1011751 - crash in nsChildContentList::cycleCollection::DeleteCycleCollectable(void*)

Status: RESOLVED DUPLICATE of bug 805406

(Core :: CSS Parsing and Computation, defect)

Description

[juan becerra [:juanb]]

This bug was filed from the Socorro interface and is 
report bp-4384fe51-82e5-41a2-ad89-6b9582140510.
=============================================================

Not sure where to file this.

This is a new signature on nightly 32a1, starting around 5/10. It's being reported mostly on Windows 7 and Windows 8.1 machines. There's only one comment mentioning that the person was on Facebook looking for a chat client on Google search. Other than that there's not much to go on.

More reports can be found here: https://crash-stats.mozilla.com/report/list?product=Firefox&signature=nsChildContentList%3A%3AcycleCollection%3A%3ADeleteCycleCollectable%28void%2A%29

0 	xul.dll 	nsChildContentList::cycleCollection::DeleteCycleCollectable(void *) 	
1 	xul.dll 	nsCSSFrameConstructor::FrameConstructionItem::IsWhitespace(nsFrameConstructorState &) 	
2 	xul.dll 	nsCSSValue::SetStringValue(nsString const &,nsCSSUnit) 	
3 	xul.dll 	mozilla::layers::Layer::GetTransform() 	
4 	xul.dll 	nsChromeRegistry::Release() 	
5 	xul.dll 	nsXULCommandDispatcher::GetRootFocusedContentAndWindow(nsPIDOMWindow * *) 	
6 	xul.dll 	nsChromeRegistry::Release() 	
7 	xul.dll 	nsImageLoadingContent::nsImageLoadingContent() 	
8 	xul.dll 	nsStyleSet::Shutdown(nsPresContext *) 	
9 	xul.dll 	nsStyleSet::Shutdown(nsPresContext *) 	
10 	xul.dll 	mozilla::FileLocation::GetURIString(nsACString_internal &) 	
11 	xul.dll 	nsImageLoadingContent::nsImageLoadingContent() 	
12 	xul.dll 	nsXPConnect::GetNativeOfWrapper(JSContext *,JSObject *) 	
13 	xul.dll 	nsJSScriptTimeoutHandler::Release() 	
14 	xul.dll 	nsJSScriptTimeoutHandler::Release() 	
15 	user32.dll 	InternalCallWinProc 	
16 	user32.dll 	GetRealWindowOwner 	
17 	user32.dll 	DispatchClientMessage 	
18 	user32.dll 	__fnDWORD 	
19 	ntdll.dll 	KiUserCallbackDispatcher 	
20 	ntdll.dll 	KiUserApcDispatcher 	
21 	user32.dll 	DispatchMessageW 	
22 	xul.dll 	mozilla::ContainerState::InvalidateForLayerChange(nsDisplayItem *,mozilla::layers::Layer *,mozilla::DisplayItemClip const &,nsPoint const &,nsDisplayItemGeometry *) 	
23 	xul.dll 	nsJSScriptTimeoutHandler::Release() 	
24 	xul.dll 	mozilla::ContainerState::InvalidateForLayerChange(nsDisplayItem *,mozilla::layers::Layer *,mozilla::DisplayItemClip const &,nsPoint const &,nsDisplayItemGeometry *) 	
25 	xul.dll 	mozilla::ContainerState::InvalidateForLayerChange(nsDisplayItem *,mozilla::layers::Layer *,mozilla::DisplayItemClip const &,nsPoint const &,nsDisplayItemGeometry *) 	
26 	xul.dll 	nsTHashtable<nsBaseHashtableET<nsISupportsHashKey,mozilla::RestyleTracker::RestyleData> >::s_HashKey(PLDHashTable *,void const *) 	
27 	xul.dll 	nsStyleSet::Shutdown(nsPresContext *) 	
28 	xul.dll 	mozilla::dom::WantsQueryInterface<nsScreen>::Enabled(JSContext *,JSObject *) 	
29 	xul.dll 	mozilla::ContainerState::InvalidateForLayerChange(nsDisplayItem *,mozilla::layers::Layer *,mozilla::DisplayItemClip const &,nsPoint const &,nsDisplayItemGeometry *) 	
30 	xul.dll 	nsTHashtable<nsBaseHashtableET<nsISupportsHashKey,mozilla::RestyleTracker::RestyleData> >::s_HashKey(PLDHashTable *,void const *) 	
31 	xul.dll 	mozilla::ipc::BackgroundChildImpl::~BackgroundChildImpl() 	
32 	xul.dll 	std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >(wchar_t const *,unsigned int) 	
33 	xul.dll 	std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >(wchar_t const *,unsigned int) 	
34 	xul.dll 	nsCOMPtr<nsIIOService>::nsCOMPtr<nsIIOService>(nsGetServiceByContractID) 	
35 	xul.dll 	mozilla::dom::DOMRect::DOMRect(nsISupports *,double,double,double,double) 	
36 	xul.dll 	google::protobuf::io::CodedOutputStream::WriteVarint32FallbackToArrayInline(unsigned int,unsigned char *) 	
37 	xul.dll 	nsDocShell::SetCreatedDynamically(bool) 	
38 	xul.dll 	nsNavBookmarks::GetTagsFolder(__int64 *) 	
39 	xul.dll 	nsFileProtocolHandler::`vector deleting destructor'(unsigned int) 	
40 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp
41 	firefox.exe 	NS_internal_main(int,char * *) 	browser/app/nsBrowserApp.cpp
42 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
43 	firefox.exe 	__tmainCRTStartup 	f:/dd/vctools/crt_bld/self_x86/crt/src/crtexe.c:552
44 	kernel32.dll 	BaseThreadInitThunk 	
45 	ntdll.dll 	__RtlUserThreadStart 	
46 	ntdll.dll 	_RtlUserThreadStart

Comment 1

[Andrew McCreight [:mccr8]]

That stack looks super bogus.

Comment 2

[(Away)]

WinDbg says these are actually PushClipsToDT. We had a symbol hiccup last week due to bug 1003085.

Build ID facets confirm that there's no overlap. All the PushClipsToDT crashes from the 5/10 and 5/13 builds got listed under DeleteCycleCollectable.

Comment 3

[Andrew McCreight [:mccr8]]

Thanks for the analysis, David!