Closed Bug 1213270 Opened 9 years ago Closed 9 years ago

crash in nsRefPtr<T>::assign_with_AddRef(mozilla::dom::VideoTrack*) | nsMutationReceiver::NativeAnonymousChildListChange(nsIDocument*, nsIContent*, bool)

Categories

(Firefox :: General, defect)

Product:
Firefox
Component:
General
Platform:
Unspecified
Windows 7
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1218195
Tracking Flags:
Tracking Status
firefox44 --- affected

People

(Reporter: sebo, Unassigned)

References

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is report bp-1b0e1bc3-3dc2-4653-875a-c8a4a2151009. ============================================================= Not sure whether that's actually related, but this crash happened multiple times after editing the HTML within the DevTools. My steps: 1. Inspected an element 2. Right-clicked it and chose 'Edit as HTML' 3. Added '<div></div>' as last child of the element 4. Hit Ctrl+Enter to save the changes Sebastian
Crash Signature: [@ nsRefPtr<T>::assign_with_AddRef(mozilla::dom::VideoTrack*) | nsMutationReceiver::NativeAnonymousChildListChange(nsIDocument*, nsIContent*, bool)] → [@ nsRefPtr<T>::assign_with_AddRef(mozilla::dom::VideoTrack*) | nsMutationReceiver::NativeAnonymousChildListChange(nsIDocument*, nsIContent*, bool)] [@ nsRefPtr<T>::assign_with_AddRef | nsMutationReceiver::NativeAnonymousChildListChange]
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → DUPLICATE
(In reply to Sebastian Zartner [:sebo] from comment #0) > This bug was filed from the Socorro interface and is > report bp-1b0e1bc3-3dc2-4653-875a-c8a4a2151009. > ============================================================= > > Not sure whether that's actually related, but this crash happened multiple > times after editing the HTML within the DevTools. My steps: > 1. Inspected an element > 2. Right-clicked it and chose 'Edit as HTML' > 3. Added '<div></div>' as last child of the element > 4. Hit Ctrl+Enter to save the changes > > Sebastian Sebastian, is there a particular page or element that triggers this crash for you? I've tried following the steps on a few different pages (Win7 Nightly) and haven't been able to hit it.
Flags: needinfo?(sebastianzartner)
Yes, I reproduced this right now on css3test.com. Here are the enhanced steps: 1. Turned off e10s. 2. Went to css3test.com 3. Right-clicked the 'background-repeat' element on the page and chose 'Inspect Element' from the context menu 4. Right-clicked the selected element within the markup view and chose 'Edit As HTML' 5. Added '<div></div>' (without quotes) at the end of the editor 6. Pressed Ctrl+Enter 7. Moved mouse over the markup view => This resulted in https://crash-stats.mozilla.com/report/index/411e8e54-9b76-45f9-b82a-9a9032151027. (Sometimes the crash doesn't happen immediately but after some time moving the mouse around.) With enabled e10s the crash signature changes to [@ js::PreliminaryObjectArray::sweep ], which is filed as bug 1212356. Sebastian
Flags: needinfo?(sebastianzartner)
(In reply to Sebastian Zartner [:sebo] from comment #3) > Yes, I reproduced this right now on css3test.com. Here are the enhanced > steps: > > 1. Turned off e10s. > 2. Went to css3test.com > 3. Right-clicked the 'background-repeat' element on the page and chose > 'Inspect Element' from the context menu > 4. Right-clicked the selected element within the markup view and chose 'Edit > As HTML' > 5. Added '<div></div>' (without quotes) at the end of the editor > 6. Pressed Ctrl+Enter > 7. Moved mouse over the markup view > > => This resulted in > https://crash-stats.mozilla.com/report/index/411e8e54-9b76-45f9-b82a- > 9a9032151027. (Sometimes the crash doesn't happen immediately but after some > time moving the mouse around.) > > With enabled e10s the crash signature changes to [@ > js::PreliminaryObjectArray::sweep ], which is filed as bug 1212356. > > Sebastian Ah thanks, I can reproduce with those instructions!
You need to log in before you can comment on or make changes to this bug.