869825 - crash in mozilla::dom::ReparentWrapper

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Scoobidiver (away)]

It first showed up in 23.0a1/20130506. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=c8e47b184aba&tochange=b109e2dbf03b
It's likely a regression from bug 855971.

There are two kinds of stack trace:
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::dom::ReparentWrapper 	dom/bindings/BindingUtils.cpp:1453
1 	xul.dll 	nsHTMLDocument::Open 	content/html/document/src/nsHTMLDocument.cpp:1686
2 	xul.dll 	mozilla::dom::HTMLDocumentBinding::open 	obj-firefox/dom/bindings/HTMLDocumentBinding.cpp:525
3 	xul.dll 	mozilla::dom::HTMLDocumentBinding::genericMethod 	obj-firefox/dom/bindings/HTMLDocumentBinding.cpp:1559
4 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:428
5 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:475
6 	mozjs.dll 	js::CrossCompartmentWrapper::call 	js/src/jswrapper.cpp:445
...

Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::dom::ReparentWrapper 	dom/bindings/BindingUtils.cpp:1453
1 	xul.dll 	nsHTMLDocument::Open 	content/html/document/src/nsHTMLDocument.cpp:1686
2 	xul.dll 	nsHTMLDocument::Open 	content/html/document/src/nsHTMLDocument.cpp:1427
3 	xul.dll 	nsHTMLDocument::WriteCommon 	content/html/document/src/nsHTMLDocument.cpp:1905
4 	xul.dll 	nsHTMLDocument::WriteCommon 	content/html/document/src/nsHTMLDocument.cpp:1839
5 	xul.dll 	mozilla::dom::HTMLDocumentBinding::write 	obj-firefox/dom/bindings/HTMLDocumentBinding.cpp:657
6 	xul.dll 	mozilla::dom::HTMLDocumentBinding::genericMethod 	obj-firefox/dom/bindings/HTMLDocumentBinding.cpp:1559
7 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:428
8 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:475
9 	mozjs.dll 	js::CrossCompartmentWrapper::call 	js/src/jswrapper.cpp:445
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Adom%3A%3AReparentWrapper%28JSContext*%2C+JS%3A%3AHandle%3CJSObject*%3E%29

Comment 1

[Boris Zbarsky [:bzbarsky]]

Looks like we're ending up with a null domClass.

Is it possible that this is document.open() on an ImageDocument?  If so, the crash should go away now that bug 868929 is fixed...

Comment 2

[Robert Kaiser]

(In reply to Boris Zbarsky (:bz) from comment #1)
> Looks like we're ending up with a null domClass.
> 
> Is it possible that this is document.open() on an ImageDocument?  If so, the
> crash should go away now that bug 868929 is fixed...

Might be true, no crashes in builds from the 8th or 9th so far (that patch landed on m-c- on the 7th).

Comment 3

[Scoobidiver (away)]

(In reply to Boris Zbarsky (:bz) from comment #1)
> Is it possible that this is document.open() on an ImageDocument?  If so, the
> crash should go away now that bug 868929 is fixed...
Confirmed after more days of monitoring.

Comment 4

[Bogdan Maris, Desktop QA]

There are crashes in last 4 weeks with this signature:
[@ mozilla::dom::ReparentWrapper(JSContext*, JS::Handle<JSObject*>)]
Based on the crash report from Socorro I think is safe to say that this is verified.

https://crash-stats.mozilla.com/query/query?product=Firefox&version=ALL%3AALL&platform=windows&range_value=4&range_unit=weeks&date=06%2F26%2F2013+16%3A56%3A06&query_search=signature&query_type=contains&query=mozilla%3A%3Adom%3A%3AReparentWrapper%28JSContext*%2C+JS%3A%3AHandle%3CJSObject*%3E%29&reason=&build_id=&process_type=any&hang_type=any&do_query=1