1080086 - shutdown/startup crash in nsCSSValue::nsCSSValue(nsCSSValue const&)

Status: RESOLVED DUPLICATE of bug 1079422

(Core :: Layout, defect)

Description

[Tony Mechelynck [:tonymec]]

Mozilla/5.0 (X11; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0 SeaMonkey/2.32a1 ID:20141008003005 c-c:f2b1c64ab6c3 m-c:e4cfacb76830
=============================================================
This bug was filed from the Socorro interface and is 
report bp-87510ea6-1fff-4d19-aed4-572ed2141008.
=============================================================
Signature 	libxul.so@0x1aa9fc0 | libxul.so@0x1a8c884 | libxul.so@0x1a81623 | libxul.so@0x1a81aea | libxul.so@0x1b68b95 | libxul.so@0x1b36169 | libxul.so@0xbe2880 | libxul.so@0xbf86cb | libxul.so@0xdad652 | libxul.so@0xd9fbf6 | libxul.so@0x17a7e51 | libxul.so@0x1e... More Reports Search
UUID 	87510ea6-1fff-4d19-aed4-572ed2141008
Date Processed	2014-10-08 17:17:12.224326
Uptime	101770
Last Crash	431809 seconds before submission
Install Age 	101769 since version was first installed.
Install Time 	2014-10-07 12:59:48
Product 	SeaMonkey
Version 	2.32a1
Build ID 	20141006193100
Release Channel 	default
OS 	Linux
OS Version 	0.0.0 Linux 3.11.10-21-debug #1 SMP Mon Jul 21 15:28:46 UTC 2014 (9a9565d) x86_64
Build Architecture 	amd64
Build Architecture Info 	family 15 model 4 stepping 1 | 2
Crash Reason 	SIGSEGV
Crash Address 	0x0
User Comments 	after Ctrl+Q and "Save and Quit" (i.e. during closedown)
App Notes 	

OpenGL: VMware, Inc. -- Gallium 0.4 on llvmpipe (LLVM 3.3, 128 bits) -- 2.1 Mesa 9.2.3 -- texture_from_pixmap

Processor Notes 	sp-processor10_phx1_mozilla_com.29527:2012; HybridCrashProcessor; SignatureTool: signature truncated due to length
EMCheckCompatibility 	

False

Winsock LSP 	

Adapter Vendor ID 	

Adapter Device ID 	

=============================================================
The crash was in an hourly build (without symbols). Here is my interpretation of the crashing thread with the help of the crashreporter-symbols.zip
=============================================================
0	libxul.so@0x1aa9fc0	nsCSSValue::nsCSSValue(nsCSSValue const&) +0x0
1	libxul.so@0x1a8c883	mozilla::dom::FontFace::GetFamilyName(nsString&) +0x1b
2	libxul.so@0x1a81622	mozilla::dom::FontFaceSet::InsertRuleFontFace(mozilla::dom::FontFace*, unsigned char, nsTArray<mozilla::dom::FontFaceSet::FontFaceRecord>&, bool&) +0x44
3	libxul.so@0x1a81ae9	mozilla::dom::FontFaceSet::UpdateRules(nsTArray<nsFontFaceRuleContainer> const&) +0x297
4	libxul.so@0x1b68b94	nsPresContext::FlushUserFontSet() +0xda
5	libxul.so@0x1b36168	nsRunnableMethodImpl<void (nsPresContext::*)(), void, true>::Run() +0x26
6	libxul.so@0xbe287f	nsThread::ProcessNextEvent(bool, bool*) +0x2c1
7	libxul.so@0xbf86ca	NS_ProcessNextEvent(nsIThread*, bool) +0x2a
8	libxul.so@0xdad651	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) +0x5f
9	libxul.so@0xd9fbf5	MessageLoop::Run() +0x1f
10	libxul.so@0x17a7e50	nsBaseAppShell::Run() +0x28
11	libxul.so@0x1eceb63	nsAppStartup::Run() +0x2f
12	libxul.so@0x1efbdef	XREMain::XRE_mainRun() +0xb39
13	libxul.so@0x1efe14e	XREMain::XRE_main(int, char**, nsXREAppData const*) +0x11a
14	libxul.so@0x1efe3a2	XRE_main +0xcd
15	seamonkey@0x5cc7	main +0x305

Comment 1

[Tony Mechelynck [:tonymec]]

N.B. Entry 0 is at +0x0. If interpreted as belonging to the very last instruction under the previous symbol, it would be @nsCSSValue::nsCSSValue(float, nsCSSUnit) +0x22.

Comment 2

[Tony Mechelynck [:tonymec]]

(In reply to Tony Mechelynck [:tonymec] from comment #0)
> Mozilla/5.0 (X11; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0
> SeaMonkey/2.32a1 ID:20141008003005 c-c:f2b1c64ab6c3 m-c:e4cfacb76830

Oops! The above is for the nightly with which I reported the crash, not for the crashing hourly.

Comment 3

[Tony Mechelynck [:tonymec]]

Mozilla/5.0 (X11; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0 SeaMonkey/2.32a1 ID:20141008003005 c-c:f2b1c64ab6c3 m-c:e4cfacb76830

This nightly had a startup crash with a very similar stack when restarting the crashed session. Trying again started up with no crash.

bp-0c0e884b-9968-498d-b81b-2e33e2141008 ; Socorro crash report follows:

Signature 	nsCSSValue::nsCSSValue(nsCSSValue const&) More Reports Search
UUID 	0c0e884b-9968-498d-b81b-2e33e2141008
Date Processed	2014-10-08 18:03:47.772128
Uptime	529
Last Crash	2844 seconds before submission
Install Age 	529 since version was first installed.
Install Time 	2014-10-08 17:54:32
Product 	SeaMonkey
Version 	2.32a1
Build ID 	20141008003005
Release Channel 	nightly
OS 	Linux
OS Version 	0.0.0 Linux 3.11.10-21-debug #1 SMP Mon Jul 21 15:28:46 UTC 2014 (9a9565d) x86_64
Build Architecture 	amd64
Build Architecture Info 	family 15 model 4 stepping 1 | 2
Crash Reason 	SIGSEGV
Crash Address 	0x0
User Comments 	during startup
App Notes 	

OpenGL: VMware, Inc. -- Gallium 0.4 on llvmpipe (LLVM 3.3, 128 bits) -- 2.1 Mesa 9.2.3 -- texture_from_pixmap

Processor Notes 	sp-processor10_phx1_mozilla_com.5450:2012; HybridCrashProcessor
EMCheckCompatibility 	

False

Winsock LSP 	

Adapter Vendor ID 	

Adapter Device ID 	

Bugzilla - Report this bug in SeaMonkey Core Plugins Toolkit
Related Bugs

    1079620NEW --- Crash [@nsCSSValue::nsCSSValue(nsCSSValue const&] loading blog.cloudflare.com
    1079422NEW --- crash in nsCSSValue::nsCSSValue(nsCSSValue const&)
    1077746REOPENED --- crash in nsCSSValue::nsCSSValue(nsCSSValue const&) on shutdown with certain sites if @font-face specified in userContent.css or MathML-fonts installed

Crashing Thread
Frame 	Module 	Signature 	Source
0 	libxul.so 	nsCSSValue::nsCSSValue(nsCSSValue const&) 	layout/style/nsCSSValue.cpp
1 	libxul.so 	nsCSSValue::operator=(nsCSSValue const&) 	layout/style/nsCSSValue.cpp
2 	libxul.so 	mozilla::dom::FontFace::GetFamilyName(nsString&) 	layout/style/FontFace.cpp
3 	libxul.so 	mozilla::dom::FontFaceSet::InsertRuleFontFace(mozilla::dom::FontFace*, unsigned char, nsTArray<mozilla::dom::FontFaceSet::FontFaceRecord>&, bool&) 	layout/style/FontFaceSet.cpp
4 	libxul.so 	mozilla::dom::FontFaceSet::UpdateRules(nsTArray<nsFontFaceRuleContainer> const&) 	layout/style/FontFaceSet.cpp
5 	libxul.so 	nsPresContext::FlushUserFontSet() 	layout/base/nsPresContext.cpp
6 	libxul.so 	PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) 	layout/base/nsPresShell.cpp
7 	libxul.so 	PresShell::WillPaint() 	layout/base/nsPresShell.cpp
8 	libxul.so 	nsViewManager::CallWillPaintOnObservers() 	view/nsViewManager.cpp
9 	libxul.so 	nsViewManager::ProcessPendingUpdates() 	view/nsViewManager.cpp
10 	libxul.so 	nsRefreshDriver::Tick(long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
11 	libxul.so 	mozilla::RefreshDriverTimer::Tick() 	layout/base/nsRefreshDriver.cpp
12 	libxul.so 	nsTimerImpl::Fire() 	xpcom/threads/nsTimerImpl.cpp
13 	libxul.so 	nsTimerEvent::Run() 	xpcom/threads/nsTimerImpl.cpp
14 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
15 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
16 	libxul.so 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
17 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
18 	libxul.so 	nsBaseAppShell::Run() 	widget/xpwidgets/nsBaseAppShell.cpp
19 	libxul.so 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp
20 	libxul.so 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
21 	libxul.so 	XREMain::XRE_main(int, char**, nsXREAppData const*) 	toolkit/xre/nsAppRunner.cpp
22 	libxul.so 	XRE_main 	toolkit/xre/nsAppRunner.cpp
23 	seamonkey 	main 	/builds/slave/c-cen-t-lnx64-ntly/build/suite/app/nsSuiteApp.cpp:189
Ø 24 	libc-2.18.so 	libc-2.18.so@0x21be4 	
25 	seamonkey 	mozilla::BinaryPath::Get(char const*, char*) 	xpcom/build/BinaryPath.h

Comment 4

[Tony Mechelynck [:tonymec]]

Hm, Socorro points to bug 1079620, bug 1079422 and bug 1079422 with the same signature. Let's have a look...

Comment 5

[Tony Mechelynck [:tonymec]]

Oops! s/and bug 1079422/and bug 1077746/

I crashed at shutdown after updating some add-ons, then at startup when restarting the crashed session (but only on 1st restart). Dupe of bug 1077746?

Comment 6

[John Daggett (:jtd)]

Yup, this is a dupe of the "new" crasher after the fix landed for bug 1077746.