1346715 - Crash in nsFrame::GetXULPrefSize with LavaFox themes

Status: RESOLVED WORKSFORME

(Firefox :: Extension Compatibility, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-ccb5b037-2280-4890-917b-ca82b2170313.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	nsFrame::GetXULPrefSize(nsBoxLayoutState&) 	layout/generic/nsFrame.cpp:9384
1 	xul.dll 	nsVideoFrame::GetVideoIntrinsicSize(nsRenderingContext*) 	layout/generic/nsVideoFrame.cpp:610
2 	xul.dll 	nsVideoFrame::GetMinISize(nsRenderingContext*) 	layout/generic/nsVideoFrame.cpp:546
3 	xul.dll 	nsLayoutUtils::IntrinsicForAxis(mozilla::PhysicalAxis, nsRenderingContext*, nsIFrame*, nsLayoutUtils::IntrinsicISizeType, unsigned int, int) 	layout/base/nsLayoutUtils.cpp:5067
4 	xul.dll 	nsLayoutUtils::IntrinsicForContainer(nsRenderingContext*, nsIFrame*, nsLayoutUtils::IntrinsicISizeType, unsigned int) 	layout/base/nsLayoutUtils.cpp:5199
5 	xul.dll 	nsFrame::AddInlineMinISize(nsRenderingContext*, nsIFrame::InlineMinISizeData*) 	layout/generic/nsFrame.cpp:4393
6 	xul.dll 	nsBlockFrame::GetMinISize(nsRenderingContext*) 	layout/generic/nsBlockFrame.cpp:773
7 	xul.dll 	nsLayoutUtils::IntrinsicForAxis(mozilla::PhysicalAxis, nsRenderingContext*, nsIFrame*, nsLayoutUtils::IntrinsicISizeType, unsigned int, int) 	layout/base/nsLayoutUtils.cpp:5067
8 	xul.dll 	nsLayoutUtils::IntrinsicForContainer(nsRenderingContext*, nsIFrame*, nsLayoutUtils::IntrinsicISizeType, unsigned int) 	layout/base/nsLayoutUtils.cpp:5199
9 	xul.dll 	nsPlaceholderFrame::AddInlineMinISize(nsRenderingContext*, nsIFrame::InlineMinISizeData*) 	layout/generic/nsPlaceholderFrame.cpp:78
10 	xul.dll 	nsBlockFrame::GetMinISize(nsRenderingContext*) 	layout/generic/nsBlockFrame.cpp:773
11 	xul.dll 	nsLayoutUtils::IntrinsicForAxis(mozilla::PhysicalAxis, nsRenderingContext*, nsIFrame*, nsLayoutUtils::IntrinsicISizeType, unsigned int, int) 	layout/base/nsLayoutUtils.cpp:5067
12 	xul.dll 	nsLayoutUtils::IntrinsicForContainer(nsRenderingContext*, nsIFrame*, nsLayoutUtils::IntrinsicISizeType, unsigned int) 	layout/base/nsLayoutUtils.cpp:5199
13 	xul.dll 	nsBlockFrame::GetMinISize(nsRenderingContext*) 	layout/generic/nsBlockFrame.cpp:753
14 	xul.dll 	nsHTMLScrollFrame::GetMinISize(nsRenderingContext*) 	layout/generic/nsGfxScrollFrame.cpp:801
15 	xul.dll 	nsFrame::ShrinkWidthToFit(nsRenderingContext*, int, nsIFrame::ComputeSizeFlags) 	layout/generic/nsFrame.cpp:5406
16 	xul.dll 	nsContainerFrame::ComputeAutoSize(nsRenderingContext*, mozilla::WritingMode, mozilla::LogicalSize const&, int, mozilla::LogicalSize const&, mozilla::LogicalSize const&, mozilla::LogicalSize const&, nsIFrame::ComputeSizeFlags) 	layout/generic/nsContainerFrame.cpp:939
17 	xul.dll 	nsFrame::ComputeSize(nsRenderingContext*, mozilla::WritingMode, mozilla::LogicalSize const&, int, mozilla::LogicalSize const&, mozilla::LogicalSize const&, mozilla::LogicalSize const&, nsIFrame::ComputeSizeFlags) 	layout/generic/nsFrame.cpp:4662
18 	xul.dll 	mozilla::ReflowInput::InitConstraints(nsPresContext*, mozilla::LogicalSize const&, nsMargin const*, nsMargin const*, nsIAtom*) 	layout/generic/ReflowInput.cpp:2450
19 	xul.dll 	mozilla::ReflowInput::Init(nsPresContext*, mozilla::LogicalSize const*, nsMargin const*, nsMargin const*) 	layout/generic/ReflowInput.cpp:399
20 	xul.dll 	mozilla::ReflowInput::ReflowInput(nsPresContext*, mozilla::ReflowInput const&, nsIFrame*, mozilla::LogicalSize const&, mozilla::LogicalSize const*, unsigned int) 	layout/generic/ReflowInput.cpp:258
21 	xul.dll 	mozilla::Maybe<mozilla::ReflowInput>::emplace<nsPresContext*&, mozilla::ReflowInput const&, nsIFrame*&, mozilla::LogicalSize&>(nsPresContext*&, mozilla::ReflowInput const&, nsIFrame*&, mozilla::LogicalSize&) 	obj-firefox/dist/include/mozilla/Maybe.h:432
22 	xul.dll 	nsLineLayout::ReflowFrame(nsIFrame*, unsigned int&, mozilla::ReflowOutput*, bool&) 	layout/generic/nsLineLayout.cpp:879
23 	xul.dll 	nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) 	layout/generic/nsBlockFrame.cpp:4143
24 	xul.dll 	nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) 	layout/generic/nsBlockFrame.cpp:3944
25 	xul.dll 	nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) 	layout/generic/nsBlockFrame.cpp:3818
26 	xul.dll 	nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) 	layout/generic/nsBlockFrame.cpp:2825
27 	xul.dll 	nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) 	layout/generic/nsBlockFrame.cpp:2361
28 	xul.dll 	nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, unsigned int&) 	layout/generic/nsBlockFrame.cpp:1224
29 	xul.dll 	nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsIFrame*, unsigned int&, nsOverflowAreas*) 	layout/generic/nsAbsoluteContainingBlock.cpp:692
30 	xul.dll 	nsAbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, unsigned int&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsOverflowAreas*) 	layout/generic/nsAbsoluteContainingBlock.cpp:138
31 	xul.dll 	ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, unsigned int&) 	layout/generic/nsViewportFrame.cpp:361
32 	xul.dll 	PresShell::DoReflow(nsIFrame*, bool) 	layout/base/nsPresShell.cpp:9363
33 	xul.dll 	PresShell::ProcessReflowCommands(bool) 	layout/base/nsPresShell.cpp:9536
34 	xul.dll 	PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) 	layout/base/nsPresShell.cpp:4174
35 	xul.dll 	PresShell::FlushPendingNotifications(mozFlushType) 	layout/base/nsPresShell.cpp:4026
36 	xul.dll 	nsDocument::FlushPendingNotifications(mozFlushType) 	dom/base/nsDocument.cpp:7768
37 	xul.dll 	mozilla::dom::Element::GetPrimaryFrame(mozFlushType) 	dom/base/Element.cpp:2194
38 	xul.dll 	mozilla::dom::Element::GetScrollFrame(nsIFrame**, bool) 	dom/base/Element.cpp:649
39 	xul.dll 	mozilla::dom::Element::GetClientAreaRect() 	dom/base/Element.cpp:956
40 	xul.dll 	mozilla::dom::ElementBinding::get_clientWidth 	obj-firefox/dom/bindings/ElementBinding.cpp:2597
41 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:447
42 	xul.dll 	CallGetter 	js/src/vm/NativeObject.cpp:1806
43 	xul.dll 	GetPropertyOperation 	js/src/vm/Interpreter.cpp:192
44 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp:2639
45 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp:405
46 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:477
47 	xul.dll 	InternalCall 	js/src/vm/Interpreter.cpp:504
48 	xul.dll 	JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) 	js/src/jsapi.cpp:2769
49 	xul.dll 	nsXBLProtoImplAnonymousMethod::Execute(nsIContent*, JSAddonId*) 	dom/xbl/nsXBLProtoImplMethod.cpp:322
50 	xul.dll 	nsXBLPrototypeBinding::BindingAttached(nsIContent*) 	dom/xbl/nsXBLPrototypeBinding.cpp:266
51 	xul.dll 	nsXBLBinding::ExecuteAttachedHandler() 	dom/xbl/nsXBLBinding.cpp:637
52 	xul.dll 	nsBindingManager::ProcessAttachedQueueInternal(unsigned int) 	dom/xbl/nsBindingManager.cpp:419
53 	xul.dll 	nsDocument::MaybeEndOutermostXBLUpdate() 	dom/base/nsDocument.cpp:4754
54 	xul.dll 	mozilla::detail::RunnableMethodImpl<void ( nsDocument::*)(void), 1, 0>::Run() 	obj-firefox/dist/include/nsThreadUtils.h:810
55 	xul.dll 	nsContentUtils::RemoveScriptBlocker() 	dom/base/nsContentUtils.cpp:5194
56 	xul.dll 	PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) 	layout/base/nsPresShell.cpp:4140
57 	xul.dll 	nsRefreshDriver::Tick(__int64, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:1836
58 	xul.dll 	mozilla::RefreshDriverTimer::TickDriver(nsRefreshDriver*, __int64, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:326
59 	xul.dll 	mozilla::RefreshDriverTimer::TickRefreshDrivers(__int64, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) 	layout/base/nsRefreshDriver.cpp:295
60 	xul.dll 	mozilla::RefreshDriverTimer::Tick(__int64, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:316
61 	xul.dll 	mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:663
62 	xul.dll 	mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:583
63 	xul.dll 	mozilla::detail::RunnableMethodImpl<void ( mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp), 1, 0, mozilla::TimeStamp>::Run() 	obj-firefox/dist/include/nsThreadUtils.h:810
64 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1216
65 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:96
66 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:225
67 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:205
68 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp:156
69 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp:262
70 	xul.dll 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp:283
71 	xul.dll 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp:4472
72 	xul.dll 	XREMain::XRE_main(int, char** const, nsXREAppData const*) 	toolkit/xre/nsAppRunner.cpp:4605
73 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:4696
74 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp:282
75 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:115
76 	firefox.exe 	__scrt_common_main_seh 	f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:253
77 	kernel32.dll 	BaseThreadInitThunk 	
78 	ntdll.dll 	__RtlUserThreadStart 	
79 	ntdll.dll 	_RtlUserThreadStart

this crash signature is on the rise since yesterday across various firefox versions on windows. it seems to be correlated to the various variants of the lavafox themes (https://addons.mozilla.org/en-US/firefox/user/zigboom/) being present which have received an update on AMO in the same timeframe. user comments seem to indicate that crashes occur repeatedly on particular sites.

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

The developer has been contacted.

Comment 2

[Sylvain Giroux [:Spoji]]

All LavaFox addons have been updated to version 2.5.0 (and approved on AMO) and contain a fix to this issue.

Comment 3

[[:philipp]]

thank you. the number of reports about this crash is now declining quickly.