507864 - random crash in Tp test on Linux [@ _purecall | nsHTMLFormElement::RemoveElement(nsIFormControl*, int)]

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1249169596.1249174547.1515.gz

A random crash happened during tp test.

> NOISE: Cycle 4: loaded http://localhost/page_load_test/pages/www.php.net/www.php.net/index.html (next: http://localhost/page_load_test/pages/www.spiegel.de/www.spiegel.de/index.html)
> NOISE: 
> NOISE: __FAILbrowser crash (code 256)__FAIL
> NOISE: Found crashdump: /tmp/tmpUJvXIm/profile/minidumps/76db0eb4-ea57-c619-633c9ccb-6385f741.dmp
> Operating system: Linux
>                   0.0.0 Linux 2.6.22-14-generic #1 SMP Sun Oct 14 23:05:12 GMT 2007 i686 GNU/Linux
> CPU: x86
>      GenuineIntel family 10 model 15 stepping 2
>      2 CPUs
> 
> Crash reason:  SIGABRT
> Crash address: 0xffffe410
> 
> Thread 0 (crashed)
>  0  0xffffe410
>     eip = 0xffffe410   esp = 0xbfa7c480   ebp = 0xbfa7c49c   ebx = 0x0000191e
>     esi = 0x0000191e   edi = 0xb6748ff4   eax = 0x00000000   ecx = 0x0000191e
>     edx = 0x00000006   efl = 0x00200206
>  1  libc-2.6.1.so + 0x2c200
>     eip = 0xb662f201   esp = 0xbfa7c4a4   ebp = 0xbfa7c5c8
>  2  libstdc++.so.6.0.9 + 0xbb6df
>     eip = 0xb68136e0   esp = 0xbfa7c5d0   ebp = 0xbfa7c608
>  3  libstdc++.so.6.0.9 + 0xb8f64
>     eip = 0xb6810f65   esp = 0xbfa7c610   ebp = 0xbfa7c628
>  4  libstdc++.so.6.0.9 + 0xb8fa1
>     eip = 0xb6810fa2   esp = 0xbfa7c630   ebp = 0xbfa7c638
>  5  libstdc++.so.6.0.9 + 0xb9864
>     eip = 0xb6811865   esp = 0xbfa7c640   ebp = 0xbfa7c658
>  6  libxul.so!nsHTMLFormElement::RemoveElement(nsIFormControl*, int) [nsHTMLFormElement.cpp:0b159e56802e : 1463 + 0x5]
>     eip = 0xb767d909   esp = 0xbfa7c660   ebp = 0xbfa7c6a8
>  7  libxul.so!nsGenericHTMLFormElement::ClearForm(int, int) [nsGenericHTMLElement.cpp:0b159e56802e : 2335 + 0xf]
>     eip = 0xb766c304   esp = 0xbfa7c6b0   ebp = 0xbfa7c808
>  8  libxul.so!nsGenericHTMLFormElement::~nsGenericHTMLFormElement() [nsGenericHTMLElement.cpp:0b159e56802e : 2286 + 0xa]
>     eip = 0xb766c416   esp = 0xbfa7c810   ebp = 0xbfa7c828
>  9  libxul.so!nsHTMLInputElement::~nsHTMLInputElement() [nsHTMLInputElement.cpp:0b159e56802e : 477 + 0xf]
>     eip = 0xb7688617   esp = 0xbfa7c830   ebp = 0xbfa7c858
> 10  libxul.so!nsNodeUtils::LastRelease(nsINode*) [nsNodeUtils.cpp:0b159e56802e : 259 + 0xa]
>     eip = 0xb761c93d   esp = 0xbfa7c860   ebp = 0xbfa7c898
> 11  libxul.so!nsGenericElement::Release() [nsGenericElement.cpp:0b159e56802e : 4134 + 0x5]
>     eip = 0xb760e3b9   esp = 0xbfa7c8a0   ebp = 0xbfa7c8b8
> 12  libxul.so!nsHTMLInputElement::Release() [nsHTMLInputElement.cpp:0b159e56802e : 489 + 0x7]
>     eip = 0xb76877bc   esp = 0xbfa7c8c0   ebp = 0xbfa7c8d8
> 13  libxul.so!SinkContext::AddLeaf(nsIParserNode const&) [nsAutoPtr.h : 956 + 0x8]
>     eip = 0xb76b9337   esp = 0xbfa7c8e0   ebp = 0xbfa7c9a8
> 14  libxul.so!HTMLContentSink::AddLeaf(nsIParserNode const&) [nsHTMLContentSink.cpp:0b159e56802e : 2408 + 0xd]
>     eip = 0xb76b999c   esp = 0xbfa7c9b0   ebp = 0xbfa7c9c8
> 15  libxul.so!CNavDTD::AddLeaf(nsIParserNode const*) [CNavDTD.cpp:0b159e56802e : 3008 + 0x8]
>     eip = 0xb7441210   esp = 0xbfa7c9d0   ebp = 0xbfa7c9e8
> 16  libxul.so!CNavDTD::HandleDefaultStartToken(CToken*, nsHTMLTag, nsCParserNode*) [CNavDTD.cpp:0b159e56802e : 1041 + 0xc]
>     eip = 0xb744164f   esp = 0xbfa7c9f0   ebp = 0xbfa7ca28
> 17  libxul.so!CNavDTD::HandleStartToken(CToken*) [CNavDTD.cpp:0b159e56802e : 1390 + 0xe]
>     eip = 0xb74419d7   esp = 0xbfa7ca30   ebp = 0xbfa7ca78
> 18  libxul.so!CNavDTD::HandleToken(CToken*) [CNavDTD.cpp:0b159e56802e : 717 + 0xc]
>     eip = 0xb7441db9   esp = 0xbfa7ca80   ebp = 0xbfa7cad8
> 19  libxul.so!CNavDTD::BuildModel(nsITokenizer*, int, int, nsCString const*) [CNavDTD.cpp:0b159e56802e : 304 + 0xa]
>     eip = 0xb7442d24   esp = 0xbfa7cae0   ebp = 0xbfa7cb38
> 20  libxul.so!nsParser::BuildModel() [nsParser.cpp:0b159e56802e : 2452 + 0x32]
>     eip = 0xb7448b3f   esp = 0xbfa7cb40   ebp = 0xbfa7cb88
> 21  libxul.so!nsParser::ResumeParse(int, int, int) [nsParser.cpp:0b159e56802e : 2333 + 0x8]
>     eip = 0xb744bd2b   esp = 0xbfa7cb90   ebp = 0xbfa7cbc8
> 22  libxul.so!nsParser::ContinueInterruptedParsing() [nsParser.cpp:0b159e56802e : 1829 + 0xf]
>     eip = 0xb7449c13   esp = 0xbfa7cbd0   ebp = 0xbfa7cbf8
> 23  libxul.so!nsContentSink::ContinueInterruptedParsingIfEnabled() [nsContentSink.cpp:0b159e56802e : 1761 + 0x8]
>     eip = 0xb75dca82   esp = 0xbfa7cc00   ebp = 0xbfa7cc18
> 24  libxul.so!nsRunnableMethod<nsContentSink, void>::Run() [nsThreadUtils.h : 264 + 0x10]
>     eip = 0xb75dfb1c   esp = 0xbfa7cc20   ebp = 0xbfa7cc38
> 25  libxul.so!nsThread::ProcessNextEvent(int, int*) [nsThread.cpp:0b159e56802e : 527 + 0xa]
>     eip = 0xb7bcdac8   esp = 0xbfa7cc40   ebp = 0xbfa7cc78
> 26  libxul.so!NS_ProcessNextEvent_P(nsIThread*, int) [nsThreadUtils.cpp : 230 + 0xd]
>     eip = 0xb7b9c803   esp = 0xbfa7cc80   ebp = 0xbfa7cca8
> 27  libxul.so!nsBaseAppShell::Run() [nsBaseAppShell.cpp:0b159e56802e : 170 + 0x9]
>     eip = 0xb7b0531e   esp = 0xbfa7ccb0   ebp = 0xbfa7ccc8
> 28  libxul.so!nsAppStartup::Run() [nsAppStartup.cpp:0b159e56802e : 193 + 0x5]
>     eip = 0xb79d6116   esp = 0xbfa7ccd0   ebp = 0xbfa7cce8
> 29  libxul.so!XRE_main [nsAppRunner.cpp:0b159e56802e : 3392 + 0xb]
>     eip = 0xb7305a9b   esp = 0xbfa7ccf0   ebp = 0xbfa7d368
> 30  firefox-bin!main [nsBrowserApp.cpp:0b159e56802e : 156 + 0xe]
>     eip = 0x080495aa   esp = 0xbfa7d370   ebp = 0xbfa7d3c8
> 31  libc-2.6.1.so + 0x1604f
>     eip = 0xb6619050   esp = 0xbfa7d3d0   ebp = 0xbfa7d438

Comment 1

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1249170621.1249176338.20564.gz

This log doesn't have the stack trace, but looks like it's crashed in same test.

Comment 2

[timeless]

1463   if (aChild->GetType() == NS_FORM_INPUT_RADIO) {

this looks like the vtable for aChild is dying on the stack....

Comment 3

[Martijn Wargers (dead)]

I just filed bug 514425 about the same crash (with a testcase).

Comment 4

[Ed Morley [:emorley]]

Mass marking whiteboard:[orange] bugs WFM (to clean up TBPL bug suggestions) that:
* Haven't changed in > 6months
* Whose whiteboard contains none of the strings: {disabled,marked,random,fuzzy,todo,fails,failing,annotated,leave open,time-bomb}
* Passed a (quick) manual inspection of bug summary/whiteboard to ensure they weren't a false positive.

I've also gone through and searched for cases where the whiteboard wasn't labelled correctly after test disabling, by using attachment description & basic comment searches. However if the test for which this bug was about has in fact been disabled/annotated/..., please accept my apologies & reopen/mark the whiteboard appropriately so this doesn't get re-closed in the future (and please ping me via IRC or email so I can try to tweak the saved searches to avoid more edge cases).

Sorry for the spam! Filter on: #FFA500