253801 - 100% cpu for 10s then crash when click on the page - FF10RC2 [@ nsTextFrame::TextStyle::TextStyle]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Rodolfo Schulz de Lima]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040705 Firefox/0.9.1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040705 Firefox/0.9.1

Firefox seems to hang when we go to www.gtk.org for 10s (in my machine), user
cpu stays 100% during this time, but no network activity. Then the page renders
with no problems, until you click anywhere in the page. The browser crashes.

Reproducible: Always
Steps to Reproduce:
1.Go to http://www.gtk.org
2.Wait until the page renders
3.Click on the page. Firefox crashes.

Actual Results:  
Firefox crashes

Expected Results:  
Normal behavior of the browser when the page loads. And firefox shouldn't hang
just spending cpu time for so long while loading the page.

Talkback ID: TB451235W
shared libraries loaded:
[rodolfo@home ~]$ ldd /opt/firefox-0.9.1/firefox-bin
        linux-gate.so.1 =>  (0xffffe000)
        libmozjs.so => not found
        libxpcom.so => not found
        libplds4.so => not found
        libplc4.so => not found
        libnspr4.so => not found
        libpthread.so.0 => /lib/libpthread.so.0 (0x40027000)
        libdl.so.2 => /lib/libdl.so.2 (0x40038000)
        libgtk-x11-2.0.so.0 => /usr/lib/libgtk-x11-2.0.so.0 (0x4003b000)
        libgdk-x11-2.0.so.0 => /usr/lib/libgdk-x11-2.0.so.0 (0x40342000)
        libatk-1.0.so.0 => /usr/lib/libatk-1.0.so.0 (0x403b5000)
        libgdk_pixbuf-2.0.so.0 => /usr/lib/libgdk_pixbuf-2.0.so.0 (0x403d1000)
        libpangoxft-1.0.so.0 => /usr/lib/libpangoxft-1.0.so.0 (0x403e7000)
        libpangox-1.0.so.0 => /usr/lib/libpangox-1.0.so.0 (0x403ec000)
        libpango-1.0.so.0 => /usr/lib/libpango-1.0.so.0 (0x403f8000)
        libgobject-2.0.so.0 => /usr/lib/libgobject-2.0.so.0 (0x4042f000)
        libgmodule-2.0.so.0 => /usr/lib/libgmodule-2.0.so.0 (0x4046f000)
        libglib-2.0.so.0 => /usr/lib/libglib-2.0.so.0 (0x40473000)
        libX11.so.6 => /usr/X11R6/lib/libX11.so.6 (0x404fa000)
        libm.so.6 => /lib/libm.so.6 (0x405d0000)
        libsmime3.so => not found
        libssl3.so => not found
        libnss3.so => not found
        libsoftokn3.so => not found
        libXt.so.6 => /usr/X11R6/lib/libXt.so.6 (0x405f3000)
        libXp.so.6 => /usr/X11R6/lib/libXp.so.6 (0x4064e000)
        libXext.so.6 => /usr/X11R6/lib/libXext.so.6 (0x40656000)
        libxpcom_compat.so => not found
        libstdc++.so.5 => /usr/lib/libstdc++.so.5 (0x40669000)
        libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x40722000)
        libc.so.6 => /lib/libc.so.6 (0x4072b000)
        libXft.so.2 => /usr/X11R6/lib/libXft.so.2 (0x40846000)
        libfontconfig.so.1 => /usr/lib/libfontconfig.so.1 (0x4085a000)
        libfreetype.so.6 => /usr/lib/libfreetype.so.6 (0x40884000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)
        libXrandr.so.2 => /usr/X11R6/lib/libXrandr.so.2 (0x40907000)
        libXinerama.so.1 => /usr/X11R6/lib/libXinerama.so.1 (0x4090b000)
        libXrender.so.1 => /usr/X11R6/lib/libXrender.so.1 (0x4090e000)
        libXcursor.so.1 => /usr/X11R6/lib/libXcursor.so.1 (0x40916000)
        libpangoft2-1.0.so.0 => /usr/lib/libpangoft2-1.0.so.0 (0x40920000)
        libSM.so.6 => /usr/X11R6/lib/libSM.so.6 (0x40949000)
        libICE.so.6 => /usr/X11R6/lib/libICE.so.6 (0x40952000)
        libexpat.so.0 => /usr/lib/libexpat.so.0 (0x4096a000)
        libz.so.1 => /lib/libz.so.1 (0x4098a000)

Backtrace:
#0  0xffffe410 in ?? ()
#1  0xbfffd900 in ?? ()
#2  0x0000000b in ?? ()
#3  0x000003b1 in ?? ()
#4  0x40171de3 in raise () from /lib/libpthread.so.0
#5  0x0878d402 in nsPrintSession::QueryInterface ()
#6  <signal handler called>
#7  0x08449865 in nsPRUint32Key::Clone ()
#8  0x0844577c in nsPRUint32Key::Clone ()
#9  0x08445dc6 in nsPRUint32Key::Clone ()
#10 0x0822710d in nsReadingIterator<unsigned short>::advance ()
#11 0x084202be in nsPRUint32Key::Clone ()
#12 0x0823a379 in nsReadingIterator<unsigned short>::advance ()
#13 0x08239d76 in nsReadingIterator<unsigned short>::advance ()
#14 0x083a69da in nsPRUint32Key::Clone ()
#15 0x083a5f86 in nsPRUint32Key::Clone ()
#16 0x083a03a6 in nsPRUint32Key::Clone ()
#17 0x0821c85d in nsReadingIterator<unsigned short>::advance ()
#18 0x08216efd in nsReadingIterator<unsigned short>::advance ()
#19 0x0821a3bf in nsReadingIterator<unsigned short>::advance ()
#20 0x402a3034 in _gtk_marshal_BOOLEAN__BOXED ()
   from /usr/lib/libgtk-x11-2.0.so.0
#21 0x4057774b in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#22 0x4058ea70 in signal_emit_unlocked_R () from /usr/lib/libgobject-2.0.so.0
#23 0xbfffe9a4 in ?? ()
#24 0x00000002 in ?? ()
#25 0xbfffeaf4 in ?? ()
#26 0xbfffe9cc in ?? ()
#27 0x405acbc0 in g_param_spec_types () from /usr/lib/libgobject-2.0.so.0
#28 0x40636230 in g_ascii_table () from /usr/lib/libglib-2.0.so.0
#29 0x0899dedc in nsComponentManagerLog ()
#30 0xbfffead4 in ?? ()
#31 0x00000001 in ?? ()
#32 0x00000014 in ?? ()
#33 0xbfffe97c in ?? ()
#34 0xbfffe9cc in ?? ()
#35 0xbfffe984 in ?? ()
#36 0x00000000 in ?? ()
#37 0x00000000 in ?? ()
#38 0xbfffe9c4 in ?? ()
#39 0xbfffe9a4 in ?? ()
#40 0xbfffe9e4 in ?? ()
#41 0x00000000 in ?? ()
#42 0x08b94438 in ?? ()
#43 0x00004c00 in ?? ()
#44 0x00000008 in ?? ()
#45 0x00000005 in ?? ()
#46 0x08c6f8e0 in ?? ()
#47 0x08c6f918 in ?? ()
#48 0x40586370 in class_closures_cmp () from /usr/lib/libgobject-2.0.so.0
Previous frame inner to this frame (corrupt stack?)

Comment 1

[Rodolfo Schulz de Lima]

Attachment: backtrace listing of my own compiled copy

The backtrace is different in my own compiled copy of firefox, compiled with
gcc-3.4.1.

Comment 2

[Adam Hauner]

TB451235W:
nsTextFrame::TextStyle::TextStyle()
nsTextFrame::GetPosition() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsTextFrame.cpp,
line 749]
nsTextFrame::GetContentAndOffsetsFromPoint() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsTextFrame.cpp,
line 3525]
nsFrame::GetNextPrevLineFromeBlockFrame() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsFrame.cpp,
line 704]
nsBlockFrame::HandleEvent() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5653]
PresShell::HandleEventInternal() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6079]
PresShell::HandleEvent() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5928]
nsViewManager::HandleEvent() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/view/src/nsViewManager.cpp,
line 710]
nsViewManager::DispatchEvent() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/view/src/nsViewManager.cpp,
line 96]
HandleEvent() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/view/src/nsView.cpp,
line 243]
nsCommonWidget::DispatchEvent() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsCommonWidget.cpp,
line 215]
nsWindow::OnButtonPressEvent() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsWindow.cpp,
line 1415]
button_press_event_cb() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsWindow.cpp,
line 3264]
libgtk-x11-2.0.so.0 + 0x129034 (0x402a3034)
libgobject-2.0.so.0 + 0x974b (0x4057774b)
libgobject-2.0.so.0 + 0x20a70 (0x4058ea70)
libgobject-2.0.so.0 + 0x22790 (0x40590790)
libgobject-2.0.so.0 + 0x22e02 (0x40590e02)
libgtk-x11-2.0.so.0 + 0x250ad4 (0x403caad4)
libgtk-x11-2.0.so.0 + 0x126daa (0x402a0daa)
libgtk-x11-2.0.so.0 + 0x1271b1 (0x402a11b1)
libgdk-x11-2.0.so.0 + 0x42a31 (0x404c3a31)
libglib-2.0.so.0 + 0x26687 (0x405d8687)
libglib-2.0.so.0 + 0x28933 (0x405da933)
libglib-2.0.so.0 + 0x28bea (0x405dabea)
libgtk-x11-2.0.so.0 + 0x1262d4 (0x402a02d4)
nsAppShell::Run() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 144]
nsAppShellService::Run() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 495]
xre_main() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/toolkit/xre/nsAppRunner.cpp,
line 692]
main() 
[/builds/tinderbox/firefox-0.9.1/Linux_2.4.20-28.8_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 59]
libc.so.6 + 0x154a7 (0x409ba4a7)

TalkBack show over 300 incidents with this signature over all products, but most
is on the Aviary brach:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsTextFrame%3A%3ATextStyle%3A%3ATextStyle&vendor=All&product=All&platform=All&buildid=&sdate=&stime=00%3A00%3A00&edate=&etime=23%3A59%3A59

Bug 250061 and bug 251219 have same signatures, but different stacks.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Sounds like yet another buggy font problem... is this crash an issue with
non-xft builds?

Comment 4

[Jay Patel [:jay]]

This is definitely a topcrasher.  I missed this one since it was mostly a Linux
only crash in Firefox 0.9.1 (and I didn't see too many Windows crashes in
0.9.2).  We are sure to see a lot of these crashes in Firefox 0.9.3 though, so
adding topcrash keyword, FF09x for tracking and nominating for aviary1.0.

Comment 5

[Jay Patel [:jay]]

Marking topcrash+ since this is the #5 topcrash with the latest Firefox 0.9.3
release.   Note that this is Linux only...so that says a lot about it's overall
rank.

Comment 6

[Jay Patel [:jay]]

Still around in Firefox 1.0 PR1 although not as high in the topcrash list.

Comment 7

[chris hofmann]

dbaron, can you have a look?

Comment 8

[Boris Zbarsky [:bzbarsky]]

There is a good chance this is caused by bug 180309 

Comment 9

[Volkmar W. Pogatzki]

(In reply to comment #0)
> [...]
> Reproducible: Always
> Steps to Reproduce:
> 1.Go to http://www.gtk.org
> 2.Wait until the page renders

WFM using (Suse Linux 9.1, KDE 3.3.1)
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2004-10-14-09-0.9/firefox-i686-linux-gtk2+xft.tar.gz

Comment 10

[timeless]

*** Bug 252819 has been marked as a duplicate of this bug. ***

Comment 11

[timeless]

*** Bug 264428 has been marked as a duplicate of this bug. ***

Comment 12

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This seems likely to be fixed by the patch to bug 180309.

Comment 13

[Asa Dotzler [:asa]]

Jay, can you poke at talkback data and see if this has cleared up? 

Comment 14

[Jay Patel [:jay]]

So far, so good.  Fix went in on 10/13 and the most recent incident with this
stack signature is from 10/12.  I'm going to mark this fixed based on dbaron's
comments and current Talkback data.  If this crash shows up in newer builds or
if anyone is able to reproduce with any builds after 10/13, we can reopen.

Comment 15

[Jay Patel [:jay]]

Reopening as I see a few crashes in both RC1 and RC2 Talkback data.  Bug 180309
has also reopened, so it looks like the fix there might not have covered all
cases leading to this crash.

Comment 16

[timeless]

*** Bug 262698 has been marked as a duplicate of this bug. ***

Comment 17

[Mohsen Hariri]

(In reply to comment #16)
> *** Bug 262698 has been marked as a duplicate of this bug. ***

see https://bugzilla.mozilla.org/show_bug.cgi?id=262698#c7

Comment 18

[timeless]

*** Bug 271040 has been marked as a duplicate of this bug. ***

Comment 19

[sairuh (rarely reading bugmail)]

from dup bug 271040 I can reliably crash thunderbird (2004111906-0.9 aviary
branch build).

Comment 20

[sairuh (rarely reading bugmail)]

removing fixed-aviary1.0 keyword as I still crash with this using recent tbird
0.9 builds (notably when trying to display spam messages). also renominating for
blocker status to see if this could get fixed for tbird 1.0.

Comment 21

[Marcia Knous [:marcia]]

adding scott and david to the cc list...

Comment 22

[Asa Dotzler [:asa]]

I don't see this in the topcrash reports for the trunk. Are we just not getting
enough usage there to find it or has it cleared up enough that it's no longer a
trunk topcrash?

Comment 23

[Rodolfo Schulz de Lima]

Since this bug isn't happening to me since version 1.0, I'll close this bug.