Closed Bug 1159873 Opened 10 years ago Closed 2 years ago

crash in nsContainerFrame::GetChildLists(nsTArray<mozilla::layout::FrameChildList>*)

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Version:
41 Branch
Platform:
All
Windows
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 707699
Tracking Flags:
Tracking Status
firefox40 --- affected
firefox41 --- affected
firefox42 --- affected
firefox43 --- affected
firefox44 --- affected
firefox45 --- affected
firefox46 --- affected
firefox47 --- affected
firefox48 --- affected
firefox49 --- affected
firefox-esr38 --- affected
firefox-esr45 --- affected
firefox50 --- affected
firefox51 --- affected
firefox52 --- wontfix
firefox53 --- affected
firefox54 --- affected

People

(Reporter: alex_mayorga, Unassigned)

References

Details

(Keywords: crash, Whiteboard: ShutDownKill)

This bug was filed from the Socorro interface and is report bp-fdd84145-b57a-454e-b59c-87b152150429. ============================================================= Crashing Thread Frame Module Signature Source 0 xul.dll nsContainerFrame::GetChildLists(nsTArray<mozilla::layout::FrameChildList>*) layout/generic/nsContainerFrame.cpp 1 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 2 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 3 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 4 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 5 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 6 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 7 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 8 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 9 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 10 xul.dll PresShell::CaptureHistoryState(nsILayoutHistoryState**) layout/base/nsPresShell.cpp 11 xul.dll nsDocShell::PersistLayoutHistoryState() docshell/base/nsDocShell.cpp 12 xul.dll nsDocShell::Destroy() docshell/base/nsDocShell.cpp 13 xul.dll nsWebBrowser::SetDocShell(nsIDocShell*) embedding/browser/nsWebBrowser.cpp 14 xul.dll nsWebBrowser::InternalDestroy() embedding/browser/nsWebBrowser.cpp 15 xul.dll nsWebBrowser::Destroy() embedding/browser/nsWebBrowser.cpp 16 xul.dll mozilla::dom::TabChild::DestroyWindow() dom/ipc/TabChild.cpp 17 xul.dll mozilla::dom::TabChild::RecvDestroy() dom/ipc/TabChild.cpp 18 xul.dll mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) obj-firefox/ipc/ipdl/PBrowserChild.cpp 19 xul.dll mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) obj-firefox/ipc/ipdl/PContentChild.cpp 20 xul.dll mozilla::ipc::MessageChannel::OnMaybeDequeueOne() ipc/glue/MessageChannel.cpp 21 xul.dll RunnableMethod<mozilla::ipc::MessageChannel, bool ( mozilla::ipc::MessageChannel::*)(void), Tuple0>::Run() ipc/chromium/src/base/task.h 22 xul.dll MessageLoop::DoWork() ipc/chromium/src/base/message_loop.cc 23 xul.dll mozilla::ipc::DoWorkRunnable::Run() ipc/glue/MessagePump.cpp 24 xul.dll nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp 25 xul.dll NS_ProcessNextEvent(nsIThread*, bool) xpcom/glue/nsThreadUtils.cpp 26 xul.dll nsXMLHttpRequest::Send(nsIVariant*, mozilla::dom::Nullable<nsXMLHttpRequest::RequestBody> const&) dom/base/nsXMLHttpRequest.cpp 27 xul.dll nsXMLHttpRequest::Send(JSContext*, mozilla::ErrorResult&) dom/base/nsXMLHttpRequest.h 28 xul.dll mozilla::dom::XMLHttpRequestBinding::send obj-firefox/dom/bindings/XMLHttpRequestBinding.cpp 29 xul.dll mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) dom/bindings/BindingUtils.cpp 30 xul.dll js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/vm/Interpreter.cpp 31 xul.dll Interpret js/src/vm/Interpreter.cpp 32 xul.dll js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp 33 xul.dll js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/vm/Interpreter.cpp 34 xul.dll js::fun_call(JSContext*, unsigned int, JS::Value*) js/src/jsfun.cpp 35 xul.dll js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/vm/Interpreter.cpp 36 xul.dll Interpret js/src/vm/Interpreter.cpp 37 xul.dll js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp 38 xul.dll js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/vm/Interpreter.cpp 39 xul.dll js::fun_apply(JSContext*, unsigned int, JS::Value*) js/src/jsfun.cpp 40 xul.dll js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/vm/Interpreter.cpp 41 xul.dll Interpret js/src/vm/Interpreter.cpp 42 xul.dll js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp 43 xul.dll js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/vm/Interpreter.cpp 44 xul.dll js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 45 xul.dll js::jit::DoCallFallback js/src/jit/BaselineIC.cpp 46 @0x3662bc
Crash Signature: [@ nsContainerFrame::GetChildLists(nsTArray<mozilla::layout::FrameChildList>*)] → [@ nsContainerFrame::GetChildLists(nsTArray<mozilla::layout::FrameChildList>*)] [@ nsContainerFrame::GetChildLists]
[@ nsContainerFrame::GetChildLists ] Win7, FF45.0a1, 64bit https://crash-stats.mozilla.com/report/index/33c427c5-731c-4566-9af0-fa75c2151107 Crashing Thread Frame Module Signature Source 0 xul.dll nsContainerFrame::GetChildLists(nsTArray<mozilla::layout::FrameChildList>*) layout/generic/nsContainerFrame.cpp 1 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 2 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 3 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 4 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 5 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 6 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 7 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 8 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 9 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 10 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 11 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 12 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 13 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 14 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 15 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 16 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 17 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 18 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 19 xul.dll nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*) layout/base/nsFrameManager.cpp 20 xul.dll PresShell::CaptureHistoryState(nsILayoutHistoryState**) layout/base/nsPresShell.cpp 21 xul.dll nsDocShell::PersistLayoutHistoryState() docshell/base/nsDocShell.cpp 22 xul.dll nsDocShell::Destroy() docshell/base/nsDocShell.cpp 23 xul.dll nsWebBrowser::SetDocShell(nsIDocShell*) embedding/browser/nsWebBrowser.cpp 24 xul.dll nsWebBrowser::InternalDestroy() embedding/browser/nsWebBrowser.cpp 25 xul.dll nsWebBrowser::Destroy() embedding/browser/nsWebBrowser.cpp 26 xul.dll mozilla::dom::TabChild::DestroyWindow() dom/ipc/TabChild.cpp 27 xul.dll mozilla::dom::TabChild::RecvDestroy() dom/ipc/TabChild.cpp 28 xul.dll mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) obj-firefox/ipc/ipdl/PBrowserChild.cpp 29 xul.dll mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) obj-firefox/ipc/ipdl/PContentChild.cpp 30 xul.dll mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) ipc/glue/MessageChannel.cpp 31 xul.dll mozilla::ipc::MessageChannel::DispatchMessageW(IPC::Message const&) ipc/glue/MessageChannel.cpp 32 xul.dll mozilla::ipc::MessageChannel::OnMaybeDequeueOne() ipc/glue/MessageChannel.cpp 33 xul.dll RunnableMethod<mozilla::ipc::MessageChannel, bool ( mozilla::ipc::MessageChannel::*)(void), Tuple0>::Run() ipc/chromium/src/base/task.h 34 xul.dll MessageLoop::DoWork() ipc/chromium/src/base/message_loop.cc 35 xul.dll mozilla::ipc::DoWorkRunnable::Run() ipc/glue/MessagePump.cpp 36 xul.dll nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp 37 xul.dll mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp 38 xul.dll mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp 39 xul.dll MessageLoop::RunHandler() ipc/chromium/src/base/message_loop.cc 40 xul.dll MessageLoop::Run() ipc/chromium/src/base/message_loop.cc 41 xul.dll nsBaseAppShell::Run() widget/nsBaseAppShell.cpp 42 xul.dll nsAppShell::Run() widget/windows/nsAppShell.cpp 43 xul.dll XRE_RunAppShell toolkit/xre/nsEmbedFunctions.cpp 44 xul.dll mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp 45 xul.dll MessageLoop::RunHandler() ipc/chromium/src/base/message_loop.cc 46 xul.dll MessageLoop::Run() ipc/chromium/src/base/message_loop.cc 47 xul.dll XRE_InitChildProcess toolkit/xre/nsEmbedFunctions.cpp 48 plugin-container.exe wmain toolkit/xre/nsWindowsWMain.cpp 49 plugin-container.exe __tmainCRTStartup f:/dd/vctools/crt/crtw32/startup/crt0.c:255 Ø 50 kernel32.dll kernel32.dll@0x159dc Ø 51 ntdll.dll ntdll.dll@0x2a630
Blocks: shutdownkill
status-firefox41: --- → affected
status-firefox42: --- → affected
status-firefox43: --- → affected
status-firefox44: --- → affected
status-firefox45: --- → affected
Component: Untriaged → Layout
OS: Windows NT → Windows
Product: Firefox → Core
Hardware: Unspecified → All
Whiteboard: ShutDownKill
Version: Trunk → 41 Branch
From the crash signature nsContainerFrame::GetChildLists, the current affected versions are: - Nightly: 47 - Aurora: 46 - Beta: 44.0b1, 44.0b4, 44.0b9, 44.0b99, 45.0b1, 45.0b2
Updating crash signature to reflect changes to signature generation made in bug 1269817 (although reports older than a week will not be reprocessed).
Crash Signature: [@ nsContainerFrame::GetChildLists(nsTArray<mozilla::layout::FrameChildList>*)] [@ nsContainerFrame::GetChildLists] → [@ IPCError-browser | ShutDownKill ]
183 crashes (36 startup) in the past week at https://crash-stats.mozilla.com/signature/?signature=nsContainerFrame%3A%3AGetChildLists
Crash Signature: [@ IPCError-browser | ShutDownKill ] → [@ nsContainerFrame::GetChildLists]
status-firefox49: --- → affected
status-firefox50: --- → affected
Crash volume for signature 'nsContainerFrame::GetChildLists': - nightly (version 52): 0 crashes from 2016-09-19. - aurora (version 51): 2 crashes from 2016-09-19. - beta (version 50): 61 crashes from 2016-09-20. - release (version 49): 331 crashes from 2016-09-05. - esr (version 45): 45 crashes from 2016-06-01. Crash volume on the last weeks (Week N is from 10-03 to 10-09): W. N-1 W. N-2 - nightly 0 0 - aurora 2 0 - beta 41 20 - release 277 54 - esr 4 4 Affected platforms: Windows, Linux Crash rank on the last 7 days: Browser Content Plugin - nightly - aurora #517 - beta #572 #176 - release #574 #62 - esr #1674
status-firefox51: --- → affected
Crash volume for signature 'nsContainerFrame::GetChildLists': - nightly (version 52): 1 crash from 2016-09-19. - aurora (version 51): 7 crashes from 2016-09-19. - beta (version 50): 171 crashes from 2016-09-20. - release (version 49): 1067 crashes from 2016-09-05. - esr (version 45): 26 crashes from 2016-07-25. Crash volume on the last weeks (Week N is from 10-17 to 10-23): W. N-1 W. N-2 W. N-3 W. N-4 - nightly 0 1 0 0 - aurora 2 2 2 0 - beta 32 61 41 20 - release 331 306 277 54 - esr 4 2 3 4 Affected platforms: Windows, Linux Crash rank on the last 7 days: Browser Content Plugin - nightly - aurora #292 - beta #585 #149 - release #567 #50 - esr #6162
status-firefox52: --- → affected
Crash Signature: [@ nsContainerFrame::GetChildLists] → [@ nsContainerFrame::GetChildLists] [@ nsContainerFrame::GetChildLists(nsTArray<T>*)]
status-firefox53: --- → affected
status-firefox54: --- → affected
Crash Signature: [@ nsContainerFrame::GetChildLists] [@ nsContainerFrame::GetChildLists(nsTArray<T>*)] → [@ nsContainerFrame::GetChildLists]
Mass wontfix for bugs affecting firefox 52.
status-firefox52: affected → wontfix
QA Whiteboard: qa-not-actionable
Severity: critical → S2

This seems to just be a variant of bug 707699. Same function on an ancestor class, which is really just getting tripped over when we do a full-frametree walk and discover latent bustage, as in bug 707699 comment 15.

I'm going to merge this into bug 707699.

Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ nsContainerFrame::GetChildLists]
You need to log in before you can comment on or make changes to this bug.