1379159 - Crash in nsView::~nsView

Status: RESOLVED FIXED

(Core :: Web Painting, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-46a1eecf-e931-4609-98da-3a6af0170707.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	nsView::~nsView() 	view/nsView.cpp:126
1 	xul.dll 	nsView::`scalar deleting destructor'(unsigned int) 	
2 	xul.dll 	nsView::Destroy() 	view/nsView.cpp:193
3 	xul.dll 	nsView::~nsView() 	view/nsView.cpp:75
4 	xul.dll 	nsView::`scalar deleting destructor'(unsigned int) 	
5 	xul.dll 	nsView::Destroy() 	view/nsView.cpp:193
6 	xul.dll 	nsViewManager::~nsViewManager() 	view/nsViewManager.cpp:80
7 	xul.dll 	nsViewManager::Release() 	obj-firefox/dist/include/nsViewManager.h:33
8 	xul.dll 	nsDocumentViewer::~nsDocumentViewer() 	layout/base/nsDocumentViewer.cpp:602
9 	xul.dll 	nsDocumentViewer::`scalar deleting destructor'(unsigned int) 	
10 	xul.dll 	nsDocumentViewer::Release() 	layout/base/nsDocumentViewer.cpp:563
11 	xul.dll 	nsCOMPtr_base::~nsCOMPtr_base() 	obj-firefox/dist/include/nsCOMPtr.h:294
12 	xul.dll 	mozilla::SegmentedVector<nsCOMPtr<nsISupports>, 4096, mozilla::MallocAllocPolicy>::PopLastN(unsigned int) 	obj-firefox/dist/include/mozilla/SegmentedVector.h:265
13 	xul.dll 	mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*) 	obj-firefox/dist/include/mozilla/dom/BindingUtils.h:2805
14 	xul.dll 	mozilla::IncrementalFinalizeRunnable::ReleaseNow(bool) 	xpcom/base/CycleCollectedJSRuntime.cpp:1322
15 	xul.dll 	mozilla::IncrementalFinalizeRunnable::Run() 	xpcom/base/CycleCollectedJSRuntime.cpp:1356
16 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1418
17 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:96
18 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:301
19 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:231
20 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:211
21 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp:156
22 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp:271
23 	xul.dll 	XRE_RunAppShell() 	toolkit/xre/nsEmbedFunctions.cpp:896
24 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:269
25 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:231
26 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:211
27 	xul.dll 	XRE_InitChildProcess(int, char** const, XREChildData const*) 	toolkit/xre/nsEmbedFunctions.cpp:712
28 	xul.dll 	mozilla::BootstrapImpl::XRE_InitChildProcess(int, char** const, XREChildData const*) 	toolkit/xre/Bootstrap.cpp:65
29 	firefox.exe 	content_process_main(mozilla::Bootstrap*, int, char** const) 	ipc/contentproc/plugin-container.cpp:64
30 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:115
31 	firefox.exe 	__scrt_common_main_seh 	f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:253
32 	kernel32.dll 	BaseThreadInitThunk 	
33 	ntdll.dll 	__RtlUserThreadStart 	
34 	ntdll.dll 	_RtlUserThreadStart

these crashes in the content process on 32bit firefox versions on windows are rising in 55.0b5 & 55.0b6. they all crash with MOZ_RELEASE_ASSERT(!mFrame) from bug 1354933.

Comment 1

[Timothy Nikkel (:tnikkel)]

I requested uplift of the backout patch in bug 1354933. When uplifted that should resolve this bug.

Comment 2

[[:philipp]]

yes, the signature is indeed gone after the uplift