Closed Bug 1200646 Opened 9 years ago Closed 3 years ago

crash in [@ DestroyDisplayItemDataForFrames] → [@ IPCError-browser | ShutDownKill ]

Categories

(Core :: Layout: Images, Video, and HTML Frames, defect, P5)

Product:
Core
Component:
Layout: Images, Video, and HTML Frames
Version:
43 Branch
Platform:
All
Windows
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox41 --- affected
firefox42 --- affected
firefox43 --- affected
firefox44 --- affected
firefox45 --- affected
firefox46 --- affected
firefox47 --- affected
firefox48 --- affected
firefox49 --- affected
firefox-esr52 --- affected
firefox57 --- affected
firefox58 --- affected
firefox59 --- affected

People

(Reporter: alex_mayorga, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, topcrash)

Crash Data

This bug was filed from the Socorro interface and is report bp-63796e0a-83e7-412e-bcf1-5186c2150901. ============================================================= Crashing Thread Frame Module Signature Source 0 xul.dll DestroyDisplayItemDataForFrames layout/generic/nsSubDocumentFrame.cpp 1 xul.dll DestroyDisplayItemDataForFrames layout/generic/nsSubDocumentFrame.cpp 2 xul.dll DestroyDisplayItemDataForFrames layout/generic/nsSubDocumentFrame.cpp 3 xul.dll DestroyDisplayItemDataForFrames layout/generic/nsSubDocumentFrame.cpp 4 xul.dll BeginSwapDocShellsForDocument layout/generic/nsSubDocumentFrame.cpp 5 xul.dll BeginSwapDocShellsForViews layout/generic/nsSubDocumentFrame.cpp 6 xul.dll nsSubDocumentFrame::DestroyFrom(nsIFrame*) layout/generic/nsSubDocumentFrame.cpp 7 xul.dll nsFrameList::DestroyFramesFrom(nsIFrame*) layout/generic/nsFrameList.cpp 8 xul.dll nsBlockFrame::DestroyFrom(nsIFrame*) layout/generic/nsBlockFrame.cpp 9 xul.dll nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) layout/generic/nsLineBox.cpp 10 xul.dll nsBlockFrame::DestroyFrom(nsIFrame*) layout/generic/nsBlockFrame.cpp 11 xul.dll nsContainerFrame::DestroyFrom(nsIFrame*) layout/generic/nsContainerFrame.cpp 12 xul.dll nsContainerFrame::DestroyFrom(nsIFrame*) layout/generic/nsContainerFrame.cpp 13 xul.dll nsContainerFrame::DestroyFrom(nsIFrame*) layout/generic/nsContainerFrame.cpp 14 xul.dll nsFrameManager::Destroy() layout/base/nsFrameManager.cpp 15 xul.dll PresShell::Destroy() layout/base/nsPresShell.cpp 16 xul.dll nsDocumentViewer::DestroyPresShell() layout/base/nsDocumentViewer.cpp 17 xul.dll nsDocumentViewer::Destroy() layout/base/nsDocumentViewer.cpp 18 xul.dll nsDocShell::Destroy() docshell/base/nsDocShell.cpp 19 xul.dll nsWebBrowser::SetDocShell(nsIDocShell*) embedding/browser/nsWebBrowser.cpp 20 xul.dll nsWebBrowser::InternalDestroy() embedding/browser/nsWebBrowser.cpp 21 xul.dll nsWebBrowser::Destroy() embedding/browser/nsWebBrowser.cpp 22 xul.dll mozilla::dom::TabChild::DestroyWindow() dom/ipc/TabChild.cpp 23 xul.dll mozilla::dom::TabChild::RecvDestroy() dom/ipc/TabChild.cpp 24 xul.dll mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) obj-firefox/ipc/ipdl/PBrowserChild.cpp 25 xul.dll mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) obj-firefox/ipc/ipdl/PContentChild.cpp 26 xul.dll mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) ipc/glue/MessageChannel.cpp 27 xul.dll mozilla::ipc::MessageChannel::DispatchMessageW(IPC::Message const&) ipc/glue/MessageChannel.cpp 28 xul.dll mozilla::ipc::MessageChannel::OnMaybeDequeueOne() ipc/glue/MessageChannel.cpp 29 xul.dll RunnableMethod<SoftwareDisplay, void ( SoftwareDisplay::*)(void), Tuple0>::Run() ipc/chromium/src/base/task.h 30 xul.dll MessageLoop::DoWork() ipc/chromium/src/base/message_loop.cc 31 xul.dll mozilla::ipc::DoWorkRunnable::Run() ipc/glue/MessagePump.cpp 32 xul.dll nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp 33 xul.dll mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp 34 xul.dll mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp 35 xul.dll MessageLoop::RunHandler() ipc/chromium/src/base/message_loop.cc 36 xul.dll MessageLoop::Run() ipc/chromium/src/base/message_loop.cc 37 xul.dll nsBaseAppShell::Run() widget/nsBaseAppShell.cpp 38 xul.dll nsAppShell::Run() widget/windows/nsAppShell.cpp 39 xul.dll XRE_RunAppShell toolkit/xre/nsEmbedFunctions.cpp 40 xul.dll mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp 41 xul.dll MessageLoop::RunHandler() ipc/chromium/src/base/message_loop.cc 42 xul.dll MessageLoop::Run() ipc/chromium/src/base/message_loop.cc 43 xul.dll XRE_InitChildProcess toolkit/xre/nsEmbedFunctions.cpp 44 plugin-container.exe wmain toolkit/xre/nsWindowsWMain.cpp 45 plugin-container.exe __tmainCRTStartup f:/dd/vctools/crt/crtw32/startup/crt0.c:255 46 kernel32.dll BaseThreadInitThunk 47 ntdll.dll RtlUserThreadStart
FF44.0a1, e10s, 64-bit, Win7: https://crash-stats.mozilla.com/report/index/77d6f19e-4e08-4bae-8012-5f2172151014 Crashing Thread Frame Module Signature Source 0 xul.dll DestroyDisplayItemDataForFrames layout/generic/nsSubDocumentFrame.cpp 1 xul.dll DestroyDisplayItemDataForFrames layout/generic/nsSubDocumentFrame.cpp 2 xul.dll DestroyDisplayItemDataForFrames layout/generic/nsSubDocumentFrame.cpp 3 xul.dll DestroyDisplayItemDataForFrames layout/generic/nsSubDocumentFrame.cpp 4 xul.dll BeginSwapDocShellsForDocument layout/generic/nsSubDocumentFrame.cpp 5 xul.dll nsDocument::EnumerateSubDocuments(bool (*)(nsIDocument*, void*), void*) dom/base/nsDocument.cpp 6 xul.dll BeginSwapDocShellsForDocument layout/generic/nsSubDocumentFrame.cpp 7 xul.dll BeginSwapDocShellsForViews layout/generic/nsSubDocumentFrame.cpp 8 xul.dll nsSubDocumentFrame::DestroyFrom(nsIFrame*) layout/generic/nsSubDocumentFrame.cpp 9 xul.dll nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) layout/generic/nsLineBox.cpp 10 xul.dll nsBlockFrame::DestroyFrom(nsIFrame*) layout/generic/nsBlockFrame.cpp 11 xul.dll nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) layout/generic/nsLineBox.cpp 12 xul.dll nsBlockFrame::DestroyFrom(nsIFrame*) layout/generic/nsBlockFrame.cpp 13 xul.dll nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) layout/generic/nsLineBox.cpp 14 xul.dll nsBlockFrame::DestroyFrom(nsIFrame*) layout/generic/nsBlockFrame.cpp 15 xul.dll nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) layout/generic/nsLineBox.cpp 16 xul.dll nsBlockFrame::DestroyFrom(nsIFrame*) layout/generic/nsBlockFrame.cpp 17 xul.dll nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) layout/generic/nsLineBox.cpp 18 xul.dll nsBlockFrame::DestroyFrom(nsIFrame*) layout/generic/nsBlockFrame.cpp 19 xul.dll nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) layout/generic/nsLineBox.cpp 20 xul.dll nsBlockFrame::DestroyFrom(nsIFrame*) layout/generic/nsBlockFrame.cpp 21 xul.dll nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) layout/generic/nsLineBox.cpp 22 xul.dll nsBlockFrame::DestroyFrom(nsIFrame*) layout/generic/nsBlockFrame.cpp 23 xul.dll nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) layout/generic/nsLineBox.cpp 24 xul.dll nsBlockFrame::DestroyFrom(nsIFrame*) layout/generic/nsBlockFrame.cpp 25 xul.dll nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) layout/generic/nsLineBox.cpp 26 xul.dll nsBlockFrame::DestroyFrom(nsIFrame*) layout/generic/nsBlockFrame.cpp 27 xul.dll nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) layout/generic/nsLineBox.cpp 28 xul.dll nsBlockFrame::DestroyFrom(nsIFrame*) layout/generic/nsBlockFrame.cpp 29 xul.dll nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) layout/generic/nsLineBox.cpp 30 xul.dll nsBlockFrame::DestroyFrom(nsIFrame*) layout/generic/nsBlockFrame.cpp 31 xul.dll nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) layout/generic/nsLineBox.cpp 32 xul.dll nsBlockFrame::DestroyFrom(nsIFrame*) layout/generic/nsBlockFrame.cpp 33 xul.dll nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) layout/generic/nsLineBox.cpp 34 xul.dll nsBlockFrame::DestroyFrom(nsIFrame*) layout/generic/nsBlockFrame.cpp 35 xul.dll nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) layout/generic/nsLineBox.cpp 36 xul.dll nsBlockFrame::DestroyFrom(nsIFrame*) layout/generic/nsBlockFrame.cpp 37 xul.dll nsContainerFrame::DestroyFrom(nsIFrame*) layout/generic/nsContainerFrame.cpp 38 xul.dll nsContainerFrame::DestroyFrom(nsIFrame*) layout/generic/nsContainerFrame.cpp 39 xul.dll nsContainerFrame::DestroyFrom(nsIFrame*) layout/generic/nsContainerFrame.cpp 40 xul.dll nsFrameManager::Destroy() layout/base/nsFrameManager.cpp 41 xul.dll PresShell::Destroy() layout/base/nsPresShell.cpp 42 xul.dll nsDocumentViewer::DestroyPresShell() layout/base/nsDocumentViewer.cpp 43 xul.dll nsDocumentViewer::Destroy() layout/base/nsDocumentViewer.cpp 44 xul.dll nsDocShell::Destroy() docshell/base/nsDocShell.cpp 45 xul.dll nsWebBrowser::SetDocShell(nsIDocShell*) embedding/browser/nsWebBrowser.cpp 46 xul.dll nsWebBrowser::InternalDestroy() embedding/browser/nsWebBrowser.cpp 47 xul.dll nsWebBrowser::Destroy() embedding/browser/nsWebBrowser.cpp 48 xul.dll mozilla::dom::TabChild::DestroyWindow() dom/ipc/TabChild.cpp 49 xul.dll mozilla::dom::TabChild::RecvDestroy() dom/ipc/TabChild.cpp 50 xul.dll mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) obj-firefox/ipc/ipdl/PBrowserChild.cpp 51 xul.dll mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) obj-firefox/ipc/ipdl/PContentChild.cpp 52 xul.dll mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) ipc/glue/MessageChannel.cpp 53 xul.dll mozilla::ipc::MessageChannel::DispatchMessageW(IPC::Message const&) ipc/glue/MessageChannel.cpp 54 xul.dll mozilla::ipc::MessageChannel::OnMaybeDequeueOne() ipc/glue/MessageChannel.cpp 55 xul.dll RunnableMethod<mozilla::ipc::MessageChannel, void ( mozilla::ipc::MessageChannel::*)(void), Tuple0>::Run() ipc/chromium/src/base/task.h 56 xul.dll MessageLoop::DoWork() ipc/chromium/src/base/message_loop.cc 57 xul.dll mozilla::ipc::DoWorkRunnable::Run() ipc/glue/MessagePump.cpp 58 xul.dll nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp 59 xul.dll XPTC__InvokebyIndex xpcom/reflect/xptcall/md/win32/xptcinvoke_asm_x86_64.asm 60 @0x9 61 xul.dll nsXPConnect::XPConnect() js/xpconnect/src/xpcprivate.h 62 xul.dll XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) js/xpconnect/src/XPCWrappedNative.cpp 63 xul.dll XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) js/xpconnect/src/XPCWrappedNativeJSOps.cpp 64 @0x336e44257ce
Component: Layout → Layout: HTML Frames
Hardware: Unspecified → x86_64
Updating crash signature to reflect changes to signature generation made in bug 1269817 (although reports older than a week will not be reprocessed), and adding dependency to ShutDownKill metabug. (These probably shouldn't all be separate bugs, but I'm not going to fix that up in a mass-change.)
Blocks: shutdownkill
Crash Signature: [@ DestroyDisplayItemDataForFrames] → [@ IPCError-browser | ShutDownKill ]
¡Hola! 21 crashes in the past week at https://crash-stats.mozilla.com/signature/?product=Firefox&signature=DestroyDisplayItemDataForFrames ¡Gracias! Alex
Crash Signature: [@ IPCError-browser | ShutDownKill ] → [@ IPCError-browser | ShutDownKill ] [@ DestroyDisplayItemDataForFrames]
status-firefox49: --- → affected
status-firefox57: --- → affected
status-firefox-esr52: --- → affected
Keywords: topcrash
OS: Windows 7 → Windows
Hardware: x86_64 → All
Summary: crash in DestroyDisplayItemDataForFrames → crash in [@ DestroyDisplayItemDataForFrames] → [@ IPCError-browser | ShutDownKill ]
Crash Signature: [@ IPCError-browser | ShutDownKill ] [@ DestroyDisplayItemDataForFrames] → [@ IPCError-browser | ShutDownKill ] [@ DestroyDisplayItemDataForFrames] https://crash-stats.mozilla.com/signature/?product=Firefox&proto_signature=~DestroyDisplayItemDataForFrames&signature=IPCError-browser%20%7C%20ShutDownKill&date=%3E%3D2017-06-06T20…
https://crash-stats.mozilla.com/signature/?signature=DestroyDisplayItemDataForFrames&date=%3E%3D2017-06-07T01%3A19%3A19.000Z&date=%3C2017-12-06T23%3A19%3A19.000Z Signature report for DestroyDisplayItemDataForFrames Showing results from 6 months ago 120 Results https://crash-stats.mozilla.com/signature/?product=Firefox&proto_signature=~DestroyDisplayItemDataForFrames&signature=IPCError-browser%20%7C%20ShutDownKill&date=%3E%3D2017-06-07T06%3A29%3A02.000Z&date=%3C2017-12-07T05%3A29%3A02.000Z#summary Signature report for IPCError-browser | ShutDownKill Proto Signature Contains: DestroyDisplayItemDataForFrames Showing results from 6 months ago 35,131 Results https://crash-stats.mozilla.com/signature/?signature=IPCError-browser%20%7C%20ShutDownKill&date=%3E%3D2017-06-07T06%3A27%3A14.000Z&date=%3C2017-12-07T05%3A27%3A14.000Z Signature report for IPCError-browser | ShutDownKill Showing results from 6 months ago 15,003,057 Results Therefore, Signature report for IPCError-browser | ShutDownKill Proto Signature Contains: DestroyDisplayItemDataForFrames accounts for 0.235% of all IPCError-browser | ShutDownKill crashes.
status-firefox58: --- → affected
status-firefox59: --- → affected
This bug has been sitting here for 2 years without ANY ACTION! Can someone please DO SOMETHING? Is the bug valid or invalid? If the bug is valid, can it be assigned to someone? Can it be assigned a priority? If it is invalid can the bug be closed? What is the point of even having a bug reporting system (why ask your users to submit bugs and comments) if you are not going to do anything about them?
Flags: needinfo?(bugs)
(In reply to Trevor Skywalker from comment #8) > Therefore, > Signature report for IPCError-browser | ShutDownKill > Proto Signature Contains: DestroyDisplayItemDataForFrames > > accounts for 0.235% of all IPCError-browser | ShutDownKill crashes. Thank you for this analysis. We do appreciate our volunteers helping improve the quality of Firefox. While your math is correct, your inputs cast too wide a net. In other words, the only Firefox we can fix is the new one (let's say 57 for now.) Crashes like this DestroyDisplayItemDataForFrames one are very difficult to reproduce for many reasons. We have close to 100% success on fixing crashes when volunteers supply a test case. These mysterious shutdown crashes are also sometimes fixed by improvements we make elsewhere (e.g., fixes to crashes we can reproduce) so the math about % of overall crashes has to be % of overall crashes in the browser we know to have all the fixes (again, 57 at the time of this writing.) With that in mind, data from the last week shows that Firefox had this crash two times in a recent build: https://crash-stats.mozilla.com/signature/?signature=DestroyDisplayItemDataForFrames&date=%3E%3D2018-01-04T11%3A23%3A45.000Z&date=%3C2018-01-11T11%3A23%3A45.000Z#aggregations Two times across all crash reports + no reproducible case. What priority would you recommend? Let's say P5? I'll say it again: if you find a reproducible test case or URL for this, please send it my way. That's the surest way to bump this one up. Thanks again for all your help!
Flags: needinfo?(bugs)
Priority: -- → P5
I have faced similar issue when start using Firefox in limited memory, i.e. using Windows JobObject with 3 GiB overall memory limit. In this case, HeapAlloc (for example) fails if requested memory will break the limit. Crash report example: https://crash-stats.mozilla.com/report/index/db68ad79-d835-44c9-a7bf-1bbc90180802
Product: Core → Core Graveyard
Component: Layout: HTML Frames → Layout: Images
Product: Core Graveyard → Core

Possibly related from a try run if someone wants to look at a dump:

https://treeherder.mozilla.org/#/jobs?repo=try&revision=3283dfbdc7f011012294a4725f53a4cfd63b938e&selectedJob=230927845

Main app process exited normally | application crashed [@ nsTArray_Impl<mozilla::FrameProperties::PropertyValue, nsTArrayInfallibleAllocator>::RemoveElementsAt(unsigned long, unsigned long)]

Assertion failure: aCount == 0 || aStart < Length() (Invalid aStart index), at /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:2222
#01: DestroyDisplayItemDataForFrames(nsIFrame*) [layout/generic/nsSubDocumentFrame.cpp:1010]
#02: DestroyDisplayItemDataForFrames(nsIFrame*) [layout/generic/nsFrameList.h:398]
#03: DestroyDisplayItemDataForFrames(nsIFrame*) [layout/generic/nsFrameList.h:398]
#04: DestroyDisplayItemDataForFrames(nsIFrame*) [layout/generic/nsFrameList.h:398]
#05: DestroyDisplayItemDataForFrames(nsIFrame*) [layout/generic/nsFrameList.h:398]
#06: DestroyDisplayItemDataForFrames(nsIFrame*) [layout/generic/nsFrameList.h:398]
#07: BeginSwapDocShellsForDocument(mozilla::dom::Document*, void*) [layout/generic/nsSubDocumentFrame.cpp:0]
#08: BeginSwapDocShellsForViews(nsView*) [view/nsView.h:71]
...

Closing this issue as Resolved > Worksforme since no crashes with this Signature were reported in the last 6 months.

Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.