1495632 - Crash in [@ IPCError-browser | ShutDownKill ] signature was [@ core::ptr::drop_in_place<T> ]

Reporter

Description

•

6 years ago

This bug was filed from the Socorro interface and is
report bp-20458ceb-af20-4a7e-9375-ac8850181002.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll static void core::ptr::drop_in_place<smallvec::SmallVec<[style::stylist::Rule; 1]>> src/libcore/ptr.rs:59
1 xul.dll static void style::selector_map::MaybeCaseInsensitiveHashMap<style::gecko_string_cache::Atom, smallvec::SmallVec<[style::stylist::Rule; 1]>>::clear<smallvec::SmallVec<[style::stylist::Rule; 1]>> servo/components/style/selector_map.rs:601
2 xul.dll static void style::stylist::ElementAndPseudoRules::clear servo/components/style/stylist.rs:1900
3 xul.dll static void style::stylist::CascadeData::clear_cascade_data servo/components/style/stylist.rs:2400
4 xul.dll static union core::result::Result< servo/components/style/stylist.rs:2044
5 xul.dll void geckoservo::glue::Servo_StyleSet_FlushStyleSheets servo/ports/geckolib/glue.rs:1533
6 xul.dll mozilla::ServoStyleSet::UpdateStylist layout/style/ServoStyleSet.cpp:1466
7 xul.dll mozilla::PresShell::DoFlushPendingNotifications layout/base/PresShell.cpp:4276
8 xul.dll nsIDocument::FlushPendingNotifications dom/base/nsDocument.cpp:7424
9 xul.dll mozilla::dom::Element::GetBoundingClientRect dom/base/Element.cpp:1074

=============================================================

Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧

Comment 3

•

6 years ago

The “crash signature” seems wrong.  Resetting bug component based on the stack trace.

Component: DOM: Content Processes → CSS Parsing and Computation

Worcester12345

Reporter

Comment 4

•

6 years ago

(In reply to Jed Davis [:jld] (⏰UTC-6) from comment #3)
> The “crash signature” seems wrong.  Resetting bug component based on the
> stack trace.

I'm fairly certain I was told that was where to put it. You'll probably see some others like that as well, then.

Cameron McCormack (:heycam)

Comment 5

•

6 years ago

I don't know that the stack trace definitely points to the style system as being a cause of the shutdown hang.  There's script on the stack flushing styles, so presumably there is some other work going on.

Blocks: IPCError_ShutDownKill

Priority: -- → P3

Summary: Crash in IPCError-browser | ShutDownKill → Crash in [@ IPCError-browser | ShutDownKill ] signature was [@ core::ptr::drop_in_place<T> ]

Trevor Skywalker

Comment 10

•

5 years ago

Signature report for ( [@ IPCError-browser | ShutDownKill ] signature was [@ core::ptr::drop_in_place<T> ] )

Filter - Processor Notes contains: core::ptr::drop_in_place<T>

https://crash-stats.mozilla.org/signature/?processor_notes=~core%3A%3Aptr%3A%3Adrop_in_place%3CT%3E&signature=IPCError-browser%20%7C%20ShutDownKill&date=%3E%3D2019-05-31T06%3A59%3A00.000Z&date=%3C2019-06-07T06%3A59%3A00.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_columns=startup_crash&_sort=-date&page=1#summary

Showing results from 7 days ago

49 Results

Windows 7 26 53.1%
Windows 10 16 32.7%
Windows 8.1 7 14.3%

Firefox 65.0a1 4 8.2% 2
Firefox 64.0 1 2.0% 1
Firefox 64.0b5 1 2.0% 1
Firefox 63.0.3 9 18.4% 6
Firefox 63.0.1 3 6.1% 3
Firefox 63.0a1 2 4.1% 1
Firefox 63.0 1 2.0% 1
Firefox 63.0b12 1 2.0% 1
Firefox 63.0b8 1 2.0% 1
Firefox 62.0b19 2 4.1% 1

amd64 33 67.3%
x86 16 32.7%

Showing results from 3 months ago

1,493 Results

Windows 7 758 50.8%
Windows 8.1 395 26.5%
Windows 10 288 19.3%
Linux 35 2.3%
Windows 8 17 1.1%

Firefox 65.0a1 86 5.8% 11
Firefox 64.0a1 66 4.4% 14
Firefox 64.0 13 0.9% 9
Firefox 64.0b4 9 0.6% 5
Firefox 64.0b5 8 0.5% 5
Firefox 64.0b7 8 0.5% 6
Firefox 64.0b6 5 0.3% 3
Firefox 64.0.2 4 0.3% 5
Firefox 63.0.3 255 17.1% 87
Firefox 63.0.1 105 7.0% 40

Firefox 61.0 7 0.5% 6
Firefox 60.7.0esr 7 0.5% 2
Firefox 60.6.1esr 37 2.5% 14
Firefox 60.6.3esr 11 0.7% 5
Firefox 60.5.2esr 7 0.5% 8
Firefox 60.4.0esr 4 0.3% 3
Firefox 60.0a1 20 1.3% 8
Firefox 60.0.2 18 1.2% 6
Firefox 60.0.1 17 1.1% 6
Firefox 60.0 4 0.3% 3
Firefox 59.0b5 104 7.0% 19
Firefox 59.0b3 64 4.3% 20
Firefox 59.0a1 55 3.7% 5
Firefox 59.0b6 50 3.3% 14

amd64 910 61.0%
x86 583 39.0%

Signature report for core::ptr::drop_in_place<T>

Showing results from 3 months ag

55 Results

Windows 7 27 49.1%
Windows 8.1 15 27.3%
Windows 10 12 21.8%
Linux 1 1.8%

Firefox 66.0.3 7 12.7% 8
Firefox 66.0.2 5 9.1% 6
Firefox 66.0.5 1 1.8% 1
Firefox 66.0rc3 1 1.8% 1
Firefox 65.0.2 12 21.8% 9
Firefox 64.0 2 3.6% 2
Firefox 60.6.3esr 3 5.5% 1
Firefox 60.6.1esr 1 1.8% 1
Thunderbird 60.6.1 3 5.5% 1
Firefox 60.5.1esr 11 20.0% 1
Firefox 60.5.2esr 1 1.8% 1
Firefox 60.3.0esr 8 14.5% 2

amd64 31 56.4%
x86 24 43.6%

Status: UNCONFIRMED → NEW

Crash Signature: [@ IPCError-browser | ShutDownKill] → [@ IPCError-browser | ShutDownKill] [@ core::ptr::drop_in_place<T> ]

status-firefox67: --- → unaffected

status-firefox67.0.1: --- → unaffected

status-firefox68: --- → unaffected

status-firefox69: --- → unaffected

status-firefox-esr60: --- → affected

Ever confirmed: true

OS: Windows 7 → All

Hardware: x86_64 → All

Version: 63 Branch → 58 Branch

BugBot [:suhaib / :marco/ :calixte]

Updated

•

5 years ago

Keywords: regression

Trevor Skywalker

Comment 11

•

5 years ago

I think these two crash signatures are related.

[@ IPCError-browser | ShutDownKill ]

[@ core::ptr::drop_in_place<T> | core::ptr::drop_in_place<T> | geckoservo::glue::Servo_StyleSet_Drop ]

Firefox 61.0.2 Crash Report [@ IPCError-browser | ShutDownKill ]
ID: d6c84006-6ccd-4bae-a2d8-3dab20190607

Firefox 60.7.0esr Crash Report [@ core::ptr::drop_in_place<T> | core::ptr::drop_in_place<T> | geckoservo::glue::Servo_StyleSet_Drop ]
ID: b7a518d3-2175-467e-84b5-661650190614

Firefox 61.0.2 Crash Report [@ IPCError-browser | ShutDownKill ]
ID: d6c84006-6ccd-4bae-a2d8-3dab20190607

Processor Notes:
SignatureIPCChannelError: Signature replaced with an IPC Channel Error, was: "core::ptr::drop_in_place<T> | core::ptr::drop_in_place<T> | core::ptr::drop_in_place<T> | core::ptr::drop_in_place<T> | geckoservo::glue::Servo_StyleSet_Drop"

Crashing Thread (0)
Frame Module Signature Source Trust
0 xul.dll static void core::ptr::drop_in_place<smallvec::SmallVec<[style::stylist::Rule; 1]>>(struct smallvec::SmallVec<[style::stylist::Rule; 1]>) src/libcore/ptr.rs:59 context
1 xul.dll static void core::ptr::drop_in_place<hashglobe::table::RawTable<style::gecko_string_cache::Atom, smallvec::SmallVec<[style::stylist::Rule; 1]>>>(struct hashglobe::table::RawTable<style::gecko_string_cache::Atom, smallvec::SmallVec<[style::stylist::Rule; 1]>>) src/libcore/ptr.rs:59 cfi
2 xul.dll static void core::ptr::drop_in_place<style::stylist::ElementAndPseudoRules>(struct style::stylist::ElementAndPseudoRules*) src/libcore/ptr.rs:59 cfi
3 xul.dll static void core::ptr::drop_in_place<style::stylist::CascadeData>(struct style::stylist::CascadeData*) src/libcore/ptr.rs:59 cfi
4 xul.dll void geckoservo::glue::Servo_StyleSet_Drop(struct style::gecko_bindings::sugar::ownership::Owned<style::gecko_bindings::bindings::RawServoStyleSet>) servo/ports/geckolib/glue.rs:3198 cfi
5 xul.dll mozilla::ServoStyleSet::Shutdown() layout/style/ServoStyleSet.cpp:193 cfi
6 xul.dll mozilla::PresShell::Destroy() layout/base/PresShell.cpp:1389 cfi
7 xul.dll nsDocumentViewer::DestroyPresShell() layout/base/nsDocumentViewer.cpp:4552 cfi
8 xul.dll nsDocumentViewer::Destroy() layout/base/nsDocumentViewer.cpp:1772 cfi
9 xul.dll nsDocShell::Destroy() docshell/base/nsDocShell.cpp:5464 cfi
10 xul.dll nsWebBrowser::SetDocShell(nsIDocShell*) toolkit/components/browser/nsWebBrowser.cpp:1697 cfi
11 xul.dll nsWebBrowser::InternalDestroy() toolkit/components/browser/nsWebBrowser.cpp:96 cfi
12 xul.dll nsWebBrowser::Destroy() toolkit/components/browser/nsWebBrowser.cpp:1291 cfi
13 xul.dll mozilla::dom::TabChild::DestroyWindow() dom/ipc/TabChild.cpp:1074 cfi
14 xul.dll mozilla::dom::TabChild::RecvDestroy() dom/ipc/TabChild.cpp:2515 cfi
15 xul.dll mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) ipc/ipdl/PBrowserChild.cpp:4638 cfi
16 xul.dll mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) ipc/ipdl/PContentChild.cpp:5316 cfi
17 xul.dll mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) ipc/glue/MessageChannel.cpp:2142 cfi
18 xul.dll mozilla::ipc::MessageChannel::DispatchMessageW(IPC::Message&&) ipc/glue/MessageChannel.cpp:2072 cfi
19 xul.dll mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) ipc/glue/MessageChannel.cpp:1918 cfi
20 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run() ipc/glue/MessageChannel.cpp:1951 cfi
21 xul.dll mozilla::SchedulerGroup::Runnable::Run() xpcom/threads/SchedulerGroup.cpp:337 cfi
22 xul.dll nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1090 cfi
23 xul.dll mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:97 cfi

Firefox 60.7.0esr Crash Report [@ core::ptr::drop_in_place<T> | core::ptr::drop_in_place<T> | geckoservo::glue::Servo_StyleSet_Drop ]
ID: b7a518d3-2175-467e-84b5-661650190614

Crashing Thread (0)
Frame Module Signature Source Trust
0 xul.dll core::ptr::drop_in_place<hashglobe::hash_map::HashMap<style::gecko_string_cache::Atom, smallvec::SmallVec<[style::invalidation::element::invalidation_map::Dependency; 1]>, core::hash::BuildHasherDefault<style::selector_map::PrecomputedHasher>>> src/libcore/ptr.rs:59 context
1 xul.dll core::ptr::drop_in_place<style::stylist::CascadeData> src/libcore/ptr.rs:59 cfi
2 xul.dll geckoservo::glue::Servo_StyleSet_Drop servo/ports/geckolib/glue.rs:2604 cfi
3 xul.dll mozilla::PresShell::Destroy() layout/base/PresShell.cpp:1353 cfi
4 xul.dll nsDocumentViewer::DestroyPresShell() layout/base/nsDocumentViewer.cpp:4364 cfi
5 xul.dll nsDocumentViewer::Hide() layout/base/nsDocumentViewer.cpp:2173 cfi
6 xul.dll nsDocShell::SetVisibility(bool) docshell/base/nsDocShell.cpp:5859 cfi
7 xul.dll nsFrameLoader::Hide() dom/base/nsFrameLoader.cpp:1004 cfi
8 xul.dll nsHideViewer::Run() layout/generic/nsSubDocumentFrame.cpp:911 cfi
9 xul.dll nsContentUtils::RemoveScriptBlocker() dom/base/nsContentUtils.cpp:5246 cfi
10 xul.dll nsDocumentViewer::Destroy() layout/base/nsDocumentViewer.cpp:1758 cfi
11 xul.dll nsDocShell::Destroy() docshell/base/nsDocShell.cpp:5274 cfi
12 xul.dll nsWebBrowser::SetDocShell(nsIDocShell*) toolkit/components/browser/nsWebBrowser.cpp:1585 cfi
13 xul.dll nsWebBrowser::InternalDestroy() toolkit/components/browser/nsWebBrowser.cpp:90 cfi
14 xul.dll nsWebBrowser::Destroy() toolkit/components/browser/nsWebBrowser.cpp:1207 cfi
15 xul.dll mozilla::dom::TabChild::DestroyWindow() dom/ipc/TabChild.cpp:982 cfi
16 xul.dll mozilla::dom::TabChild::RecvDestroy() dom/ipc/TabChild.cpp:2275 cfi
17 xul.dll mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) ipc/ipdl/PBrowserChild.cpp:4432 cfi
18 xul.dll mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) ipc/ipdl/PContentChild.cpp:5103 cfi
19 xul.dll mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) ipc/glue/MessageChannel.cpp:2014 cfi
20 xul.dll mozilla::ipc::MessageChannel::DispatchMessageW(IPC::Message&&) ipc/glue/MessageChannel.cpp:1943 cfi
21 xul.dll mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) ipc/glue/MessageChannel.cpp:1801 cfi
22 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run() ipc/glue/MessageChannel.cpp:1832 cfi
23 xul.dll mozilla::SchedulerGroup::Runnable::Run() xpcom/threads/SchedulerGroup.cpp:370 cfi
24 xul.dll nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:975 cfi
25 xul.dll mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:88 cfi

Crash Signature: [@ IPCError-browser | ShutDownKill] [@ core::ptr::drop_in_place<T> ] → [@ IPCError-browser | ShutDownKill] [@ core::ptr::drop_in_place<T> ] [@ core::ptr::drop_in_place<T> | core::ptr::drop_in_place<T> | geckoservo::glue::Servo_StyleSet_Drop ]

Worcester12345

Reporter

Updated

•

5 years ago

Keywords: crash, dupeme

Gabriele Svelto [:gsvelto]

Comment 12

•

3 years ago

This is mostly old signatures that are now tracked in bug 1613797.

Status: NEW → RESOLVED

Closed: 3 years ago

Resolution: --- → DUPLICATE

BugBot [:suhaib / :marco/ :calixte]

Updated

•

3 years ago

Keywords: dupeme

Ryan VanderMeulen [:RyanVM]

Updated

•

2 years ago

status-firefox-esr60: affected → wontfix

Bugzilla

Quick Search

Crash in [@ IPCError-browser | ShutDownKill ] signature was [@ core::ptr::drop_in_place<T> ]

Categories

(Core :: CSS Parsing and Computation, defect, P3)

Tracking

()

People

(Reporter: worcester12345, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression)

Crash Data

Security

(public)

User Story

Description

Comment 3

Comment 4

Comment 5

Comment 10

Updated

Comment 11

Updated

Comment 12

Updated

Updated