940751 - B2G crash in nsINode::GetProperty(nsIAtom*, unsigned int*) const

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-8b1e6d68-9431-4a2f-a4f4-353472131115.
=============================================================
Crashing Thread
Frame 	Module 	Signature 	Source
0 	libxul.so 	nsINode::GetProperty(nsIAtom*, unsigned int*) const 	/builds/slave/b2g_m-cen_hamachi_ntly-0000000/build/objdir-gecko/layout/base/../../dist/include/nsINode.h
1 	libxul.so 	nsLayoutUtils::FindIDFor(nsIContent const*, unsigned long long*) 	layout/base/nsLayoutUtils.cpp
2 	libxul.so 	mozilla::widget::APZCCallbackHelper::GetScrollIdentifiers(nsIContent const*, unsigned int*, unsigned long long*) 	widget/xpwidgets/APZCCallbackHelper.cpp
3 	libxul.so 	mozilla::dom::TabChild::HandlePossibleViewportChange() 	dom/ipc/TabChild.cpp
4 	libxul.so 	mozilla::dom::TabChild::RecvUpdateDimensions(nsRect const&, nsIntSize const&, unsigned int const&) 	dom/ipc/TabChild.cpp
5 	libxul.so 	mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) 	/builds/slave/b2g_m-cen_hamachi_ntly-0000000/build/objdir-gecko/ipc/ipdl/PBrowserChild.cpp
6 	libxul.so 	mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) 	/builds/slave/b2g_m-cen_hamachi_ntly-0000000/build/objdir-gecko/ipc/ipdl/PContentChild.cpp
7 	libxul.so 	mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
8 	libxul.so 	mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
9 	libxul.so 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	ipc/glue/MessageChannel.cpp
10 	libxul.so 	RunnableMethod<WebCore::ReverbConvolver, void (WebCore::ReverbConvolver::*)(), Tuple0>::Run() 	ipc/chromium/src/base/tuple.h
11 	libxul.so 	mozilla::ipc::MessageChannel::DequeueTask::Run() 	/builds/slave/b2g_m-cen_hamachi_ntly-0000000/build/objdir-gecko/ipc/glue/../../dist/include/mozilla/ipc/MessageChannel.h
12 	libxul.so 	MessageLoop::RunTask(Task*) 	ipc/chromium/src/base/message_loop.cc
13 	libxul.so 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) 	ipc/chromium/src/base/message_loop.cc
14 	libxul.so 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
15 	libxul.so 	mozilla::ipc::DoWorkRunnable::Run() 	ipc/glue/MessagePump.cpp
16 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
17 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
18 	libxul.so 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
19 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
20 	libxul.so 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc
21 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
22 	libxul.so 	nsBaseAppShell::Run() 	widget/xpwidgets/nsBaseAppShell.cpp
23 	libxul.so 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp
24 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
25 	libxul.so 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc
26 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
27 	libxul.so 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp
28 	plugin-container 	main 	ipc/app/MozillaRuntimeMain.cpp
29 	libc.so 	__libc_init 	bionic/libc/bionic/libc_init_dynamic.c
30 		@0xb00045a9 	

More Crashes : 
https://crash-stats.mozilla.com/report/list?product=B2G&signature=nsINode%3A%3AGetProperty%28nsIAtom*%2C+unsigned+int*%29+const

Comment 1

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

URLs :  	
http://www.google.com/search?q=%E6%9B%B4%E5%A5%BD%20%E6%89%8B%E6%A9%9F 
https://0.facebook.com/?_rdr
http://gmail.com/ 
http://movistar.pe/
http://www.google.com/search?q=test 
http://google.at/
http://bahn.de/
http://www.google.com/search?q=facebook%20caida
http://bumeran.com.pe/
http://www.google.com/search?q=goigke

Comment 2

[Timothy Nikkel (:tnikkel)]

Maybe something recent caused this.

Comment 3

[Kartikaya Gupta (email:[e-mail])]

Likely that the document element is null at [1]. This is probably a regression from cset ad35a39b48a6 (bug 937688).

[1] http://hg.mozilla.org/mozilla-central/annotate/b2fab608772f/dom/ipc/TabChild.cpp#l542

Comment 4

[Kartikaya Gupta (email:[e-mail])]

Attachment: Patch

Comment 5

[Kartikaya Gupta (email:[e-mail])]

https://hg.mozilla.org/integration/b2g-inbound/rev/b9889f5c0844

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/b9889f5c0844

Comment 7

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

No crashes occuring past 11/20 builds : 20131120062258

I can't seem to duplicate the crash in the current build.
Doesn't occur in 1.2 from the crash reports.