449481 - Crash [@ nsPresContext::GetContainerInternal][@ nsINode::GetOwnerDoc] with a lot of audio elements src attribute

Status: RESOLVED WORKSFORME

(Core :: Audio/Video, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, I usually crash with that testcase within 30s.

I don't get a breakpad id with this kind of crash.

Comment 1

[Martijn Wargers (dead)]

I guess this is basically the crash I constantly get when testing video/audio:
http://crash-stats.mozilla.com/report/index/a2fc0efd-9084-11dd-932b-001cc4e2bf68
0  	xul.dll  	nsPresContext::GetContainerInternal  	 layout/base/nsPresContext.cpp:1260
1 	xul.dll 	nsPresContext::GetContainer 	layout/base/nsPresContext.h:421
2 	xul.dll 	PresShell::UnsuppressAndInvalidate 	layout/base/nsPresShell.cpp:4310
3 	xul.dll 	PresShell::UnsuppressPainting 	layout/base/nsPresShell.cpp:4343
4 	xul.dll 	PresShell::sPaintSuppressionCallback 	layout/base/nsPresShell.cpp:2505
5 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:420
6 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:512
7 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:510
8 	xul.dll 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:227
9 	xul.dll 	nsThread::Shutdown 	xpcom/threads/nsThread.cpp:465
10 	xul.dll 	nsOggDecoder::Stop 	content/media/video/src/nsOggDecoder.cpp:504
11 	xul.dll 	nsHTMLMediaElement::DestroyContent 	content/html/content/src/nsHTMLMediaElement.cpp:827
12 	xul.dll 	nsGenericElement::DestroyContent 	content/base/src/nsGenericElement.cpp:3485
13 	xul.dll 	nsGenericElement::DestroyContent 	content/base/src/nsGenericElement.cpp:3485
14 	xul.dll 	nsGenericElement::DestroyContent 	content/base/src/nsGenericElement.cpp:3485
15 	xul.dll 	nsGenericElement::DestroyContent 	content/base/src/nsGenericElement.cpp:3485
16 	xul.dll 	nsDocument::Destroy 	content/base/src/nsDocument.cpp:6392
17 	xul.dll 	xul.dll@0x2dcdd2 	

I can try and attach a testcase for this, if wanted.

Comment 2

[Martijn Wargers (dead)]

I'm still crashing with the testcase (after a while, 30s or so), using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b2pre) Gecko/20081020 Minefield/3.1b2pre

It has got even worse, it has gotten the ability to crash my other Firefox too, which I run in a separate process.
Just before the crash, I'm seeing symptoms of UI not being repainted, like Firefox is exhausting GDI resources (reminds me of bug 420145).

Breakpad ids of the crashes while running the testcase:
http://crash-stats.mozilla.com/report/index/bda6c0d1-9ead-11dd-8cf5-001cc4e2bf68?p=1
0  	xul.dll  	nsINode::GetOwnerDoc  	 obj-firefox/dist/include/content/nsINode.h:267
1 	xul.dll 	nsHTMLMediaElement::DispatchProgressEvent 	content/html/content/src/nsHTMLMediaElement.cpp:808
2 	xul.dll 	nsMediaDecoder::Progress 	content/media/video/src/nsMediaDecoder.cpp:137
3 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:420
4 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:512
5 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:510
etc...

http://crash-stats.mozilla.com/report/index/079020c7-9eae-11dd-b142-001321b13766?p=1
http://crash-stats.mozilla.com/report/index/6623674c-9eae-11dd-9a7a-001a4bd43ef6?p=1

Breakpad ids I get in the other Firefox process:
http://crash-stats.mozilla.com/report/index/9b7c695c-9eae-11dd-81c7-0013211cbf8a?p=1
http://crash-stats.mozilla.com/report/index/ef490e0a-9eae-11dd-bb47-001a4bd43ed6?p=1
http://crash-stats.mozilla.com/report/index/f135b573-9eae-11dd-ab7f-001cc45a2ce4?p=1
Frame  	Module  	Signature [Expand]  	Source
0 	xul.dll 	imgRequest::NotifyProxyListener 	modules/libpr0n/src/imgRequest.cpp:230
1 	xul.dll 	imgRequestProxy::Clone 	modules/libpr0n/src/imgRequestProxy.cpp:349
2 	xul.dll 	nsImageBoxFrame::UpdateImage 	layout/xul/base/src/nsImageBoxFrame.cpp:283
3 	xul.dll 	nsImageBoxFrame::Init 	layout/xul/base/src/nsImageBoxFrame.cpp:238
4 	xul.dll 	nsCSSFrameConstructor::InitAndRestoreFrame 	layout/base/nsCSSFrameConstructor.cpp:6757
5 	xul.dll 	nsCSSFrameConstructor::ConstructXULFrame 	layout/base/nsCSSFrameConstructor.cpp:6134
6 	xul.dll 	nsCSSFrameConstructor::ConstructFrameInternal 	layout/base/nsCSSFrameConstructor.cpp:7535
etc..

Comment 3

[Martijn Wargers (dead)]

And now I hang with the testcase, using current trunk build.

Comment 4

[Martijn Wargers (dead)]

Never mind, I'm still able to generate  @nsINode::GetOwnerDoc crashes (although not with the attached testcase).