Closed Bug 1236398 Opened 5 years ago Closed 2 years ago

crash in nsRuleNode::WalkRuleTree

Categories

(Core :: CSS Parsing and Computation, defect)

Product:
Core
Component:
CSS Parsing and Computation
Version:
46 Branch
Platform:
x86
Windows NT
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED INCOMPLETE
Tracking Flags:
Tracking Status
firefox46 --- affected
firefox48 --- affected
firefox49 --- affected
firefox-esr45 --- affected
firefox50 --- affected
firefox51 --- affected
firefox52 --- wontfix

People

(Reporter: mats, Unassigned)

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

crash1.xml
38.21 KB, text/xml
Details 
This bug was filed from the Socorro interface and is 
report bp-0f39aaa9-c12e-4ff8-bb4d-422612151228.
=============================================================

nsRuleNode::WalkRuleTree is the #1 signature in 46.0a1 Top Crash data for
the past week so I suspect this is a recent trunk regression.
(the signature doesn't occur in 45.0a2 Top Crash list)
It seems to have started around 14 days ago or so.
It only occurs on Windows.
It's mostly a startup crash with the following stack:

@0x29809b3d
nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*)
nsBoxFrame::GetInitialOrientation(bool&)
nsBoxFrame::DidSetStyleContext(nsStyleContext*)
nsFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*)
nsBoxFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*)
nsCSSFrameConstructor::SetUpDocElementContainingBlock(nsIContent*)
nsCSSFrameConstructor::ConstructDocElementFrame(mozilla::dom::Element*, nsILayoutHistoryState*)
nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsIContent*, nsILayoutHistoryState*, bool)
nsCSSFrameConstructor::ContentInserted(nsIContent*, nsIContent*, nsILayoutHistoryState*, bool)
PresShell::Initialize(int, int)
mozilla::dom::XULDocument::StartLayout()
mozilla::dom::XULDocument::DoneWalking()
mozilla::dom::XULDocument::StyleSheetLoaded(mozilla::CSSStyleSheet*, bool, nsresult)
mozilla::css::Loader::SheetComplete(mozilla::css::SheetLoadData*, nsresult)
mozilla::css::Loader::ParseSheet(nsAString_internal const&, mozilla::css::SheetLoadData*, bool&)
mozilla::css::SheetLoadData::OnStreamComplete(nsIUnicharStreamLoader*, nsISupports*, nsresult, nsAString_internal const&)
nsUnicharStreamLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult)
nsJARChannel::OnStopRequest(nsIRequest*, nsISupports*, nsresult)
nsInputStreamPump::OnStateStop()
nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*)
nsInputStreamReadyEvent::Run()
nsThread::ProcessNextEvent(bool, bool*)
Crash volume for signature 'nsRuleNode::WalkRuleTree':
 - nightly (version 51): 2 crashes from 2016-08-01.
 - aurora  (version 50): 2 crashes from 2016-08-01.
 - beta    (version 49): 60 crashes from 2016-08-02.
 - release (version 48): 96 crashes from 2016-07-25.
 - esr     (version 45): 163 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       1       1       0
 - aurora        1       1       0
 - beta         26      17       3
 - release      35      33      15
 - esr          10      13       7

Affected platforms: Windows, Mac OS X

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly           #661
 - aurora            #1031
 - beta    #600      #679
 - release #752
 - esr     #490
status-firefox48: --- → affected
status-firefox49: --- → affected
status-firefox50: --- → affected
status-firefox51: --- → affected
status-firefox-esr45: --- → affected
Crash volume for signature 'nsRuleNode::WalkRuleTree':
 - nightly (version 52): 2 crashes from 2016-09-19.
 - aurora  (version 51): 6 crashes from 2016-09-19.
 - beta    (version 50): 44 crashes from 2016-09-20.
 - release (version 49): 74 crashes from 2016-09-05.
 - esr     (version 45): 255 crashes from 2016-06-01.

Crash volume on the last weeks (Week N is from 10-03 to 10-09):
            W. N-1  W. N-2
 - nightly       1       1
 - aurora        0       6
 - beta         37       7
 - release      52      22
 - esr          61      30

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly           #999
 - aurora
 - beta    #517      #322
 - release #965      #697
 - esr     #175
status-firefox52: --- → affected
I have the similar Crash as well :
https://crash-stats.mozilla.com/report/index/de5cfb92-128e-482d-95e1-17e162170308 

In Firefox ESR, I have added the attachement for reproducing the issue.
Attached file crash1.xml — 
Too late for firefox 52, mass-wontfix.
status-firefox52: affected → wontfix
nsRuleNode is gone so it's not worth tracking these signatures anymore.
I'll add the test in comment 4 as a crashtest.
Status: NEW → RESOLVED
Closed: 2 years ago
Flags: in-testsuite+
Resolution: --- → INCOMPLETE
Pushed by mpalmgren@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/37f874064e54
Disable this crashtest for now since it crashes stylo!  r=bustage  CLOSED TREE
You need to log in before you can comment on or make changes to this bug.