Closed Bug 785808 Opened 12 years ago Closed 12 years ago

crash in nsRootPresContext::RequestUpdatePluginGeometry

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Version:
17 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla18
Tracking Flags:
Tracking Status
firefox17 + fixed
firefox18 + fixed

People

(Reporter: scoobidiver, Assigned: cpearce)

References

Details

(Keywords: crash, regression, topcrash, Whiteboard: [native-crash])

Crash Data

There are still crashes after the fix of bug 781279.

Signature 	nsRootPresContext::RequestUpdatePluginGeometry(nsIFrame*) More Reports Search
UUID	acf091de-be8a-40e5-8660-ab4d52120827
Date Processed	2012-08-27 06:32:39
Uptime	7626
Last Crash	2.1 hours before submission
Install Age	9.0 hours since version was first installed.
Install Time	2012-08-26 21:30:49
Product	Firefox
Version	17.0a1
Build ID	20120826030526
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 20 model 1 stepping 0
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x1d
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x9802, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.823.0.0
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- 
EMCheckCompatibility	True
Adapter Vendor ID	0x1002
Adapter Device ID	0x9802
Total Virtual Memory	4294836224
Available Virtual Memory	3724992512
System Memory Use Percentage	55
Available Page File	4607651840
Available Physical Memory	1788993536

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsRootPresContext::RequestUpdatePluginGeometry 	layout/base/nsPresContext.cpp:2665
1 	xul.dll 	PresShell::DoReflow 	layout/base/nsPresShell.cpp:7500
2 	xul.dll 	PresShell::ProcessReflowCommands 	layout/base/nsPresShell.cpp:7576
3 	xul.dll 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:3892
4 	xul.dll 	nsRefreshDriver::Notify 	layout/base/nsRefreshDriver.cpp:398
5 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:476
6 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:624
7 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:82
8 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:201
9 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:175
10 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:163
11 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:232
12 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:273
13 	xul.dll 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3800
14 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3877
15 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3953
16 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:100
17 	firefox.exe 	__tmainCRTStartup 	crtexe.c:552
18 	kernel32.dll 	BaseThreadInitThunk 	
19 	ntdll.dll 	__RtlUserThreadStart 	
20 	ntdll.dll 	_RtlUserThreadStart 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsRootPresContext%3A%3ARequestUpdatePluginGeometry%28nsIFrame*%29
Crash Signature: [@ nsRootPresContext::RequestUpdatePluginGeometry(nsIFrame*)] → [@ nsRootPresContext::RequestUpdatePluginGeometry(nsIFrame*)] [@ nsRootPresContext::UpdatePluginGeometry()] [@ mozalloc_abort(char const* const) | NS_DebugBreak_P | nsIFrame::GetOffsetToCrossDoc(nsIFrame const* int)] [@ mozalloc_abort(char const* const…
Crash Signature: [@ nsRootPresContext::RequestUpdatePluginGeometry(nsIFrame*)] [@ nsRootPresContext::UpdatePluginGeometry()] [@ mozalloc_abort(char const* const) | NS_DebugBreak_P | nsIFrame::GetOffsetToCrossDoc(nsIFrame const* int)] [@ mozalloc_abort(char const* const… → [@ nsRootPresContext::RequestUpdatePluginGeometry(nsIFrame*)] [@ nsRootPresContext::UpdatePluginGeometry()] [@ nsRootPresContext::UpdatePluginGeometry] [@ mozalloc_abort(char const* const) | NS_DebugBreak_P | nsIFrame::GetOffsetToCrossDoc(nsIFrame cons…
OS: Windows 7 → All
Hardware: x86 → All
Whiteboard: [native-crash]
With combined signatures, it's #4 top crasher in 18.0a1.
tracking-firefox17: --- → ?
Keywords: topcrash
Let's try to find a reproducible case for Chris to look at.
Assignee: nobody → cpearce
tracking-firefox17: ? → +
tracking-firefox18: --- → +
Keywords: needURLs, qawanted, steps-wanted
We know how to reproduce bug 781279 with the same signatures.
Can you restrict the URLs to crashes in 17.a1/20120825 and above for the five crash signatures?
Keywords: needURLs
I won't do that, too much work and complication for questionable gain. Also, I don't care about 17.0a1 any more. We can wait a few days and see what 18.0a1 shows.
There's no need to wait because, with combined signatures, it's #2 top browser crasher in 18.0a1.
Trying to narrow down the scope of the environment to track down a reproducible case for this. It appears as though the majority happens on Windows 7 32-bit with [blank] Flash. Does this mean no Flash installed or that we just couldn't get the version for some reason?
(In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #7)
> Windows 7 32-bit with [blank] Flash. Does this mean no Flash installed or
> that we just couldn't get the version for some reason?

It in almost all cases means that we have not loaded Flash into the crashing process (mostly because it was the browser process crashing and not the plugin process that actually loads Flash).
I've tried a bunch of different behaviours but so far have been unable to reproduce this crash. I'm using Windows 7 SP1 32-bit and Firefox 18.0a1 2012-08-30. Here's a list of the things I tried.

* Hotmail open in a tab, tried sending/receiving a message, browsing attached photos, attaching files
* Switch to Outlook UI and do the same
* Install Flash 11.4 and repeat
* Install Silverlight 5 and repeat
* Open a new tab to Facebook, browse my timeline, open a chat session, watch some video
* Open a new tab to Google Plus and repeat the same functions
* Switch back to Hotmail and try using Web Messenger
* Quit Firefox and install Windows Live Messenger
* Try to launch Hotmail from within Windows Live Messenger

Even though this is a #2 top-crash it does not appear to be easily triggered, at least not with a new profile. I'll continue to play around with this but it would help if we could do some work in parallel. Perhaps someone can give me some guidance of where to focus my testing. Perhaps some Engineering insight into what might cause this crash. Perhaps even some outreach to users who are reproducing this. For my own part, I'll send out an email to the QA Org and our community to get more people looking at this.
You could try adding some back/forward navigation in there maybe.
(In reply to Timothy Nikkel (:tn) from comment #10)
> You could try adding some back/forward navigation in there maybe.

Sorry, I forgot to mention that I did try some of that. I tried back/forward a single page, back/forward multiple, back/forward leapfrog (by holding down button). I also threw in some Session Restore and Private Browsing but was unable to trigger this.

There might be something else going on here that mimicking standard user behaviour on a clean profile in Firefox is unable to reproduce. If possible, it might be helpful to do some outreach/investigation to figure out the make up of some of these users' profiles.
I've sent an email to my QA peers to see if they can do some testing around this issue. I've also sent an email to the Nightly Testers newsgroup to solicit crash reports if they notice any crashes using Hotmail.
Keywords: needURLs
I tested this on two different Win 8 machines running Build 9200 and did not have any luck generating a crash.
Amongst the six signatures, here is the only report with a comment: "hostmonster.com crashed the browser" (bp-ca1ef793-e8c3-48f2-9d31-2b6712120829).
Crash Signature: [@ nsRootPresContext::RequestUpdatePluginGeometry(nsIFrame*)] [@ nsRootPresContext::UpdatePluginGeometry()] [@ nsRootPresContext::UpdatePluginGeometry] [@ mozalloc_abort(char const* const) | NS_DebugBreak_P | nsIFrame::GetOffsetToCrossDoc(nsIFrame cons… → [@ nsRootPresContext::RequestUpdatePluginGeometry(nsIFrame*)] [@ nsRootPresContext::RequestUpdatePluginGeometry] [@ nsRootPresContext::UpdatePluginGeometry()] [@ nsRootPresContext::UpdatePluginGeometry] [@ mozalloc_abort(char const* const) | NS_DebugB…
Here are other comments:
"Just checking google reader when critical error happen."
"I clicked on a site and pow!"
Depends on: 787089
There are no crashes after 18.0a1/20120905 which matches the fix of bug 787089.
Status: NEW → RESOLVED
Closed: 12 years ago
status-firefox18: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
Keywords: qawanted, steps-wanted
status-firefox17: --- → fixed
You need to log in before you can comment on or make changes to this bug.