crash in nsCSSValue::nsCSSValue(nsCSSValue const&)

VERIFIED FIXED in Firefox 35

Status

()

Core
Layout
--
critical
VERIFIED FIXED
4 years ago
4 years ago

People

(Reporter: Alice0775 White, Assigned: jtd)

Tracking

(4 keywords)

35 Branch
mozilla35
crash, regression, reproducible, topcrash
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox34 unaffected, firefox35+ verified)

Details

(crash signature)

Attachments

(3 attachments, 1 obsolete attachment)

(Reporter)

Description

4 years ago
Created attachment 8501239 [details]
test.html

[Tracking Requested - why for this release]:

This bug was filed from the Socorro interface and is 
report bp-1a9abd4a-7c0a-4469-910e-a1c442141007.
=============================================================

Build Identifier:
https://hg.mozilla.org/mozilla-central/rev/9ee9e193fc48
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0 ID:20141007030202

Steps To Reproduce:
1. Start Nightly with newly created profile
2. Open attached html

3. Repeat F5 for several times 10-20
4. Right click on contents area and chose "Inspect Element(Q)"
5. Close Inspector
6. Repeat step 3- step 6

Actual Results:
Browser crashes
(Reporter)

Updated

4 years ago
Keywords: reproducible
OS: Windows NT → Windows 7
(Reporter)

Comment 1

4 years ago
Regression window(m-i)
Good:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a20031e192ce
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0 ID:20141005212530
Bad;
https://hg.mozilla.org/integration/mozilla-inbound/rev/7fceb8bf84d2
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0 ID:20141005213030
Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=a20031e192ce&tochange=7fceb8bf84d2

Regressed by 
7fceb8bf84d2	Cameron McCormack — Bug 1077746 - Move FontFace pointer from nsCSSFontFaceRule to a table on FontFaceSet. r=jdaggett
Blocks: 1077746
(Reporter)

Updated

4 years ago
status-firefox34: --- → unaffected
(Reporter)

Updated

4 years ago
Keywords: regression
(Reporter)

Updated

4 years ago
Flags: needinfo?(jdaggett)
Keywords: topcrash
We have a mac crash with this signature from one of our Nightly testers: https://crash-stats.mozilla.com/report/index/4a33050a-30a6-4a65-8c20-9d7a72141007    

I'm noting it here because perhaps it should be a separate bug that is specific to Macs.
Keywords: topcrash
Ack, accidentally removed topcrash label. It is still a topcrash. It's the #1 crash for Nightly right now with 294/587 crashes in the last day; most of these on Windows.
Keywords: topcrash

Comment 4

4 years ago
I just crashed twice with Thunderbird nightly (i.e. Daily) while trying to forward an email.  Had to instead use webmail.

bp-0770e7e3-bd55-4e98-b770-1b7fd2141007
bp-25c792f7-e479-4eba-859d-aa6752141007

I'm using Windows 8.1 x64
(Assignee)

Updated

4 years ago
Assignee: nobody → jdaggett
Flags: needinfo?(jdaggett)
(Assignee)

Comment 5

4 years ago
(In reply to Liz Henry :lizzard from comment #2)
> We have a mac crash with this signature from one of our Nightly testers:
> https://crash-stats.mozilla.com/report/index/4a33050a-30a6-4a65-8c20-
> 9d7a72141007    
> 
> I'm noting it here because perhaps it should be a separate bug that is
> specific to Macs.

That signature is from the "fixed" bug, bug 1077746. Unfortunately, a lot of different crashes are lumped together in this crash signature.
OS: Windows 7 → All
Hardware: x86 → All
(Assignee)

Comment 6

4 years ago
Can reproduce on OSX also.
tracking-firefox35: ? → +
(Assignee)

Comment 7

4 years ago
Created attachment 8501578 [details] [diff] [review]
patch, backout fix from bug 1077746
Attachment #8501578 - Flags: review?(dbaron)
(Assignee)

Comment 8

4 years ago
Created attachment 8501580 [details] [diff] [review]
patch, eliminate need to reference FontFace object from @font-face rules

Eliminates the mFontFace field from nsCSSFontFaceRule objects. Creates a rule ==> FontFace object map on the fly within FontFaceSet::UpdateRules. This change ends up trimming out several other methods that end up not being referenced.
Attachment #8501580 - Flags: review?(dbaron)
(Assignee)

Comment 9

4 years ago
tryserver build (in progress):
https://tbpl.mozilla.org/?tree=Try&rev=e1f37d2054bc

Comment 10

4 years ago
Crash in Mozilla/5.0 (X11; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0 ID:20141004030203 CSet: 229801d17f7e
openSUSE 13.2 Beta1 KDE 4.14.1
My crashes:

https://crash-stats.mozilla.com/report/index/bp-ddfc0b7f-c4e9-4af3-ad6d-c1eef2141007
https://crash-stats.mozilla.com/report/index/bp-d517a324-b0a3-4828-9619-99d1e2141007
(Assignee)

Comment 11

4 years ago
Comment on attachment 8501580 [details] [diff] [review]
patch, eliminate need to reference FontFace object from @font-face rules

Canceling review now, getting a couple test failures on try.

trybuild
https://tbpl.mozilla.org/?tree=Try&rev=a0f532223991
Attachment #8501580 - Flags: review?(dbaron)
(Assignee)

Comment 12

4 years ago
(In reply to Raul Malea from comment #10)
> Crash in Mozilla/5.0 (X11; Linux x86_64; rv:35.0) Gecko/20100101
> Firefox/35.0 ID:20141004030203 CSet: 229801d17f7e
> openSUSE 13.2 Beta1 KDE 4.14.1
> My crashes:
> 
> https://crash-stats.mozilla.com/report/index/bp-ddfc0b7f-c4e9-4af3-ad6d-
> c1eef2141007
> https://crash-stats.mozilla.com/report/index/bp-d517a324-b0a3-4828-9619-
> 99d1e2141007

These are both crashes from bug 1077746.
(Assignee)

Updated

4 years ago
Duplicate of this bug: 1080086
(Assignee)

Comment 14

4 years ago
Created attachment 8502238 [details] [diff] [review]
patch v2, eliminate need to reference FontFace object from @font-face rules

Fixed up the problem causing the mochitest failures.
Attachment #8501580 - Attachment is obsolete: true
Attachment #8502238 - Flags: review?(dholbert)
(Assignee)

Updated

4 years ago
Attachment #8501578 - Flags: review?(dbaron) → review?(dholbert)
(Assignee)

Updated

4 years ago
Blocks: 1079199
(Assignee)

Updated

4 years ago
Blocks: 1079620
(Assignee)

Updated

4 years ago
Duplicate of this bug: 1079109
Comment on attachment 8502238 [details] [diff] [review]
patch v2, eliminate need to reference FontFace object from @font-face rules

Review of attachment 8502238 [details] [diff] [review]:
-----------------------------------------------------------------

Stealing as I have a free moment.  This looks fine to me, thanks -- you're right that we really only need to keep a track of the rule <--> FontFace association during UpdateRules.
Attachment #8502238 - Flags: review?(dholbert) → review+
Comment on attachment 8501578 [details] [diff] [review]
patch, backout fix from bug 1077746

rs=me
Attachment #8501578 - Flags: review?(dholbert) → review+
https://hg.mozilla.org/mozilla-central/rev/f214e1efac1b
https://hg.mozilla.org/mozilla-central/rev/3d2e70bf3813
Status: NEW → RESOLVED
Last Resolved: 4 years ago
status-firefox35: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla35
(Assignee)

Comment 20

4 years ago
This appears to have resolved the problem, no crashes on Nightly for this signature since the patch landed (10/9, in 10/10 Nightly).
(In reply to John Daggett (:jtd) from comment #20)
> This appears to have resolved the problem, no crashes on Nightly for this
> signature since the patch landed (10/9, in 10/10 Nightly).

This is still true after a couple more days.

Alice, could you please confirm this issue is resolved for you?
Flags: needinfo?(alice0775)
(Reporter)

Comment 22

4 years ago
I cannot reproduce the crash on latest Nightly.

https://hg.mozilla.org/mozilla-central/rev/62f0b771583c
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 ID:20141015030202
Flags: needinfo?(alice0775)
Thank you Alice.
Status: RESOLVED → VERIFIED
status-firefox35: fixed → verified
You need to log in before you can comment on or make changes to this bug.