1236398 - crash in nsRuleNode::WalkRuleTree

Status: RESOLVED INCOMPLETE

(Core :: CSS Parsing and Computation, defect, critical)

Description

[Mats Palmgren (:mats)]

This bug was filed from the Socorro interface and is 
report bp-0f39aaa9-c12e-4ff8-bb4d-422612151228.
=============================================================

nsRuleNode::WalkRuleTree is the #1 signature in 46.0a1 Top Crash data for
the past week so I suspect this is a recent trunk regression.
(the signature doesn't occur in 45.0a2 Top Crash list)
It seems to have started around 14 days ago or so.
It only occurs on Windows.
It's mostly a startup crash with the following stack:

@0x29809b3d
nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*)
nsBoxFrame::GetInitialOrientation(bool&)
nsBoxFrame::DidSetStyleContext(nsStyleContext*)
nsFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*)
nsBoxFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*)
nsCSSFrameConstructor::SetUpDocElementContainingBlock(nsIContent*)
nsCSSFrameConstructor::ConstructDocElementFrame(mozilla::dom::Element*, nsILayoutHistoryState*)
nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsIContent*, nsILayoutHistoryState*, bool)
nsCSSFrameConstructor::ContentInserted(nsIContent*, nsIContent*, nsILayoutHistoryState*, bool)
PresShell::Initialize(int, int)
mozilla::dom::XULDocument::StartLayout()
mozilla::dom::XULDocument::DoneWalking()
mozilla::dom::XULDocument::StyleSheetLoaded(mozilla::CSSStyleSheet*, bool, nsresult)
mozilla::css::Loader::SheetComplete(mozilla::css::SheetLoadData*, nsresult)
mozilla::css::Loader::ParseSheet(nsAString_internal const&, mozilla::css::SheetLoadData*, bool&)
mozilla::css::SheetLoadData::OnStreamComplete(nsIUnicharStreamLoader*, nsISupports*, nsresult, nsAString_internal const&)
nsUnicharStreamLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult)
nsJARChannel::OnStopRequest(nsIRequest*, nsISupports*, nsresult)
nsInputStreamPump::OnStateStop()
nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*)
nsInputStreamReadyEvent::Run()
nsThread::ProcessNextEvent(bool, bool*)

Comment 1

[Release mgmt bot [:sylvestre / :calixte / :marco for bugbug]]

Crash volume for signature 'nsRuleNode::WalkRuleTree':
 - nightly (version 51): 2 crashes from 2016-08-01.
 - aurora  (version 50): 2 crashes from 2016-08-01.
 - beta    (version 49): 60 crashes from 2016-08-02.
 - release (version 48): 96 crashes from 2016-07-25.
 - esr     (version 45): 163 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       1       1       0
 - aurora        1       1       0
 - beta         26      17       3
 - release      35      33      15
 - esr          10      13       7

Affected platforms: Windows, Mac OS X

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly           #661
 - aurora            #1031
 - beta    #600      #679
 - release #752
 - esr     #490

Comment 2

[Release mgmt bot [:sylvestre / :calixte / :marco for bugbug]]

Crash volume for signature 'nsRuleNode::WalkRuleTree':
 - nightly (version 52): 2 crashes from 2016-09-19.
 - aurora  (version 51): 6 crashes from 2016-09-19.
 - beta    (version 50): 44 crashes from 2016-09-20.
 - release (version 49): 74 crashes from 2016-09-05.
 - esr     (version 45): 255 crashes from 2016-06-01.

Crash volume on the last weeks (Week N is from 10-03 to 10-09):
            W. N-1  W. N-2
 - nightly       1       1
 - aurora        0       6
 - beta         37       7
 - release      52      22
 - esr          61      30

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly           #999
 - aurora
 - beta    #517      #322
 - release #965      #697
 - esr     #175

Comment 3

[Dhiraj Mishra]

I have the similar Crash as well :
https://crash-stats.mozilla.com/report/index/de5cfb92-128e-482d-95e1-17e162170308 

In Firefox ESR, I have added the attachement for reproducing the issue.

Comment 4

[Dhiraj Mishra]

Attachment: crash1.xml

Comment 5

[Julien Cristau [:jcristau]]

Too late for firefox 52, mass-wontfix.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/b7e081a8dcd1
Add a crashtest. r=me

Comment 7

[Mats Palmgren (:mats)]

nsRuleNode is gone so it's not worth tracking these signatures anymore.
I'll add the test in comment 4 as a crashtest.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/37f874064e54
Disable this crashtest for now since it crashes stylo!  r=bustage  CLOSED TREE

Comment 9

[Bogdan Tara[:bogdan_tara]]

https://hg.mozilla.org/mozilla-central/rev/b7e081a8dcd1
https://hg.mozilla.org/mozilla-central/rev/37f874064e54