453927 - top crash [@ JS_RestoreFrameChain]

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[chris hofmann]

crash reporter is back up and I started looking at a sample of 3.0.1 crashes received in the last 24 hours.  This is the stack of the #2 top crash

It appears to be a start up crash with no real information in any of the comments received so far...

I also don't see any indication of a common .dll or extension with binary component that might be involved.

0  	js3250.dll  	JS_RestoreFrameChain  	
1 	xul.dll 	XPCJSContextStack::Pop(JSContext**) 	
2 	xul.dll 	nsCxPusher::Pop() 	
3 	xul.dll 	nsTextBoxFrame::UpdateAccesskey(nsWeakFrame&) 	
4 	mozcrt19.dll 	free 	
5 	xul.dll 	nsAsyncAccesskeyUpdate::ReflowFinished() 	
6 	xul.dll 	PresShell::HandlePostedReflowCallbacks() 	
7 	xul.dll 	PresShell::DidDoReflow() 	
8 	xul.dll 	PresShell::ProcessReflowCommands(int) 	


timeless filed a bunch of bugs naming JS_RestoreFrameChain at the top of the stack and in the title of the bugs but I don't think these are related...

Comment 1

[chris hofmann]

link to some crash reports

http://crash-stats.mozilla.com/report/list?version=Firefox%3A3.0.1&query_search=signature&query_type=contains&query=&date=&range_value=24&range_unit=hours&do_query=1&signature=JS_RestoreFrameChain

Comment 2

[chris hofmann]

source line info is only in the raw dump for right now in the new reporting system...

13|0|js3250.dll|JS_RestoreFrameChain|cvs:cvs.mozilla.org/cvsroot:mozilla/js/src/jsapi.c:3.446|5192|0x4 

13|1|xul.dll|XPCJSContextStack::Pop(JSContext * *)|cvs:cvs.mozilla.org/cvsroot:mozilla/js/src/xpconnect/src/xpcthreadcontext.cpp:1.54|113|0x7 

13|2|xul.dll|nsCxPusher::Pop()|cvs:cvs.mozilla.org/cvsroot:mozilla/content/base/src/nsContentUtils.cpp:1.309|2686|0x11 

13|3|xul.dll|nsTextBoxFrame::UpdateAccesskey(nsWeakFrame &)|cvs:cvs.mozilla.org/cvsroot:mozilla/layout/xul/base/src/nsTextBoxFrame.cpp:1.132|252|0x7 

13|4|mozcrt19.dll|free|e:/fx19rel/winnt_5.2_depend/mozilla/obj-fx-trunk/memory/jemalloc/src/jemalloc.c|6009|0x16 

13|5|xul.dll|nsAsyncAccesskeyUpdate::ReflowFinished()|cvs:cvs.mozilla.org/cvsroot:mozilla/layout/xul/base/src/nsTextBoxFrame.cpp:1.132|222|0x8 

13|6|xul.dll|PresShell::HandlePostedReflowCallbacks()|cvs:cvs.mozilla.org/cvsroot:mozilla/layout/base/nsPresShell.cpp:3.1116|4471|0x5 

13|7|xul.dll|PresShell::DidDoReflow()|cvs:cvs.mozilla.org/cvsroot:mozilla/layout/base/nsPresShell.cpp:3.1116|6213|0x4 

13|8|xul.dll|PresShell::ProcessReflowCommands(int)|cvs:cvs.mozilla.org/cvsroot:mozilla/layout/base/nsPresShell.cpp:3.1116|6401|0x6

Comment 3

[chris hofmann]

looks like code at the top of the stack has been around for more than a year...

3.312 <[e-mail]> 2007-04-13 12:20
Add an API to set aside and restore cx->fp. bug 377090, r=brendan

Comment 4

[chris hofmann]

this looks like its going to be a tough one to figure out.

Comment 5

[chris hofmann]

there are only about 10 reports of this but 3.0 users in the last 24 hours, and 645 reports from 3.0.1 users but that just may reflect a bigger user base on 3.0.1 now and not increased visibility or regression

Comment 6

[Samuel Sidler (old account; do not CC)]

Blake, does anything obvious about this code stand out to you?

We had some roboform-caused crashes (a regression on our end) during the 3.0.2 cycle, which bring up bug 423411 (filed a while ago and clearly not a regression in 3.0.2). That bug is probably the same or similar.

Comment 7

[Samuel Sidler (old account; do not CC)]

Regression from 2.0, fwiw.

Comment 8

[Samuel Sidler (old account; do not CC)]

(In reply to comment #0)
> I also don't see any indication of a common .dll or extension with binary
> component that might be involved.

You sure? I disagree. In every module list, I see DTToolbarFF.dll, which also seems to be the cause of bug 457898.

e.g.:
  bp-0a72005c-94b3-11dd-b26f-001321b13766
  bp-d6f0ac23-94b2-11dd-948a-001a4bd43e5c
  bp-fb46524a-94b2-11dd-a3ae-001a4bd43e5c
  bp-881013e1-948f-11dd-87ad-001321b13766

All are using version 1.0.0.1 of the dll file (maybe the same version of the toolbar?).

We need to find out what's going on. If this toolbar is the cause of our #1 and #4 topcrashes, we need to either blocklist it or get it fixed.

Comment 9

[Rey Bango]

The toolbar is set to be blocklisted per this bug https://bugzilla.mozilla.org/show_bug.cgi?id=459850

Comment 10

[Jesse Ruderman]

There were 683 "JS_RestoreFrameChain" reports in the last week, not quite enough to make the top-100-crashes list.  Two people mentioned Kodak photo sharing.

Comment 11

[chris hofmann]

http://confluence.atlassian.com/display/CONFEXT/Atlassian+Drag+and+Drop+Firefox+plugin was one of the urls in the list.  might be worth installing it to look for incompatibility

distribution of versions where the crash was found on 20090817 was
  53 Firefox 3.0.13
  41 Firefox 3.5.2
   4 Firefox 3.0.11
   3 Firefox 3.5
   1 Firefox 3.0.9
   1 Firefox 3.0.5
   1 Firefox 3.0.4
   1 Firefox 3.0.12
   1 Firefox 3.0.1
   1 Firefox 3.0

Comment 12

[Sheila Mooney]

This signature still exists but it seems to be mostly on 3.0 and 3.6. Closing.