252328 - FF09x crash [@ nsRuleNode::SetDefaultOnRoot] [@ nsInputStreamPump::OnStateStop]

Status: RESOLVED WORKSFORME

(Core :: Networking, defect)

Description

[Jay Patel [:jay]]

The stack isn't very helpful and the comments are all over the place, but there
are enough crashes of this type to make it a topcrasher for Firefox 0.9.2:

Rank    StackSignature    Count  

17   nsRuleNode::SetDefaultOnRoot   203 

 
 	Source File :
d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/content/base/src/nsRuleNode.cpp
line : 1449
 
====================================================================================================
     Count   Offset    Real Signature
[ 202   nsRuleNode::SetDefaultOnRoot 20ef5768 - nsRuleNode::SetDefaultOnRoot ]
 
     Crash date range: 10-JUL-04 to 19-JUL-04
     Min/Max Seconds since last crash: 10 - 576147
     Min/Max Runtime: 97 - 576147
 
     Count   Platform List 
     183   Windows XP [Windows NT 5.1 build 2600] 
     17   Windows 2K [Windows NT 5.0 build 2195] 
     2   Windows XP [Windows NT 5.2 build 3790] 
 
     Count   Build Id List 
     202   2004070723
 
     No of Unique Users       156
 
 Stack trace(Frame) 

	 nsRuleNode::SetDefaultOnRoot
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/content/base/src/nsRuleNode.cpp
 line 1449] 
	 nsInputStreamPump::OnStateStop
[d:/builds/tinderbox/firefox-0.9.2/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp
 line 499]  
 
     (361610)	Comments: just browsing
     (361096)	Comments: dont work
     (359725)	URL: http://www.livejournal.com
     (357762)	URL: http://www.heise.de/tp/deutsch/inhalt/musik/17898/1.html
     (357762)	Comments: loading the page
     (357654)	URL: forum.golem.de/?????
     (357654)	Comments: crash while loading  
     (356733)	URL: http://www.ebay.com/
     (356733)	Comments: Simply navigating around eBay looking at various auction
items.
     (352712)	URL: www.aol.com
     (352712)	Comments: I was trying to bring up my mail from the message list 
that worked only moments before. And it suddenly crashed. Love this browser btw.
I think AOL just has a problem %)
     (351596)	URL: www.spiegel.de/politik
     (351596)	Comments: page was loading
     (351260)	Comments: at dell website  had just enterede a search field and
pressed return
     (350576)	URL: http://www.heise.de
     (350576)	Comments: crash... again
     (348168)	Comments: scolling on an aol e-mail
     (345736)	Comments: Reading an article on www.heise.de
     (344106)	URL: www.tomshardware.de
     (344106)	Comments: klikced an normal link
     (341493)	URL: http://www.spiegel.de
     (341493)	Comments: opening several tabs
     (338805)	URL: http://my.msn.com/default.armx
     (338805)	Comments: Nothing
     (338121)	URL: http://webmail.aol.com/msglist.adp
     (337535)	Comments: Browsing
     (335503)	Comments: Trying to open Firefox.
     (332710)	URL:
http://www.themexp.org/preview.php?mid=33263&type=wp&view=downloads&page=16&cat=&name=digitalmasterpiece.zip
     (332710)	Comments: clicked the back button.
     (331367)	URL: www.heise.de/tp/
     (330728)	URL: http://graphics.tomshardware.com/display/20031105/lcd-16.html
     (330728)	Comments: Browsing an article on Tom's Hardware guide.  Had
several tabs open  but the above URL was the one that was loading when the crash
happened
     (329620)	Comments: Completing a hotel reservation
     (326794)	URL: http://www.tunewear.com/english/product/index.html
     (326794)	Comments: Normal browsing
     (325263)	URL: www.spiegel.de
     (322864)	URL: http://news.google.com.au/news/en/au/nation.html
     (319337)	URL: www.offthekerb.co.uk
     (319337)	Comments: clicked on link from email.
     (315688)	URL: www.stern.de
     (314407)	URL: http://www.tvb.com/tvbi/global/malaysia.htm
     (311787)	Comments: sfasfasfsaf
     (311699)	Comments: Browsing eBay!
     (311513)	URL: www.twisted.co.uk
     (310430)	Comments: Using my mousewheel to scroll down a page that was still
in the process of loading (at least the images).
     (310419)	URL: www.heise.de
     (309827)	URL: www.aol.com
     (309802)	URL: www.aol.com
     (309802)	Comments: I was trying to check my AOL email.  I opened up a
message and the program crashed.
     (307815)	URL: www.gamestar.de
     (307815)	Comments: klicking on a link to pop up a java script window


Note:  I don't see any crashes with this stack signature in MozillaTrunk or
Mozilla 1.x Talkback data.

Comment 1

[Boris Zbarsky [:bzbarsky]]

ccing firefox folks, if this is only happening on aviary...

Comment 2

[Boris Zbarsky [:bzbarsky]]

So if the crash is actually in SetDefaultOnRoot, chances are the rulenode has a
null mPresContext (or we're OOM, but that would crash all over, I'd think). 
That _could_ be triggered by dynamic theme switching.

That said, SetDefaultOnRoot is never called by OnStateStop.  So perhaps the
stack is just completely bogus.

Comment 3

[Darin Fisher]

maybe this is a duplicate of bug 241947?

Comment 4

[Jay Patel [:jay]]

Marking topcrash+ since this has been in the top 10 crash list for the past
couple of releases of Firefox 0.9.x.  I haven't been able to reproduce, but this
definitely needs a closer look.

nsRuleNode::SetDefaultOnRoot crashes:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsRuleNode%3A%3ASetDefaultOnRoot&vendor=All&product=All&platform=All&buildid=&sdate=&stime=00%3A00%3A00&edate=&etime=23%3A59%3A59

Darin:  Should we mark this a dup of bug 241947?  Let me know so I can move all
the Talkback info over there.  Thanks.

Comment 5

[Darin Fisher]

> Darin:  Should we mark this a dup of bug 241947?  Let me know so I can move all
> the Talkback info over there.  Thanks.

hard to say.  i don't think there's enough info to know if we should dupe the
bugs.  the stack traces are similar, so maybe.

Comment 6

[chris hofmann]

I'm minusing this for lack of patch and reproducable test case, but if either
appears be sure to renominate.

Comment 7

[Jay Patel [:jay]]

I don't see any of these crashes in the latest Talkback data for Firefox 1.0
PR1.  Marking worksforme.  If anyone is able to reproduce with these stack
signatures or see them show up in Talkback data again, please reopen.