1370750 - Crash in UnhookTextRunFromFrames

Status: RESOLVED WORKSFORME

(Core :: Layout: Text and Fonts, defect)

Description

[Ting-Yu Chou [:ting] (away)]

This bug was filed from the Socorro interface and is 
report bp-7778b9e2-bcc3-433d-8022-fbcc80170606.
=============================================================
Top #16 of Nightly 20170604030205 on Windows, 13 reports from a single installation. But there're 153 reports from 50 installations in the past week.

Comment 1

[Ting-Yu Chou [:ting] (away)]

The stack in bp-7778b9e2-bcc3-433d-8022-fbcc80170606 is different from the others like:

  bp-584ba926-2bc0-42be-9dc4-b47e40170607 (invalid userDataFrame 0x00000042),
  bp-14e9fc16-5580-41d2-bf01-f05880170606 (invalid userDataFrame 0x0000001e),
  bp-74867d27-f474-4e0d-9251-5067c0170606 (invalid userDataFrame 0x00000000),
  bp-27c540db-d986-4198-bde7-883bd0170526 (invalid userData 0x00000000`00000002)

Better ignore it as it is from a single installation.

Comment 2

[Jeremy Chen ([e-mail])]

There's no crash report with Signature:[@ UnhookTextRunFromFrames ] on Firefox 57. All the reports are on Firefox 56.0b12 or earlier. Resolve this.

Comment 3

[Jonathan Kew [:jfkthame]]

If we don't actually know what fixed this, but it seems to be OK now, I think WORKSFORME is a better resolution. FIXED generally implies that we can point to a specific patch that fixed the bug.

Comment 4

[Trevor Skywalker]

(In reply to Jeremy Chen [:jeremychen] UTC+8 (away) ([e-mail]) from comment #2)
> There's no crash report with Signature:[@ UnhookTextRunFromFrames ] on
> Firefox 57. All the reports are on Firefox 56.0b12 or earlier. Resolve this.

Reopening as there are still crashes with this signature on FFx59(Release) and FFx60(Beta).

It's also showing up as crash signature  [@ IPCError-browser | ShutDownKill ] which is the #1 top crash signature (but contains different bugs from different causes).

Signature replaced with an IPC Channel Error, was: "UnhookTextRunFromFrames"

Firefox 60.0b16 Crash Report [@ IPCError-browser | ShutDownKill ]
ID: 0c917828-a478-4749-a0af-1138c0180503

Uptime 	2,435 seconds (40 minutes and 35 seconds)
Install Age 	124,975 seconds since version was first installed (1 day, 10 hours and 42 minutes)
Install Time 	2018-05-02 09:10:54
Product 	Firefox
Release Channel 	beta
Version 	60.0b16
Build ID 	20180426170554
OS 	Windows 7
OS Version 	6.1.7601 Service Pack 1
Build Architecture 	amd64

App Notes :FP(D00-L1000-W00001000-T000) AdapterVendorID: 0x8086, AdapterDeviceID: 0x0046, AdapterSubsysID: 215a17aa, AdapterDriverVersion: 8.15.10.2622
D2D1.1? DWrite? DWrite+ D2D1.1+ WR? WR- OMTP? OMTP+ WebGL? EGL? EGL+ GL Context? GL Context+ WebGL+ 

Processor Notes 	processor_ip-172-31-14-85_us-west-2_compute_internal_7; Processor2015; non-integer value of "SecondsSinceLastCrash"; Signature replaced with an IPC Channel Error, was: "UnhookTextRunFromFrames"

Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	UnhookTextRunFromFrames 	layout/generic/nsTextFrame.cpp:649
1 	xul.dll 	nsTextFrame::ClearTextRun(nsTextFrame*, nsTextFrame::TextRunType) 	layout/generic/nsTextFrame.cpp:4810
2 	xul.dll 	nsTextFrame::ClearTextRuns() 	layout/generic/nsTextFrame.h:626
3 	xul.dll 	nsTextFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) 	layout/generic/nsTextFrame.cpp:4417
4 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*, mozilla::layout::PostFrameDestroyData&) 	layout/generic/nsLineBox.cpp:402
5 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) 	layout/generic/nsBlockFrame.cpp:330
6 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*, mozilla::layout::PostFrameDestroyData&) 	layout/generic/nsLineBox.cpp:402
7 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) 	layout/generic/nsBlockFrame.cpp:330
8 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*, mozilla::layout::PostFrameDestroyData&) 	layout/generic/nsLineBox.cpp:402
9 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) 	layout/generic/nsBlockFrame.cpp:330
10 	xul.dll 	nsContainerFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) 	layout/generic/nsContainerFrame.cpp:229

46 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp:401
47 	xul.dll 	XRE_RunAppShell() 	toolkit/xre/nsEmbedFunctions.cpp:892
48 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:269
49 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:319
50 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:299
51 	xul.dll 	XRE_InitChildProcess(int, char** const, XREChildData const*) 	toolkit/xre/nsEmbedFunctions.cpp:718
52 	firefox.exe 	content_process_main(mozilla::Bootstrap*, int, char** const) 	ipc/contentproc/plugin-container.cpp:50
53 	firefox.exe 	NS_internal_main(int, char**, char**) 	browser/app/nsBrowserApp.cpp:280
54 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:129
55 	firefox.exe 	__scrt_common_main_seh 	f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:283
56 	kernel32.dll 	BaseThreadInitThunk 	
57 	ntdll.dll 	RtlUserThreadStart

Comment 5

[Jonathan Kew [:jfkthame]]

For UnhookTextRunFromFrames, I don't see any reports from versions later than 60.0.2; in particular, although 61.0 has been released for around 6 weeks, there don't seem to be any crashes from it. I guess we can give it a bit longer, but this is looking like WFM.

(The IPCError-browser | ShutDownKill signature isn't really useful here, as it encompasses all kinds of crashes that are completely unrelated.)

Setting needinfo on myself to remind me to look again in a few weeks, and close this if we're still not getting crashes from current releases.

Comment 6

[Jonathan Kew [:jfkthame]]

There's currently one crash report from 62.0b18: 2fb5f41c-9345-4de0-a1fb-909bf0180820
So this hasn't completely gone away, sadly.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.