1357004 - Crash in nsTHashtable<T>::s_HashKey | mozilla::FramePropertyTable::GetInternal

Status: RESOLVED INCOMPLETE

(Core :: Layout, defect, P5)

Description

[baffclan]

This bug was filed from the Socorro interface and is 
report bp-0ca9420e-a3c9-4232-8a36-58b8d2170417.
=============================================================

Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	nsTHashtable<nsRefPtrHashKey<mozilla::dom::Animation> >::s_HashKey(void const*) 	obj-firefox/dist/include/nsTHashtable.h:375
1 	xul.dll 	mozilla::FramePropertyTable::GetInternal(nsIFrame const*, mozilla::FramePropertyDescriptorUntyped const*, bool*) 	layout/base/FramePropertyTable.cpp:79
2 	xul.dll 	mozilla::FrameLayerBuilder::GetPaintedLayerScaleForFrame(nsIFrame*) 	layout/painting/FrameLayerBuilder.cpp:5866
3 	xul.dll 	mozilla::ScrollFrameHelper::GetScrolledRect() 	layout/generic/nsGfxScrollFrame.cpp:5809
4 	xul.dll 	mozilla::ScrollFrameHelper::GetScrollRange(int, int) 	layout/generic/nsGfxScrollFrame.cpp:3845
5 	xul.dll 	mozilla::ScrollFrameHelper::GetScrollRangeForClamping() 	layout/generic/nsGfxScrollFrame.cpp:3859
6 	xul.dll 	mozilla::ScrollFrameHelper::ExpandRectToNearlyVisible(nsRect const&) 	layout/generic/nsGfxScrollFrame.cpp:3158
7 	xul.dll 	nsHTMLScrollFrame::ExpandRectToNearlyVisible(nsRect const&) 	layout/generic/nsGfxScrollFrame.h:900
8 	xul.dll 	mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible(nsIFrame*, nsRect const&, mozilla::Maybe<nsClassHashtable<nsUint64HashKey, mozilla::gfx::IntRegionTyped<mozilla::CSSPixel> > >&, bool) 	layout/base/PresShell.cpp:6029
9 	xul.dll 	mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible(nsIFrame*, nsRect const&, mozilla::Maybe<nsClassHashtable<nsUint64HashKey, mozilla::gfx::IntRegionTyped<mozilla::CSSPixel> > >&, bool) 	layout/base/PresShell.cpp:6060
10 	xul.dll 	mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible(nsIFrame*, nsRect const&, mozilla::Maybe<nsClassHashtable<nsUint64HashKey, mozilla::gfx::IntRegionTyped<mozilla::CSSPixel> > >&, bool) 	layout/base/PresShell.cpp:6060
11 	xul.dll 	mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible(nsIFrame*, nsRect const&, mozilla::Maybe<nsClassHashtable<nsUint64HashKey, mozilla::gfx::IntRegionTyped<mozilla::CSSPixel> > >&, bool) 	layout/base/PresShell.cpp:6060
12 	xul.dll 	mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible(nsIFrame*, nsRect const&, mozilla::Maybe<nsClassHashtable<nsUint64HashKey, mozilla::gfx::IntRegionTyped<mozilla::CSSPixel> > >&, bool) 	layout/base/PresShell.cpp:6060
13 	xul.dll 	mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible(nsIFrame*, nsRect const&, mozilla::Maybe<nsClassHashtable<nsUint64HashKey, mozilla::gfx::IntRegionTyped<mozilla::CSSPixel> > >&, bool) 	layout/base/PresShell.cpp:6060
14 	xul.dll 	mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible(nsIFrame*, nsRect const&, mozilla::Maybe<nsClassHashtable<nsUint64HashKey, mozilla::gfx::IntRegionTyped<mozilla::CSSPixel> > >&, bool) 	layout/base/PresShell.cpp:6060
15 	xul.dll 	mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible(nsIFrame*, nsRect const&, mozilla::Maybe<nsClassHashtable<nsUint64HashKey, mozilla::gfx::IntRegionTyped<mozilla::CSSPixel> > >&, bool) 	layout/base/PresShell.cpp:6060
16 	xul.dll 	mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible(nsIFrame*, nsRect const&, mozilla::Maybe<nsClassHashtable<nsUint64HashKey, mozilla::gfx::IntRegionTyped<mozilla::CSSPixel> > >&, bool) 	layout/base/PresShell.cpp:6060
17 	xul.dll 	mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible(nsIFrame*, nsRect const&, mozilla::Maybe<nsClassHashtable<nsUint64HashKey, mozilla::gfx::IntRegionTyped<mozilla::CSSPixel> > >&, bool) 	layout/base/PresShell.cpp:6060
18 	xul.dll 	mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible(nsIFrame*, nsRect const&, mozilla::Maybe<nsClassHashtable<nsUint64HashKey, mozilla::gfx::IntRegionTyped<mozilla::CSSPixel> > >&, bool) 	layout/base/PresShell.cpp:6060
19 	xul.dll 	mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible(nsIFrame*, nsRect const&, mozilla::Maybe<nsClassHashtable<nsUint64HashKey, mozilla::gfx::IntRegionTyped<mozilla::CSSPixel> > >&, bool) 	layout/base/PresShell.cpp:6060
20 	xul.dll 	mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible(nsIFrame*, nsRect const&, mozilla::Maybe<nsClassHashtable<nsUint64HashKey, mozilla::gfx::IntRegionTyped<mozilla::CSSPixel> > >&, bool) 	layout/base/PresShell.cpp:6060
21 	xul.dll 	mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible(nsIFrame*, nsRect const&, mozilla::Maybe<nsClassHashtable<nsUint64HashKey, mozilla::gfx::IntRegionTyped<mozilla::CSSPixel> > >&, bool) 	layout/base/PresShell.cpp:6060
22 	xul.dll 	mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible(nsIFrame*, nsRect const&, mozilla::Maybe<nsClassHashtable<nsUint64HashKey, mozilla::gfx::IntRegionTyped<mozilla::CSSPixel> > >&, bool) 	layout/base/PresShell.cpp:6060
23 	xul.dll 	mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible(nsIFrame*, nsRect const&, mozilla::Maybe<nsClassHashtable<nsUint64HashKey, mozilla::gfx::IntRegionTyped<mozilla::CSSPixel> > >&, bool) 	layout/base/PresShell.cpp:6060
24 	xul.dll 	mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible(nsIFrame*, nsRect const&, mozilla::Maybe<nsClassHashtable<nsUint64HashKey, mozilla::gfx::IntRegionTyped<mozilla::CSSPixel> > >&, bool) 	layout/base/PresShell.cpp:6060
25 	xul.dll 	mozilla::PresShell::RebuildApproximateFrameVisibility(nsRect*, bool) 	layout/base/PresShell.cpp:6096
26 	xul.dll 	mozilla::PresShell::DoUpdateApproximateFrameVisibility(bool) 	layout/base/PresShell.cpp:6128
27 	xul.dll 	mozilla::detail::RunnableMethodImpl<mozilla::dom::HTMLMediaElement::StreamListener* const, void ( mozilla::dom::HTMLMediaElement::StreamListener::*)(void), 1, 0>::Run() 	obj-firefox/dist/include/nsThreadUtils.h:890
28 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1264
29 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:96
30 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:301
31 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:231
32 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:211
33 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp:156
34 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp:269
35 	xul.dll 	XRE_RunAppShell() 	toolkit/xre/nsEmbedFunctions.cpp:869
36 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:269
37 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:231
38 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:211
39 	xul.dll 	XRE_InitChildProcess(int, char** const, XREChildData const*) 	toolkit/xre/nsEmbedFunctions.cpp:693
40 	firefox.exe 	content_process_main(mozilla::Bootstrap*, int, char** const) 	ipc/contentproc/plugin-container.cpp:64
41 	firefox.exe 	NS_internal_main(int, char**, char**) 	browser/app/nsBrowserApp.cpp:286
42 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:115
43 	firefox.exe 	__scrt_common_main_seh 	f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:253
44 	kernel32.dll 	BaseThreadInitThunk 	
45 	ntdll.dll 	RtlUserThreadStart 	


Application Basics: 
Name: Firefox
Version: 54.0a2
Build ID: 20170416004007
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0) Gecko/20100101 Firefox/54.0

Comment 1

[Astley Chen (inactive)]

2 occurrences on Fennec & desktop for last 3 months.

https://crash-stats.mozilla.com/signature/?signature=nsTHashtable%3CT%3E%3A%3As_HashKey%20%7C%20mozilla%3A%3AFramePropertyTable%3A%3AGetInternal&date=%3E%3D2017-05-01T02%3A40%3A00.000Z&date=%3C2017-07-17T02%3A40%3A00.000Z

Comment 2

[Mats Palmgren (inactive)]

FramePropertyTable no longer exist; it was replaced by an array of
properties on each frame.  I looked through signatures matching
"FrameProperty" to see if we got crashes on FramePropertyDescriptor
instead, or "GetProperty", but it doesn't seem so.

Anyway, no need to continue tracking this signature...