1013603 - crash in RuleHash_IdTable_GetKey

Status: RESOLVED DUPLICATE of bug 1011391

(Core :: CSS Parsing and Computation, defect)

Description

[juan becerra [:juanb]]

This bug was filed from the Socorro interface and is 
report bp-fc61cf95-7645-454f-b49a-e25362140515.
=============================================================

This is currently in the top 20 for nightly 32a1. This signature has been around for a while (including 29), but it's been reported in the list of explosive reports for nightly 32a1 for a week or so. I didn't see any reports for 31a2. There are no comments in the reports and no correlations. It's happening mostly on Win7 and 8.1 

More reports can be found here: https://crash-stats.mozilla.com/report/list?product=Firefox&signature=RuleHash_IdTable_GetKey

0 	xul.dll 	RuleHash_IdTable_GetKey 	layout/style/nsCSSRuleProcessor.cpp
1 	xul.dll 	RuleHash_CSMatchEntry 	layout/style/nsCSSRuleProcessor.cpp
2 	xul.dll 	SearchTable 	xpcom/glue/pldhash.cpp
3 	xul.dll 	PL_DHashTableOperate(PLDHashTable *,void const *,PLDHashOperator) 	xpcom/glue/pldhash.cpp
4 	xul.dll 	RuleHash::EnumerateAllRules(mozilla::dom::Element *,ElementDependentRuleProcessorData *,NodeMatchContext &) 	layout/style/nsCSSRuleProcessor.cpp
5 	xul.dll 	nsCSSRuleProcessor::RulesMatching(ElementRuleProcessorData *) 	layout/style/nsCSSRuleProcessor.cpp
6 	xul.dll 	EnumRulesMatching<ElementRuleProcessorData> 	layout/style/nsStyleSet.cpp
7 	xul.dll 	nsStyleSet::FileRules(bool (*)(nsIStyleRuleProcessor *,void *),RuleProcessorData *,mozilla::dom::Element *,nsRuleWalker *) 	layout/style/nsStyleSet.cpp
8 	xul.dll 	nsStyleSet::ResolveStyleFor(mozilla::dom::Element *,nsStyleContext *,TreeMatchContext &) 	layout/style/nsStyleSet.cpp
9 	xul.dll 	nsCSSFrameConstructor::ResolveStyleContext(nsStyleContext *,nsIContent *,nsFrameConstructorState *) 	layout/base/nsCSSFrameConstructor.cpp
10 	xul.dll 	nsCSSFrameConstructor::ResolveStyleContext(nsIFrame *,nsIContent *,nsFrameConstructorState *) 	layout/base/nsCSSFrameConstructor.cpp
11 	xul.dll 	nsCSSFrameConstructor::AddFrameConstructionItems(nsFrameConstructorState &,nsIContent *,bool,nsIFrame *,nsCSSFrameConstructor::FrameConstructionItemList &) 	layout/base/nsCSSFrameConstructor.cpp
12 	xul.dll 	nsCSSFrameConstructor::ContentAppended(nsIContent *,nsIContent *,bool) 	layout/base/nsCSSFrameConstructor.cpp
13 	xul.dll 	nsCSSFrameConstructor::CreateNeededFrames(nsIContent *) 	layout/base/nsCSSFrameConstructor.cpp
14 	xul.dll 	nsCSSFrameConstructor::CreateNeededFrames(nsIContent *) 	layout/base/nsCSSFrameConstructor.cpp
15 	xul.dll 	nsCSSFrameConstructor::CreateNeededFrames() 	layout/base/nsCSSFrameConstructor.cpp
16 	xul.dll 	mozilla::RestyleManager::ProcessPendingRestyles() 	layout/base/RestyleManager.cpp
17 	xul.dll 	PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) 	layout/base/nsPresShell.cpp
18 	xul.dll 	nsDocument::FlushPendingNotifications(mozFlushType) 	content/base/src/nsDocument.cpp
19 	xul.dll 	mozilla::dom::Element::GetPrimaryFrame(mozFlushType) 	content/base/src/Element.cpp
20 	xul.dll 	mozilla::dom::Element::GetStyledFrame() 	content/base/src/Element.cpp
21 	xul.dll 	nsGenericHTMLElement::GetOffsetRect(mozilla::gfx::IntRectTyped<mozilla::CSSPixel> &) 	content/html/content/src/nsGenericHTMLElement.cpp
22 	xul.dll 	mozilla::dom::HTMLElementBinding::get_offsetHeight 	obj-firefox/dom/bindings/HTMLElementBinding.cpp
23 	xul.dll 	mozilla::dom::GenericBindingGetter(JSContext *,unsigned int,JS::Value *) 	dom/bindings/BindingUtils.cpp
24 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
25 	mozjs.dll 	js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value const *,JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
26 	mozjs.dll 	js::InvokeGetterOrSetter(JSContext *,JSObject *,JS::Value,unsigned int,JS::Value *,JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
27 	mozjs.dll 	js::Shape::get(JSContext *,JS::Handle<JSObject *>,JSObject *,JSObject *,JS::MutableHandle<JS::Value>) 	js/src/vm/Shape-inl.h
28 	mozjs.dll 	js::baseops::GetProperty(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::MutableHandle<JS::Value>) 	js/src/jsobj.cpp
29 	mozjs.dll 	GetPropertyOperation 	js/src/vm/Interpreter.cpp
30 	mozjs.dll 	Interpret 	js/src/vm/Interpreter.cpp
31 	mozjs.dll 	js::RunScript(JSContext *,js::RunState &) 	js/src/vm/Interpreter.cpp
32 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
33 	mozjs.dll 	js_fun_apply(JSContext *,unsigned int,JS::Value *) 	js/src/jsfun.cpp
34 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
35 	mozjs.dll 	Interpret 	js/src/vm/Interpreter.cpp
36 	mozjs.dll 	js::RunScript(JSContext *,js::RunState &) 	js/src/vm/Interpreter.cpp
37 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
38 	mozjs.dll 	js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value const *,JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
39 	mozjs.dll 	JS::Call(JSContext *,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::HandleValueArray const &,JS::MutableHandle<JS::Value>) 	js/src/jsapi.cpp
40 	xul.dll 	mozilla::dom::EventListener::HandleEvent(JSContext *,JS::Handle<JS::Value>,mozilla::dom::Event &,mozilla::ErrorResult &) 	obj-firefox/dom/bindings/EventListenerBinding.cpp
41 	xul.dll 	mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget *>(mozilla::dom::EventTarget * const &,mozilla::dom::Event &,mozilla::ErrorResult &,mozilla::dom::CallbackObject::ExceptionHandling) 	obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h
42 	xul.dll 	mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener *,nsIDOMEvent *,mozilla::dom::EventTarget *) 	dom/events/EventListenerManager.cpp
43 	xul.dll 	mozilla::EventListenerManager::HandleEventInternal(nsPresContext *,mozilla::WidgetEvent *,nsIDOMEvent * *,mozilla::dom::EventTarget *,nsEventStatus *) 	dom/events/EventListenerManager.cpp
44 	xul.dll 	mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor &,mozilla::ELMCreationDetector &) 	dom/events/EventDispatcher.cpp
45 	xul.dll 	mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem> &,mozilla::EventChainPostVisitor &,mozilla::EventDispatchingCallback *,mozilla::ELMCreationDetector &) 	dom/events/EventDispatcher.cpp
46 	xul.dll 	mozilla::EventDispatcher::Dispatch(nsISupports *,nsPresContext *,mozilla::WidgetEvent *,nsIDOMEvent *,nsEventStatus *,mozilla::EventDispatchingCallback *,nsCOMArray<mozilla::dom::EventTarget> *) 	dom/events/EventDispatcher.cpp
47 	xul.dll 	mozilla::EventDispatcher::DispatchDOMEvent(nsISupports *,mozilla::WidgetEvent *,nsIDOMEvent *,nsPresContext *,nsEventStatus *) 	dom/events/EventDispatcher.cpp
48 	xul.dll 	nsINode::DispatchEvent(nsIDOMEvent *,bool *) 	content/base/src/nsINode.cpp
49 	xul.dll 	nsContentUtils::DispatchEvent(nsIDocument *,nsISupports *,nsAString_internal const &,bool,bool,bool,bool *) 	content/base/src/nsContentUtils.cpp
50 	xul.dll 	nsContentUtils::DispatchTrustedEvent(nsIDocument *,nsISupports *,nsAString_internal const &,bool,bool,bool *) 	content/base/src/nsContentUtils.cpp
51 	xul.dll 	nsDocument::DispatchContentLoadedEvents() 	content/base/src/nsDocument.cpp
52 	xul.dll 	nsRunnableMethodImpl<void ( nsProcess::*)(void),void,1>::Run() 	obj-firefox/dist/include/nsThreadUtils.h
53 	xul.dll 	nsThread::ProcessNextEvent(bool,bool *) 	xpcom/threads/nsThread.cpp
54 	xul.dll 	NS_ProcessNextEvent(nsIThread *,bool) 	xpcom/glue/nsThreadUtils.cpp
55 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) 	ipc/glue/MessagePump.cpp
56 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
57 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
58 	xul.dll 	nsBaseAppShell::Run() 	widget/xpwidgets/nsBaseAppShell.cpp
59 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp
60 	xul.dll 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp
61 	xul.dll 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
62 	xul.dll 	XREMain::XRE_main(int,char * * const,nsXREAppData const *) 	toolkit/xre/nsAppRunner.cpp
63 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp
64 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp
65 	firefox.exe 	NS_internal_main(int,char * *) 	browser/app/nsBrowserApp.cpp
66 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
67 	firefox.exe 	__tmainCRTStartup 	f:/dd/vctools/crt_bld/self_64_amd64/crt/src/crtexe.c:552
68 	kernel32.dll 	BaseThreadInitThunk 	
69 	ntdll.dll 	RtlUserThreadStart 	
70 	kernel32.dll 	BasepReportFault 	
71 	kernel32.dll 	BasepReportFault

Comment 1

[Boris Zbarsky [:bzbarsky]]

Almost certainly the same thing as bug 1011391.

Can we get any sort of info on when this appeared?  _Something_ is clearly corrupting memory, with the style system most likely an innocent victim.  :(

Comment 2

[Robert Kaiser]

Juan, can you take a look at when this started spiking on nightly as requested by bz?

Comment 3

[juan becerra [:juanb]]

This also started appearing around 5/2, at the same time as bug 1011391. The signatures look very similar, but I filed them separately to be on the safe side.