nsInputStreamPump::OnStateStart 	nsInputStreamPump.cpp:417
34 	XUL 	nsInputStreamPump::OnInputStreamReady 	nsInputStreamPump.cpp:368
35 	XUL 	nsInputStreamReadyEvent::Run 	nsStreamUtils.cpp:82
36 	XUL 	nsThread::ProcessNextEvent 	nsThread.cpp:627
37 	XUL 	NS_ProcessPendingEvents_P 	nsThreadUtils.cpp:188
38 	XUL 	nsBaseAppShell::NativeEventCallback 	nsBaseAppShell.cpp:97
39 	XUL 	nsAppShell::ProcessGeckoEvents 	nsAppShell.mm:387 
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Adom%3A%3AHTMLTableElementBinding%3A%3Aset_tHead

Comment 1

[Peter Van der Beken [:peterv]]

And this is not a dupe of bug 828180?

Comment 2

[Scoobidiver (away)]

(In reply to Peter Van der Beken [:peterv] from comment #1)
> And this is not a dupe of bug 828180?
It seems so according to the stack trace and the fact there are no crashes after 21.0a1/20130110.