376625 - Random crash [@ mozilla::dom::FragmentOrElement::GetBindingParent()]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[jayram]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

Random crash. Only yahoo mail was opened in one of the tabs. Using Ubuntu Edgy

Reproducible: Always

Steps to Reproduce:
1.
2.
3.
Actual Results:  
http://talkback-public.mozilla.org/search/start.jsp?search=2&type=iid&id=TB30917696

Comment 1

[jayram]

nsGenericElement::GetBindingParent()  [mozilla/content/base/src/nsGenericElement.cpp, line 2701]
nsBindingManager::WalkRules()  [mozilla/content/xbl/src/nsBindingManager.cpp, line 1105]
nsStyleSet::FileRules()  [mozilla/layout/style/nsStyleSet.cpp, line 848]
nsStyleSet::ResolveStyleFor()  [mozilla/layout/style/nsStyleSet.cpp, line 273]
nsFrameManager::ReResolveStyleContext()  [mozilla/layout/base/nsFrameManager.cpp, line 80]
nsFrameManager::ReResolveStyleContext()  [mozilla/layout/base/nsFrameManager.cpp, line 1354]
nsFrameManager::ReResolveStyleContext()  [mozilla/layout/base/nsFrameManager.cpp, line 1354]
nsFrameManager::ReResolveStyleContext()  [mozilla/layout/base/nsFrameManager.cpp, line 1354]
nsFrameManager::ReResolveStyleContext()  [mozilla/layout/base/nsFrameManager.cpp, line 1354]
nsFrameManager::ReResolveStyleContext()  [mozilla/layout/base/nsFrameManager.cpp, line 1354]
nsFrameManager::ReResolveStyleContext()  [mozilla/layout/base/nsFrameManager.cpp, line 1354]
nsFrameManager::ComputeStyleChangeFor()  [mozilla/layout/base/nsFrameManager.cpp, line 236]
nsCSSFrameConstructor::RestyleElement()  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10565]
nsCSSFrameConstructor::ProcessOneRestyle()  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 14096]
nsCSSFrameConstructor::ProcessPendingRestyles()  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 14145]
PresShell::FlushPendingNotifications()  [mozilla/layout/base/nsPresShell.cpp, line 5384]
nsDocument::FlushPendingNotifications()  [mozilla/content/base/src/nsDocument.cpp, line 848]
nsHTMLDocument::FlushPendingNotifications()  [mozilla/content/html/document/src/nsHTMLDocument.cpp, line 1310]
nsGenericHTMLElement::GetOffsetRect()  [mozilla/content/html/content/src/nsGenericHTMLElement.cpp, line 624]
nsGenericHTMLElement::GetOffsetWidth()  [mozilla/content/html/content/src/nsGenericHTMLElement.cpp, line 838]
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)()  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2168]
XPC_WN_GetterSetter()  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1959]
js_Invoke()  [mozilla/js/src/jsinterp.c, line 1396]
js_InternalInvoke()  [mozilla/js/src/jsinterp.c, line 1491]
js_InternalGetOrSet()  [mozilla/js/src/jsinterp.c, line 1561]
js_NativeGet()  [mozilla/js/src/jsobj.c, line 3423]
js_GetProperty()  [mozilla/js/src/jsobj.c, line 3556]
js_Interpret()  [mozilla/js/src/jsinterp.c, line 5805]
js_Invoke()  [mozilla/js/src/jsinterp.c, line 1415]
js_InternalInvoke()  [mozilla/js/src/jsinterp.c, line 1491]
JS_CallFunctionValue()  [mozilla/js/src/jsapi.c, line 4357]
nsJSContext::CallEventHandler()  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 1495]
nsGlobalWindow::RunTimeout()  [mozilla/dom/src/base/nsGlobalWindow.cpp, line 848]
nsGlobalWindow::TimerCallback()  [mozilla/dom/src/base/nsGlobalWindow.cpp, line 7126]
nsTimerImpl::Fire()  [mozilla/xpcom/threads/nsTimerImpl.cpp, line 395]
handleTimerEvent()  [mozilla/xpcom/threads/nsTimerImpl.cpp, line 462]
PL_HandleEvent()  [mozilla/xpcom/threads/plevent.c, line 689]
PL_ProcessPendingEvents()  [mozilla/xpcom/threads/plevent.c, line 623]
nsEventQueueImpl::ProcessPendingEvents()  [mozilla/xpcom/threads/nsEventQueue.cpp, line 421]
event_processor_callback()  [mozilla/widget/src/gtk2/nsAppShell.cpp, line 67]
libglib-2.0.so.0 + 0x54c8d (0xb791bc8d)
libglib-2.0.so.0 + 0x2b802 (0xb78f2802)
libglib-2.0.so.0 + 0x2e7df (0xb78f57df)
libglib-2.0.so.0 + 0x2eb89 (0xb78f5b89)
libgtk-x11-2.0.so.0 + 0x137574 (0xb7bcf574)
nsAppShell::Run()  [mozilla/widget/src/gtk2/nsAppShell.cpp, line 141]
nsAppStartup::Run()  [mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152]
XRE_main()  [mozilla/toolkit/xre/nsAppRunner.cpp, line 2697]
main()  [mozilla/browser/app/nsBrowserApp.cpp, line 62]
libc.so.6 + 0x158cc (0xb73de8cc)

Comment 2

[Wayne Mery (:wsmwk)]

bp-29ddfeaa-0d35-43ed-a464-58b8c2110122 may be the same stack.  FF 4.0 beta
EXCEPTION_ACCESS_VIOLATION_READ
0xffffffffffffffff
0		@0xffffffff	
1	xul.dll	nsGenericElement::GetBindingParent	content/base/src/nsGenericElement.cpp:3479
2	xul.dll	nsStyleSet::WalkRuleProcessors	layout/style/nsStyleSet.cpp:738
3	xul.dll	nsStyleSet::HasAttributeDependentStyle	layout/style/nsStyleSet.cpp:1297
4	xul.dll	nsGenericElement::SetAttr	content/base/src/nsGenericElement.cpp:4613
5	xul.dll	nsGenericHTMLElement::SetAttr	content/html/content/src/nsGenericHTMLElement.cpp:1210
6	xul.dll	nsGenericHTMLElement::SetAttr	content/html/content/src/nsGenericHTMLElement.h:166
7	xul.dll	nsGenericHTMLElement::SetId	content/html/content/src/nsGenericHTMLElement.cpp:412
8	xul.dll	nsIDOMHTMLElement_SetId	obj-firefox/js/src/xpconnect/src/dom_quickstubs.cpp:16779 


Other crashes at same line# (but different stack)
bp-3ff3d6a6-186a-4022-b46a-2d1d12110125
bp-e5c920c1-2bb1-41a7-aa4b-75de62110210

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'mozilla::dom::FragmentOrElement::GetBindingParent':
 - nightly (version 50): 0 crash from 2016-06-06.
 - aurora  (version 49): 0 crash from 2016-06-07.
 - beta    (version 48): 47 crashes from 2016-06-06.
 - release (version 47): 77 crashes from 2016-05-31.
 - esr     (version 45): 1 crash from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          0          0          0          0          0          0
 - aurora           0          0          0          0          0          0          0
 - beta            11          4         11          6          4          7          2
 - release         16          6          9         16         12         10          1
 - esr              0          0          0          0          0          0          0

Affected platforms: Windows, Linux

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.