Closed Bug 292549 Opened 19 years ago Closed 16 years ago

crash [@ nsFrame::BoxReflow] at start of page rendering -Trunk

Categories

(Toolkit :: Startup and Profile System, defect, P2)

Product:
Toolkit
Component:
Startup and Profile System
Platform:
x86
Linux
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla1.9

People

(Reporter: chpe, Assigned: benjamin)

References

Details

(Keywords: crash, regression, topcrash, Whiteboard: [cannot reproduce])

Crash Data

Attachments

(1 file)

Don't initialize the chrome registry if JAR isn't up, rev. 1
3.44 KB, patch
mossop
: review+
beltzner
: approval1.9+
Details | Diff | Splinter Review 
Steps to reproduce:
0) Build ff trunk
1) Start TestGtkEmbed
2) Load www.gnome.org

Result:
Crash.

###!!! ASSERTION: A box layout method was called but InitBoxMetrics was never
called: 'metrics', file
/opt/source/firefox-trunk/mozilla/layout/generic/nsFrame.cpp, line 5644
Break: at file /opt/source/firefox-trunk/mozilla/layout/generic/nsFrame.cpp,
line 5644

#0  0xb68ca472 in nsFrame::BoxReflow (this=0x8318290, aState=@0xbfffe644,
aPresContext=0x8303e80, aDesiredSize=@0xbfffe3b0, aReflowState=@0xbfffe760,
aStatus=@0xbfffe404, 
    aX=6900, aY=6000, aWidth=0, aHeight=0, aMoveFrame=1) at
/opt/source/firefox-trunk/mozilla/layout/generic/nsFrame.cpp:5306
#1  0xb68c9f79 in nsFrame::DoLayout (this=0x8318290, aState=@0xbfffe644) at
/opt/source/firefox-trunk/mozilla/layout/generic/nsFrame.cpp:5109
#2  0xb6a5a07e in nsIFrame::Layout (this=0x8318290, aState=@0xbfffe644) at
/opt/source/firefox-trunk/mozilla/layout/xul/base/src/nsBox.cpp:800
#3  0xb6a6073e in nsBoxFrame::LayoutChildAt (aState=@0xbfffe644, aBox=0x8318290,
aRect=@0xbfffe4d0)
    at /opt/source/firefox-trunk/mozilla/layout/xul/base/src/nsBoxFrame.cpp:2681
#4  0xb68e1d31 in nsGfxScrollFrameInner::LayoutScrollbars (this=0x8318074,
aState=@0xbfffe644, aContentArea=@0xbfffe580, aOldScrollArea=@0xbfffe600,
aScrollArea=@0xbfffe664)
    at /opt/source/firefox-trunk/mozilla/layout/generic/nsGfxScrollFrame.cpp:2306
#5  0xb68dd68f in nsHTMLScrollFrame::Reflow (this=0x8318028,
aPresContext=0x8303e80, aDesiredSize=@0xbfffe830, aReflowState=@0xbfffe760,
aStatus=@0xbfffe9e8)
    at /opt/source/firefox-trunk/mozilla/layout/generic/nsGfxScrollFrame.cpp:746
#6  0xb68bb8c2 in nsContainerFrame::ReflowChild (this=0x8317e04,
aKidFrame=0x8318028, aPresContext=0x8303e80, aDesiredSize=@0xbfffe830,
aReflowState=@0xbfffe760, aX=0, aY=0, 
    aFlags=0, aStatus=@0xbfffe9e8) at
/opt/source/firefox-trunk/mozilla/layout/generic/nsContainerFrame.cpp:890
#7  0xb694ec49 in ViewportFrame::Reflow (this=0x8317e04, aPresContext=0x8303e80,
aDesiredSize=@0xbfffea10, aReflowState=@0xbfffe920, aStatus=@0xbfffe9e8)
    at /opt/source/firefox-trunk/mozilla/layout/generic/nsViewportFrame.cpp:238
#8  0xb68789c2 in PresShell::InitialReflow (this=0x8316db0, aWidth=6900,
aHeight=6000) at /opt/source/firefox-trunk/mozilla/layout/base/nsPresShell.cpp:2850
#9  0xb6ac06f4 in nsContentSink::StartLayout (this=0x82ff4e8, aIsFrameset=0) at
/opt/source/firefox-trunk/mozilla/content/base/src/nsContentSink.cpp:921
[...]

5(gdb) p metrics
$1 = (nsBoxLayoutMetrics *) 0x0
306        if (metrics->mStyleChange) {


This is with TestGtkEmbed on my own build from cvs; but I've also found talkback
for this crash: 5490302, 5490297, 5473329 from firefox and thunderbird.

A build from Friday (2005-04-29) didn't show this crash; saturday night's
(2005-04-30) did.
Severity: normal → critical
Keywords: crash, regression
worksforme with linux current CVS (suite browser and TestGtkEmbed)
well, I don't know why it worked before, but it does crash for me now.  But I'm
seeing a crash with 4/28 builds.  backing out bug 240276 fixed it for me.

==> roc
Assignee: nobody → roc
Depends on: 240276
The reason I wasn't seeing this before is that my suite build doesn't crash,
only firefox.  Possible relevant differences between the build configs:

firefox (comparable options not set on suite build):
ac_add_options --enable-optimize="-Os"
ac_add_options --disable-shared
ac_add_options --enable-static
ac_add_options --enable-svg

suite is debug while firefox is not, but Christian was obviously using a debug
build.  I tried rebuilding layout with -O0, but I still crash.

also "./run-mozilla.sh ./TestGtkEmbed about:blank" crashes for me with the same
stack.

It's reproducible in TestGtkEmbed both with my firefox trunk debug
(--disable-optimize --enable-debug) and non-debug builds.
Bug 240276 is about scrollbars, so the following warning could be relevant:

Couldn't convert chrome URL: chrome://global/skin/scrollbars.css
###!!! ASSERTION: Could not load scrollbars.css.:
'gStyleCache->mScrollbarsSheet', file
/opt/source/firefox-trunk/mozilla/layout/style/nsLayoutStylesheetCache.cpp, line 88
Break: at file
/opt/source/firefox-trunk/mozilla/layout/style/nsLayoutStylesheetCache.cpp, line 88

This warning has been there for quite some time, but it didn't crash before.
It doesn't work in TestGtkEmbed.  The problem seems to be related to getting the
nsBoxLayoutMetrics in nsFrame::BoxReflow.  The call to get the property from the
atom looks it up in nsPropertyTable::GetPropertyInternal() and the property is
not found.
It works for me. It looks like there's a non-box frame being used as a
scrollbar, which will crash, but that shouldn't happen.

Could you get me a frame dump of the frame tree before you crash? In
nsFrame::BoxReflow, in a debug build, you could call
  ((nsFrame*)GetParent())->List(GetPresContext(), stdout, 0);

I would, but I cannot reproduce the crash in TestGtkEmbed with a build from
20050508 anymore, and the assertion in comment 4 is gone. But it still seems to
happen on firefox, since this crash is #4 topcrasher
[http://talkback-public.mozilla.org/reports/firefox/FFTrunk/FFTrunk-topcrashers.html],
with reports from builds from after that date too.
Keywords: topcrash
Summary: crash in nsFrame::BoxReflow at start of page rendering → crash in nsFrame::BoxReflow at start of page rendering -Trunk [@ nsFrame::BoxReflow]
I think the real problem is with the stylesheets failing to load. We then crash
in BoxReflow because the scrollbars haven't been styled to be boxes. I could fix
scrollframes to not crash, but the browser would still be horked.
The stylesheets are failing to load because the URI comes up invalid according
to the chrome registry.  I have no idea why that would happen exactly (and can't
reproduce).  Benjamin, any idea?
Flags: blocking1.8b3?
TestGTKEmbed uses which chrome registry? And does this show up in local build
trees, or only install trees? There might have been a problem with the
installdir being non-writable, but that problem is now gone with bug 295235
being fixed.
No more information, can't block a release on this.
Flags: blocking1.8b3? → blocking1.8b3-
Summary: crash in nsFrame::BoxReflow at start of page rendering -Trunk [@ nsFrame::BoxReflow] → crash [@ nsFrame::BoxReflow] at start of page rendering -Trunk
Blocks: 380015
OK.. I dunno what happened here.  Added comments and +'d this last night.  

Anyway, +'ing again as this is a #16 top crasher and it's on windows as well.
Flags: blocking1.9? → blocking1.9+
We need someone, anyone, who can reproduce this.
Priority: -- → P2
Whiteboard: [cannot reproduce]
roc: see bug 403013, it may be a dupe.
Probably shouldn't block on this if nobody can reproduce given that the topcrashes looked like one user crashing a bunch of times (and not necessarily even because of this bug).  (9 crashes within a 6-minute period, all with the same build/OS)
Flags: blocking1.9+ → blocking1.9-
I think am able to reproduce this bug though it is in a totally different product. I am building Spicebird (www.spicebird.org) with mozilla TRUNK from 2008-03-05 00:00 PDT. I get crash only on new profile creation (or first run) and only with a static build.

I get the following stack trace:

#0  0x00002b3145e3cdf5 in nanosleep () from /lib/libc.so.6
#1  0x00002b3145e3cc14 in sleep () from /lib/libc.so.6
#2  0x000000000045d444 in ah_crap_handler (signum=11) at nsSigHandlers.cpp:149
#3  0x000000000045e7a2 in nsProfileLock::FatalSignalHandler (signo=11) at nsProfileLock.cpp:216
#4  <signal handler called>
#5  0x0000000000874935 in nsFrame::BoxReflow (this=0x266b750, aState=@0x7fff684d2d28, aPresContext=0x24077d0,
    aDesiredSize=@0x7fff684d2a80, aRenderingContext=0x28c8c90, aX=6000, aY=6000, aWidth=0, aHeight=0, aMoveFrame=1)
    at /home/bunny/build/testing/mozilla/layout/generic/nsFrame.cpp:6218
#6  0x0000000000874e80 in nsFrame::DoLayout (this=0x266b750, aState=@0x7fff684d2d28)
    at /home/bunny/build/testing/mozilla/layout/generic/nsFrame.cpp:6025
#7  0x00000000009e3147 in nsIFrame::Layout (this=0x266b750, aState=@0x7fff684d2d28)
    at /home/bunny/build/testing/mozilla/layout/xul/base/src/nsBox.cpp:561
#8  0x00000000009e461c in nsBoxFrame::LayoutChildAt (aState=@0x7fff684d2d28, aBox=0x266b750, aRect=@0x7fff684d2c50)
    at /home/bunny/build/testing/mozilla/layout/xul/base/src/nsBoxFrame.cpp:2022
#9  0x0000000000894257 in LayoutAndInvalidate (aState=@0x7fff684d2d28, aBox=0x266b750, aRect=@0x7fff684d2c50)
    at /home/bunny/build/testing/mozilla/layout/generic/nsGfxScrollFrame.cpp:2475
#10 0x00000000008957be in nsGfxScrollFrameInner::LayoutScrollbars (this=0x266b360, aState=@0x7fff684d2d28,
    aContentArea=@0x7fff684d2db0, aOldScrollArea=@0x7fff684d2df0, aScrollArea=@0x7fff684d2d58)
    at /home/bunny/build/testing/mozilla/layout/generic/nsGfxScrollFrame.cpp:2537
#11 0x000000000089a30c in nsHTMLScrollFrame::Reflow (this=0x266b2d8, aPresContext=0x24077d0, aDesiredSize=@0x7fff684d3180,
    aReflowState=@0x7fff684d2f50, aStatus=@0x7fff684d339c)
    at /home/bunny/build/testing/mozilla/layout/generic/nsGfxScrollFrame.cpp:818
#12 0x000000000086d381 in nsContainerFrame::ReflowChild (this=0x266af90, aKidFrame=0x266b2d8, aPresContext=0x24077d0,
    aDesiredSize=@0x7fff684d3180, aReflowState=@0x7fff684d2f50, aX=0, aY=0, aFlags=0, aStatus=@0x7fff684d339c, aTracker=0x0)
    at /home/bunny/build/testing/mozilla/layout/generic/nsContainerFrame.cpp:760
#13 0x00000000009024a5 in ViewportFrame::Reflow (this=0x266af90, aPresContext=0x24077d0, aDesiredSize=@0x7fff684d3370,
    aReflowState=@0x7fff684d3270, aStatus=@0x7fff684d339c)
    at /home/bunny/build/testing/mozilla/layout/generic/nsViewportFrame.cpp:286
#14 0x000000000082e3c7 in PresShell::DoReflow (this=0x26a5f80, target=0x266af90)
    at /home/bunny/build/testing/mozilla/layout/base/nsPresShell.cpp:6252
#15 0x000000000083baf5 in PresShell::ProcessReflowCommands (this=0x26a5f80, aInterruptible=1)
    at /home/bunny/build/testing/mozilla/layout/base/nsPresShell.cpp:6357
#16 0x000000000083bd90 in PresShell::DoFlushPendingNotifications (this=0x26a5f80, aType=Flush_Layout,
    aInterruptibleReflow=1) at /home/bunny/build/testing/mozilla/layout/base/nsPresShell.cpp:4545
#17 0x000000000083be96 in PresShell::ReflowEvent::Run (this=0x2664bd0)
    at /home/bunny/build/testing/mozilla/layout/base/nsPresShell.cpp:6119
#18 0x00002b3142c109e4 in ?? ()
---Type <return> to continue, or q <return> to quit---
#19 0x000000000217f3f0 in ?? ()
#20 0x00000000feedbeef in ?? ()
#21 0x00000000005ace38 in non-virtual thunk to nsXPConnect::AfterProcessNextEvent(nsIThreadInternal*, unsigned int) ()
#22 0x0100000000000000 in ?? ()
#23 0x000000000263fc38 in ?? ()
#24 0x000000000076ecea in nsRunnable::nsRunnable () at ../../../../dist/include/content/nsINode.h:677
#25 0x00002b3142ba31dc in ?? ()
#26 0x00007fff684d3690 in ?? ()
#27 0x00000001021645f0 in ?? ()
#28 0x0000000101000000 in ?? ()
#29 0x00000000021645f0 in ?? ()
#30 0x00007fff684d3690 in ?? ()
#31 0x0000000142ba3119 in ?? ()
#32 0x00007fff684d3710 in ?? ()
#33 0x0000000001022347 in nsXULWindow::ShowModal (this=0x21645f0)
    at /home/bunny/build/testing/mozilla/xpfe/appshell/src/nsXULWindow.cpp:398
#34 0x0000000001022347 in nsXULWindow::ShowModal (this=0x2826930)
    at /home/bunny/build/testing/mozilla/xpfe/appshell/src/nsXULWindow.cpp:398
#35 0x000000000102f8dc in nsContentTreeOwner::ShowAsModal (this=0x24b25a0)
    at /home/bunny/build/testing/mozilla/xpfe/appshell/src/nsContentTreeOwner.cpp:524
#36 0x0000000000fdc79a in nsWindowWatcher::OpenWindowJSInternal (this=0x26581f0, aParent=0x0,
    aUrl=0x24a2bf0 "chrome://collab/content/splash.xul", aName=0x24d9100 "_blank",
    aFeatures=0x2349110 "chrome,centerscreen,alwaysRaised=yes,titlebar=no,modal=yes,popup=yes", aDialog=1, argv=0x24ac740,
    aCalledFromJS=0, _retval=0x7fff684d4288)
    at /home/bunny/build/testing/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp:944
#37 0x0000000000fdce87 in nsWindowWatcher::OpenWindow (this=0x26581f0, aParent=0x0,
    aUrl=0x24a2bf0 "chrome://collab/content/splash.xul", aName=0x24d9100 "_blank",
    aFeatures=0x2349110 "chrome,centerscreen,alwaysRaised=yes,titlebar=no,modal=yes,popup=yes", aArguments=0x28300f0,
    _retval=0x7fff684d4288)
    at /home/bunny/build/testing/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp:419
#38 0x00002b3142c2a6fe in ?? ()
#39 0x00007fff684d4288 in ?? ()
#40 0x0000000642c2e0c2 in ?? ()
#41 0x00007fff684d4100 in ?? ()
#42 0x00002b3142c2a50a in ?? ()
#43 0x00007fff684d4070 in ?? ()
#44 0x00002b3142c2cfff in ?? ()
---Type <return> to continue, or q <return> to quit---
#45 0x000000000251bd88 in ?? ()
#46 0x00007fff684d4000 in ?? ()
#47 0x0000000600000000 in ?? ()
#48 0x00007fff684d4210 in ?? ()
#49 0x0000000300000006 in ?? ()
#50 0x00000000026581f0 in ?? ()
#51 0x0000000002355520 in ?? ()
#52 0x000000000068eb0c in nsScriptSecurityManager::CheckPropertyAccessImpl ()
    at /home/bunny/build/testing/mozilla/caps/src/nsScriptSecurityManager.cpp:963
#53 0x00000000005df6e0 in XPCWrappedNative::CallMethod (ccx=@0x7fff684d4670, mode=XPCWrappedNative::CALL_METHOD)
    at /home/bunny/build/testing/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2369
#54 0x00000000005ed748 in XPC_WN_CallMethod (cx=0x22cb840, obj=0x23aa680, argc=5, argv=0x21a2e38, vp=0x7fff684d4870)
    at /home/bunny/build/testing/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1470
#55 0x00002b31428974d3 in ?? ()
#56 0x00000000024f84c0 in ?? ()
#57 0x000000050230f610 in ?? ()
#58 0x0000000000000000 in ?? ()

And the error messages are as follows:

###!!! ASSERTION: document demuxed from FastLoad file more than once?: 'entry->mNextSegmentOffset != 0', file /home/bunny/build/checkout/mozilla/xpcom/io/nsFastLoadFile.cpp, line 554
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x8000FFFF: file /home/bunny/build/checkout/mozilla/js/src/xpconnect/loader/mozJSComponentLoader.cpp, line 369
WARNING: NS_ENSURE_TRUE(otherJAR) failed: file /home/bunny/build/checkout/mozilla/modules/libjar/nsJARURI.cpp, line 273
Couldn't convert chrome URL: chrome://xmpp4moz/content/service/client_session.js
JS Component Loader: ERROR (null):0
                     uncaught exception: Error creating channel (invalid URL scheme?)
###!!! ASSERTION: document demuxed from FastLoad file more than once?: 'entry->mNextSegmentOffset != 0', file /home/bunny/build/checkout/mozilla/xpcom/io/nsFastLoadFile.cpp, line 554
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x8000FFFF: file /home/bunny/build/checkout/mozilla/js/src/xpconnect/loader/mozJSComponentLoader.cpp, line 369
WARNING: NS_ENSURE_TRUE(otherJAR) failed: file /home/bunny/build/checkout/mozilla/modules/libjar/nsJARURI.cpp, line 273
Couldn't convert chrome URL: chrome://xmpp4moz/content/service/transport-tcp.js
JS Component Loader: ERROR (null):0
                     uncaught exception: Error creating channel (invalid URL scheme?)
###!!! ASSERTION: document demuxed from FastLoad file more than once?: 'entry->mNextSegmentOffset != 0', file /home/bunny/build/checkout/mozilla/xpcom/io/nsFastLoadFile.cpp, line 554
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x8000FFFF: file /home/bunny/build/checkout/mozilla/js/src/xpconnect/loader/mozJSComponentLoader.cpp, line 369
WARNING: NS_ENSURE_TRUE(otherJAR) failed: file /home/bunny/build/checkout/mozilla/modules/libjar/nsJARURI.cpp, line 273
Couldn't convert chrome URL: chrome://xmpp4moz/content/service/client_service.js
JS Component Loader: ERROR (null):0
                     uncaught exception: Error creating channel (invalid URL scheme?)
WARNING: NS_ENSURE_TRUE(otherJAR) failed: file /home/bunny/build/checkout/mozilla/modules/libjar/nsJARURI.cpp, line 273
Couldn't convert chrome URL: chrome://branding/locale/brand.properties
++WEBSHELL 0x28be740 == 1
++DOMWINDOW == 1 (0x28cc150) [serial = 1] [Outer = (nil)]
WARNING: NS_ENSURE_TRUE(strenum) failed: file /home/bunny/build/checkout/mozilla/toolkit/components/commandlines/src/nsCommandLine.cpp, line 603
WARNING: dependent window created without a parent: file /home/bunny/build/checkout/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 458
++WEBSHELL 0x2272aa0 == 2
++DOMWINDOW == 2 (0x247bd90) [serial = 2] [Outer = (nil)]
WARNING: NS_ENSURE_TRUE(cv) failed: file /home/bunny/build/checkout/mozilla/xpfe/appshell/src/nsXULWindow.cpp, line 1542
WARNING: NS_ENSURE_TRUE(otherJAR) failed: file /home/bunny/build/checkout/mozilla/modules/libjar/nsJARURI.cpp, line 273
Couldn't convert chrome URL: chrome://global/locale/css.properties
WARNING: NS_ENSURE_TRUE(otherJAR) failed: file /home/bunny/build/checkout/mozilla/modules/libjar/nsJARURI.cpp, line 273
Couldn't convert chrome URL: chrome://global/content/xul.css
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004002: file /home/bunny/build/checkout/mozilla/layout/style/nsCSSLoader.cpp, line 1950
++DOMWINDOW == 3 (0x26faf20) [serial = 3] [Outer = 0x247bd40]
WARNING: NS_ENSURE_TRUE(otherJAR) failed: file /home/bunny/build/checkout/mozilla/modules/libjar/nsJARURI.cpp, line 273
Couldn't convert chrome URL: chrome://global/skin/xulscrollbars.css
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004002: file /home/bunny/build/checkout/mozilla/layout/style/nsCSSLoader.cpp, line 2051
###!!! ASSERTION: Could not load xulscrollbars.css.: 'gStyleCache->mScrollbarsSheet', file /home/bunny/build/checkout/mozilla/layout/style/nsLayoutStylesheetCache.cpp, line 95
WARNING: NS_ENSURE_TRUE(otherJAR) failed: file /home/bunny/build/checkout/mozilla/modules/libjar/nsJARURI.cpp, line 273
Couldn't convert chrome URL: chrome://mozapps/content/plugins/missingPluginBinding.css
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004002: file /home/bunny/build/checkout/mozilla/layout/style/nsCSSLoader.cpp, line 2051
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004002: file /home/bunny/build/checkout/mozilla/layout/base/nsStyleSheetService.cpp, line 176
WARNING: NS_ENSURE_TRUE(otherJAR) failed: file /home/bunny/build/checkout/mozilla/modules/libjar/nsJARURI.cpp, line 273
Couldn't convert chrome URL: chrome://global/skin/xulscrollbars.css
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004002: file /home/bunny/build/checkout/mozilla/layout/style/nsCSSLoader.cpp, line 2051
###!!! ASSERTION: Could not load xulscrollbars.css.: 'gStyleCache->mScrollbarsSheet', file /home/bunny/build/checkout/mozilla/layout/style/nsLayoutStylesheetCache.cpp, line 95
WARNING: NS_ENSURE_TRUE(otherJAR) failed: file /home/bunny/build/checkout/mozilla/modules/libjar/nsJARURI.cpp, line 273
Couldn't convert chrome URL: chrome://collab/content/splash.xul
WARNING: NS_ENSURE_TRUE(otherJAR) failed: file /home/bunny/build/checkout/mozilla/modules/libjar/nsJARURI.cpp, line 273
Couldn't convert chrome URL: chrome://global-platform/locale/intl.properties
WARNING: NS_ENSURE_TRUE(otherJAR) failed: file /home/bunny/build/checkout/mozilla/modules/libjar/nsJARURI.cpp, line 273
Couldn't convert chrome URL: chrome://global/locale/intl.properties
++DOMWINDOW == 4 (0x27dda10) [serial = 4] [Outer = 0x28cc100]
WARNING: NS_ENSURE_TRUE(otherJAR) failed: file /home/bunny/build/checkout/mozilla/modules/libjar/nsJARURI.cpp, line 273
Couldn't convert chrome URL: chrome://global/skin/xulscrollbars.css
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004002: file /home/bunny/build/checkout/mozilla/layout/style/nsCSSLoader.cpp, line 2051
###!!! ASSERTION: Could not load xulscrollbars.css.: 'gStyleCache->mScrollbarsSheet', file /home/bunny/build/checkout/mozilla/layout/style/nsLayoutStylesheetCache.cpp, line 95
###!!! ASSERTION: Must be a box frame!: 'mScrollCornerBox->IsBoxFrame()', file /home/bunny/build/checkout/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 2513
###!!! ASSERTION: A box layout method was called but InitBoxMetrics was never called: 'metrics', file /home/bunny/build/checkout/mozilla/layout/generic/nsFrame.cpp, line 6359

I tried to trace this problem:

1) "metrics" in nsFrame::BoxReflow is indeed null which is the cause of the crash.
2) This is mostly because of the stylesheets not loading as Robert (#8) said. Evidence is "A box layout method was called but InitBoxMetrics was never called: 'metrics'" and "Could not load xulscrollbars.css".
3) The problem with sytlesheets and lot of other files loading seems to be that Jar URI conversion fails with "WARNING: NS_ENSURE_TRUE(otherJAR) failed: file /home/bunny/build/checkout/mozilla/modules/libjar/nsJARURI.cpp, line 273"
4) Jar conversion itself seems to have failed because of manifest hash not holding proper values (nsIBaseURIs instead of nsIJARURIs).
5) This traces back to jar protocol handler "@mozilla.org/network/protocol;name=jar" component not being available at the time of parsing manifests (at even later, I think) and a default uri handler is used by nsIOService.
6) This may be because the component manager not loading the component properly. The contractID hash in the component manager does contain this contract id at all.

The application seems to be restarting twice (during first run) which means it is loading modules etc. a total of three times. This, I deduced from the message "WARNING: XPCOM objects created/destroyed from static ctor/dtor:..." appearing in a total of three sets in error log.  I don't know if this is normal. The first time the component manager is reading from compreg.dat in the application components directory. Then, it is trying to read second and third times from the profile directory. The first time the application runs, compreg.dat from the application directory is getting parsed and all the contractIDs are loaded into the hash. The second and third time, the component manager tries to read compreg.dat from the profile directory and is failing with file not found error. However, by the time application crashes a compreg.dat at the location at which the component manager tried to read exists and is properly filled.

I haven't looked further yet.

I think I found the problem:

Normally, first the nsChromeModule and nsJarModule are getting registered before javascript components. But somehow (directory scanning order?), under my conditions, javascripts components are getting loaded before nsJarModule. Some javascript modules try to load subscripts during registerSelf using chrome URLs. JS module needs chrome module which in turn needs that jar module.

This is not a bad thing. XPCOM component loading allows for dependencies by delaying registration when registerSelf returns NS_ERROR_FACTORY_REGISTER_AGAIN. This is not happening properly.
 
I have a bad JS component from XMPP4Moz which tries to load chrome url subscripts during JS loading. Chrome protocol handler is then trying to initialise chrome registry which in turn is parsing the manifests even without a jar protocol handler leading to the disaster as I mentioned previously.

I've fixed my component to load subscripts during registerSelf which happens on the second pass and everything work fine. However, minor problems in JS components should not crash the entire application. To me it appears that not registering chrome until jar module is registered seems to be a good compromise (although chrome does not strictly need jar module).
Here is the stract trace for js component triggering manifest parsing:

#0  nsChromeRegistry::ProcessManifest (this=0x22b1940, aManifest=0x22b9800, aSkinOnly=0) at /home/bunny/build/checkout/mozilla/chrome/src/nsChromeRegistry.cpp:1879
#1  0x00000000010d7e91 in nsChromeRegistry::CheckForNewChrome (this=0x22b1940) at /home/bunny/build/checkout/mozilla/chrome/src/nsChromeRegistry.cpp:1246
#2  0x00000000010d3bc0 in nsChromeRegistry::Init (this=0x22b1940) at /home/bunny/build/checkout/mozilla/chrome/src/nsChromeRegistry.cpp:566
#3  0x00000000010cd6e1 in nsChromeRegistryConstructor (aOuter=0x0, aIID=@0x16e00d0, aResult=0x7fffbaa9b8f0)
    at /home/bunny/build/checkout/mozilla/chrome/src/nsChromeFactory.cpp:49
#4  0x00002b5cf05ddfff in nsGenericFactory::CreateInstance (this=0x22a0800, aOuter=0x0, aIID=@0x16e00d0, aResult=0x7fffbaa9b8f0) at nsGenericFactory.cpp:80
#5  0x00002b5cf063b670 in nsComponentManagerImpl::CreateInstanceByContractID (this=0x2164610, aContractID=0x1aba400 "@mozilla.org/chrome/chrome-registry;1", 
    aDelegate=0x0, aIID=@0x16e00d0, aResult=0x7fffbaa9b8f0) at /home/bunny/build/checkout/mozilla/xpcom/components/nsComponentManager.cpp:1788
#6  0x00002b5cf063d46e in nsComponentManagerImpl::GetServiceByContractID (this=0x2164610, aContractID=0x1aba400 "@mozilla.org/chrome/chrome-registry;1", 
    aIID=@0x16e00d0, result=0x7fffbaa9b9f8) at /home/bunny/build/checkout/mozilla/xpcom/components/nsComponentManager.cpp:2226
#7  0x00002b5cf05d234b in CallGetService (aContractID=0x1aba400 "@mozilla.org/chrome/chrome-registry;1", aIID=@0x16e00d0, aResult=0x7fffbaa9b9f8)
    at nsComponentManagerUtils.cpp:94
#8  0x00002b5cf05d23e0 in nsGetServiceByContractID::operator() (this=0x7fffbaa9b9e0, aIID=@0x16e00d0, aInstancePtr=0x7fffbaa9b9f8) at nsComponentManagerUtils.cpp:278
#9  0x0000000000449ba5 in nsCOMPtr<nsIChromeRegistry>::assign_from_gs_contractid (this=0x7fffbaa9bc00, gs=
      {mContractID = 0x1aba400 "@mozilla.org/chrome/chrome-registry;1"}, aIID=@0x16e00d0) at ../../dist/include/xpcom/nsCOMPtr.h:1315
#10 0x0000000000449bfd in nsCOMPtr (this=0x7fffbaa9bc00, gs={mContractID = 0x1aba400 "@mozilla.org/chrome/chrome-registry;1"}) at ../../dist/include/xpcom/nsCOMPtr.h:677
#11 0x00000000010da692 in nsChromeProtocolHandler::NewChannel (this=0x22a0250, aURI=0x22a02e0, aResult=0x7fffbaa9c020)
    at /home/bunny/build/checkout/mozilla/chrome/src/nsChromeProtocolHandler.cpp:533
#12 0x00000000004c0d96 in nsIOService::NewChannelFromURI (this=0x22783e0, aURI=0x22a02e0, result=0x7fffbaa9c020)
    at /home/bunny/build/checkout/mozilla/netwerk/base/src/nsIOService.cpp:587
#13 0x00000000004bfba3 in nsIOService::NewChannel (this=0x22783e0, aSpec=@0x7fffbaa9c0d0, aCharset=0x0, aBaseURI=0x0, result=0x7fffbaa9c020)
    at /home/bunny/build/checkout/mozilla/netwerk/base/src/nsIOService.cpp:598
#14 0x00000000005a55f7 in mozJSSubScriptLoader::LoadSubScript (this=0x22d2720) at /home/bunny/build/checkout/mozilla/js/src/xpconnect/loader/mozJSSubScriptLoader.cpp:227
#15 0x00002b5cf06629ea in NS_InvokeByIndex_P (that=0x22d2720, methodIndex=3, paramCount=1, params=0x7fffbaa9c360)
    at /home/bunny/build/checkout/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_64_linux.cpp:208
#16 0x00000000005df73c in XPCWrappedNative::CallMethod (ccx=@0x7fffbaa9c7c0, mode=XPCWrappedNative::CALL_METHOD)
    at /home/bunny/build/checkout/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2369
#17 0x00000000005ed7a4 in XPC_WN_CallMethod (cx=0x224b590, obj=0x22ec2c0, argc=2, argv=0x22af9c8, vp=0x7fffbaa9c9c0)
    at /home/bunny/build/checkout/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1470
#18 0x00002b5cf02cf4d3 in js_Invoke (cx=0x224b590, argc=2, vp=0x22af9b8, flags=2048) at /home/bunny/build/checkout/mozilla/js/src/jsinterp.c:1265
#19 0x00002b5cf02bf9db in js_Interpret (cx=0x224b590, pc=0x22d2b6b ":", result=0x7fffbaa9d780) at /home/bunny/build/checkout/mozilla/js/src/jsinterp.c:4823
#20 0x00002b5cf02cffcb in js_Execute (cx=0x224b590, chain=0x22ea1c0, script=0x22d28f0, down=0x0, flags=2048, result=0x7fffbaa9d9f8)
    at /home/bunny/build/checkout/mozilla/js/src/jsinterp.c:1509
#21 0x00002b5cf02644df in JS_ExecuteScript (cx=0x224b590, obj=0x22ea1c0, script=0x22d28f0, rval=0x7fffbaa9d9f8) at /home/bunny/build/checkout/mozilla/js/src/jsapi.c:4823
#22 0x000000000059f19d in mozJSComponentLoader::GlobalForLocation (this=0x216d500, aComponent=0x22b5dc0, aGlobal=0x22b5c18, aLocation=0x22b5c20)
    at /home/bunny/build/checkout/mozilla/js/src/xpconnect/loader/mozJSComponentLoader.cpp:1270
#23 0x00000000005a088a in mozJSComponentLoader::LoadModule (this=0x216d500, aComponentFile=0x22b5dc0, aResult=0x7fffbaa9df30)
    at /home/bunny/build/checkout/mozilla/js/src/xpconnect/loader/mozJSComponentLoader.cpp:607
#24 0x00002b5cf063c3ea in nsComponentManagerImpl::AutoRegisterComponent (this=0x2164610, aComponentFile=0x22b5dc0, aDeferred=@0x7fffbaa9e130, minLoader=0)
    at /home/bunny/build/checkout/mozilla/xpcom/components/nsComponentManager.cpp:3027
#25 0x00002b5cf063c950 in nsComponentManagerImpl::AutoRegisterDirectory (this=0x2164610, inDirSpec=0x2170cf0, aLeftovers=@0x7fffbaa9e140, aDeferred=@0x7fffbaa9e130)
    at /home/bunny/build/checkout/mozilla/xpcom/components/nsComponentManager.cpp:2942
#26 0x00002b5cf063ca96 in nsComponentManagerImpl::AutoRegisterImpl (this=0x2164610, inDirSpec=0x2170cf0, aLeftovers=@0x7fffbaa9e140, aDeferred=@0x7fffbaa9e130)
    at /home/bunny/build/checkout/mozilla/xpcom/components/nsComponentManager.cpp:2901
#27 0x00002b5cf063e8ad in nsComponentManagerImpl::AutoRegister (this=0x2164610, aSpec=0x0)
    at /home/bunny/build/checkout/mozilla/xpcom/components/nsComponentManager.cpp:3310
#28 0x0000000000440779 in ScopedXPCOMStartup::DoAutoreg (this=0x7fffbaa9e200) at /home/bunny/build/checkout/mozilla/toolkit/xre/nsAppRunner.cpp:1006
#29 0x0000000000442bcb in ImportProfiles (aPService=0x2154920, aNative=0x20e2370) at /home/bunny/build/checkout/mozilla/toolkit/xre/nsAppRunner.cpp:1795
#30 0x0000000000444769 in SelectProfile (aResult=0x7fffbaa9eab0, aNative=0x20e2370, aStartOffline=0x7fffbaa9eaac, aProfileName=0x7fffbaa9e7e0)
    at /home/bunny/build/checkout/mozilla/toolkit/xre/nsAppRunner.cpp:1958
#31 0x00000000004463f2 in XRE_main (argc=1, argv=0x7fffbaa9ef48, aAppData=0x20d7f90) at /home/bunny/build/checkout/mozilla/toolkit/xre/nsAppRunner.cpp:2873
#32 0x000000000043f8e0 in main (argc=1, argv=0x7fffbaa9ef48) at /home/bunny/build/checkout/mozilla/collab/app/nsCollabApp.cpp:88

Uh... This thing is doing network access during GlobalForLocation?

I'm not sure there's a sane way of making that sort of malfeasance work in general.
(In reply to comment #22)
> Uh... This thing is doing network access during GlobalForLocation?

Not doing network access, just loading a subscript from a chrome URL.



And delaying chrome module until after the registration of jar module should surely avoid the crash.
Same thing.  chrome:// URLs can map to https://, for example.
I'll let Benjamin comment on the feasibility of the "chrome module before jar module" thing, but given that we're still getting factories, not actually running registration code, it sounds like we're early enough that we may not be able to do that.
If I understand correctly, at least in case of chrome protocol handler the factory is available after the registration.
The real answer is: you should not use Cu.import with chrome URIs during registration. I will add a check to make this throw an error.
Assignee: roc → nobody
Component: Layout → XRE Startup
Product: Core → Toolkit
QA Contact: layout → xre.startup
Target Milestone: --- → mozilla1.9
Assignee: nobody → benjamin
Dave, can you think of any way I could usefully unit-test this? I think I'd have to create a test harness that registers component dirs in an unusual order.
Attachment #310494 - Flags: review?
Attachment #310494 - Flags: review? → review?(dtownsend)
(In reply to comment #29)
> Created an attachment (id=310494) [details]
> Don't initialize the chrome registry if JAR isn't up, rev. 1
> 

Benjamin, does this mean that those crashes will now turn into application cannot start properly errors since nsChromeRegistry::Init is never called again (I think)?
I believe it would be called again: getservice will fail once, but it should retry later successfully.
Comment on attachment 310494 [details] [diff] [review]
Don't initialize the chrome registry if JAR isn't up, rev. 1

I guess this is reasonable. It will hand back a failure to anything trying to use a chrome url before the jar protocol is up but I suppose that chrome urls are so often in jars that that makes some sense.

As for unit testing, I can't really see how you could reproduce this in a standard environent. I guess you could write a custom executable that registered components manually somehow.
Attachment #310494 - Flags: review?(dtownsend) → review+
Comment on attachment 310494 [details] [diff] [review]
Don't initialize the chrome registry if JAR isn't up, rev. 1

This patch could potentially fix a class of errors that happen during component registration which cause the browser to crash on startup. It's not entirely without risk, as it intentionally causes the chrome registry to fail if the JAR module isn't registered yet: but that shouldn't happen, and if it does you'd likely experience this crash anyway.
Attachment #310494 - Flags: approval1.9?
This patch also has at least a wallpaper fix and perhaps the correct fix for blocker bug 391311
Comment on attachment 310494 [details] [diff] [review]
Don't initialize the chrome registry if JAR isn't up, rev. 1

a=beltzner
Attachment #310494 - Flags: approval1.9? → approval1.9+
Keywords: checkin-needed
Checking in chrome/src/nsChromeRegistry.cpp;
/cvsroot/mozilla/chrome/src/nsChromeRegistry.cpp,v  <--  nsChromeRegistry.cpp
new revision: 1.366; previous revision: 1.365
done
Status: NEW → RESOLVED
Closed: 16 years ago
Keywords: checkin-needed
Resolution: --- → FIXED
Component: XRE Startup → Startup and Profile System
QA Contact: xre.startup → startup
Crash Signature: [@ nsFrame::BoxReflow]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: