474938 - crashes [@ nsCSSFrameConstructor::FindInputData]

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Starting in 1/20 builds, a new topcrash appeared (and it's now the #1 crash in trunk builds) at nsCSSFrameConstructor::FindInputData.

For reports, see http://crash-stats.mozilla.com/report/list?product=Firefox&branch=1.9.2&version=Firefox%3A3.2a1pre&query_search=signature&query_type=contains&query=&date=&range_value=7&range_unit=days&do_query=1&signature=nsCSSFrameConstructor%3A%3AFindInputData%28nsIContent*%2C%20nsStyleContext*%29

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

So, the line we're crashing on corresponds perfectly to the crash that was fixed by http://hg.mozilla.org/mozilla-central/rev/9ac7c363cf78 which makes me think that this is in fact also the cause of bug 474915.

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

In particular, http://hg.mozilla.org/mozilla-central/rev/692ae2bf70de essentially backed out http://hg.mozilla.org/mozilla-central/rev/9ac7c363cf78 (although the previous time I don't know that it was known to show up in crash-stats).

Comment 3

[Boris Zbarsky [:bzbarsky]]

I restored the null-check.  http://hg.mozilla.org/mozilla-central/rev/915c70b15d1f

Comment 4

[Boris Zbarsky [:bzbarsky]]

I filed bug 475015 to get some URLs for those crashing pages.  So far, the only one I found at http://crash-stats.mozilla.com/topcrasher/byurl/Firefox/3.2a1pre is http://www.daemon-search.com/explore and I just loaded it a few dozen times with no crash.  :(

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Judging from bug 474915 and bug 474961, we may well have two of them in the talos pageset.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Yeah, but I don't have that pageset...

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I bet Alice does, though.