544015 - Talos tjss Crash in libxul.so!RuleHash::PrependRule(RuleValue*) [nsCSSRuleProcessor.cpp:71aca77cf17a : 536 + 0x3] running real-base64-4.html or real-base64-2.html

Status: RESOLVED WORKSFORME

(Core :: CSS Parsing and Computation, defect)

Description

[Jeff Muizelaar [:jrmuizel]]

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1265214637.1265215133.8161.gz

 0  libxul.so!RuleHash::PrependRule(RuleValue*) [nsCSSRuleProcessor.cpp:71aca77cf17a : 536 + 0x3]
    eip = 0xb74a6ed9   esp = 0xbfbbbe90   ebp = 0xbfbbbeac   ebx = 0xb7f2a1ac
    esi = 0xb254f220   edi = 0xb112cb60   eax = 0x00000005   ecx = 0xb112cb60
    edx = 0xb254f220   efl = 0x00210206
    Found by: given as instruction pointer in context
 1  libxul.so!nsCSSRuleProcessor::RefreshRuleCascade(nsPresContext*) [nsCSSRuleProcessor.cpp:71aca77cf17a : 2499 + 0x4]
    eip = 0xb74a89ce   esp = 0xbfbbbeb4   ebp = 0xbfbbbf6c
    Found by: previous frame's frame pointer
 2  libxul.so!nsCSSRuleProcessor::GetRuleCascade(nsPresContext*) [nsCSSRuleProcessor.cpp:71aca77cf17a : 2776 + 0x8]
    eip = 0xb74a8c1f   esp = 0xbfbbbf74   ebp = 0xbfbbbf8c
    Found by: previous frame's frame pointer
 3  libxul.so!nsCSSRuleProcessor::RulesMatching(AnonBoxRuleProcessorData*) [nsCSSRuleProcessor.cpp:71aca77cf17a : 2188 + 0xb]
    eip = 0xb74a9026   esp = 0xbfbbbf94   ebp = 0xbfbbbfac
    Found by: previous frame's frame pointer
 4  libxul.so!int EnumRulesMatching<AnonBoxRuleProcessorData>(nsIStyleRuleProcessor*, void*) [nsStyleSet.cpp:71aca77cf17a : 419 + 0x8]
    eip = 0xb74dd80c   esp = 0xbfbbbfb4   ebp = 0xbfbbbfcc
    Found by: previous frame's frame pointer
 5  libxul.so!nsStyleSet::FileRules(int (*)(nsIStyleRuleProcessor*, void*), void*, nsIContent*, nsRuleWalker*) [nsStyleSet.cpp:71aca77cf17a : 555 + 0x8]
    eip = 0xb74de592   esp = 0xbfbbbfd4   ebp = 0xbfbbc01c
    Found by: previous frame's frame pointer
 6  libxul.so!nsStyleSet::ResolveAnonymousBoxStyle(nsIAtom*, nsStyleContext*) [nsStyleSet.cpp:71aca77cf17a : 910 + 0x10]
    eip = 0xb74de9c0   esp = 0xbfbbc024   ebp = 0xbfbbc07c
    Found by: previous frame's frame pointer
 7  libxul.so!nsCSSFrameConstructor::ConstructRootFrame(nsIFrame**) [nsCSSFrameConstructor.cpp:71aca77cf17a : 2544 + 0x6]
    eip = 0xb73e15ed   esp = 0xbfbbc084   ebp = 0xbfbbc0bc
    Found by: previous frame's frame pointer
 8  libxul.so!PresShell::InitialReflow(int, int) [nsPresShell.cpp:71aca77cf17a : 2509 + 0xd]
    eip = 0xb741a7c2   esp = 0xbfbbc0c4   ebp = 0xbfbbc11c
    Found by: previous frame's frame pointer
 9  libxul.so!nsContentSink::StartLayout(int) [nsContentSink.cpp:71aca77cf17a : 1319 + 0xa]
    eip = 0xb753985e   esp = 0xbfbbc124   ebp = 0xbfbbc1cc
    Found by: previous frame's frame pointer
10  libxul.so!HTMLContentSink::OpenBody(nsIParserNode const&) [nsHTMLContentSink.cpp:71aca77cf17a : 2011 + 0x9]
    eip = 0xb761e7c4   esp = 0xbfbbc1d4   ebp = 0xbfbbc1fc
    Found by: previous frame's frame pointer
11  libxul.so!CNavDTD::OpenBody(nsCParserNode const*) [CNavDTD.cpp:71aca77cf17a : 2490 + 0x11]
    eip = 0xb7399e4d   esp = 0xbfbbc204   ebp = 0xbfbbc21c
    Found by: previous frame's frame pointer
12  libxul.so!CNavDTD::HandleDefaultStartToken(CToken*, nsHTMLTag, nsCParserNode*) [CNavDTD.cpp:71aca77cf17a : 1036 + 0xf]
    eip = 0xb739bbc4   esp = 0xbfbbc224   ebp = 0xbfbbc27c
    Found by: previous frame's frame pointer
13  libxul.so!CNavDTD::HandleStartToken(CToken*) [CNavDTD.cpp:71aca77cf17a : 1376 + 0x10]
    eip = 0xb739be7e   esp = 0xbfbbc284   ebp = 0xbfbbc2cc
    Found by: previous frame's frame pointer
14  libxul.so!CNavDTD::HandleToken(CToken*) [CNavDTD.cpp:71aca77cf17a : 714 + 0xc]
    eip = 0xb739b47f   esp = 0xbfbbc2d4   ebp = 0xbfbbc33c
    Found by: previous frame's frame pointer
15  libxul.so!CNavDTD::BuildModel(nsITokenizer*, int, int, nsCString const*) [CNavDTD.cpp:71aca77cf17a : 301 + 0xa]
    eip = 0xb739c77b   esp = 0xbfbbc344   ebp = 0xbfbbc39c
    Found by: previous frame's frame pointer
16  libxul.so!nsParser::BuildModel() [nsParser.cpp:71aca77cf17a : 2446 + 0x32]
    eip = 0xb73a272f   esp = 0xbfbbc3a4   ebp = 0xbfbbc3ec
    Found by: previous frame's frame pointer
17  libxul.so!nsParser::ResumeParse(int, int, int) [nsParser.cpp:71aca77cf17a : 2344 + 0x8]
    eip = 0xb73a642f   esp = 0xbfbbc3f4   ebp = 0xbfbbc42c
    Found by: previous frame's frame pointer
18  libxul.so!nsParser::ContinueInterruptedParsing() [nsParser.cpp:71aca77cf17a : 1818 + 0x12]
    eip = 0xb73a624d   esp = 0xbfbbc434   ebp = 0xbfbbc45c
    Found by: previous frame's frame pointer
19  libxul.so!nsContentSink::ContinueInterruptedParsingIfEnabled() [nsContentSink.cpp:71aca77cf17a : 1749 + 0x8]
    eip = 0xb7539078   esp = 0xbfbbc464   ebp = 0xbfbbc47c
    Found by: previous frame's frame pointer
20  libxul.so!nsRunnableMethod<nsContentSink, void>::Run() [nsThreadUtils.h : 282 + 0x10]
    eip = 0xb753c182   esp = 0xbfbbc484   ebp = 0xbfbbc49c
    Found by: previous frame's frame pointer
21  libxul.so!nsThread::ProcessNextEvent(int, int*) [nsThread.cpp:71aca77cf17a : 527 + 0xa]
    eip = 0xb7bad82a   esp = 0xbfbbc4a4   ebp = 0xbfbbc4dc
    Found by: previous frame's frame pointer
22  libxul.so!NS_ProcessNextEvent_P(nsIThread*, int) [nsThreadUtils.cpp : 250 + 0xd]
    eip = 0xb7b7d54c   esp = 0xbfbbc4e4   ebp = 0xbfbbc50c
    Found by: previous frame's frame pointer
23  libxul.so!nsThread::Shutdown() [nsThread.cpp:71aca77cf17a : 468 + 0xb]
    eip = 0xb7badb9a   esp = 0xbfbbc514   ebp = 0xbfbbc55c
    Found by: previous frame's frame pointer
24  libxul.so!NS_GetXPTCallStub_P + 0x31
    eip = 0xb7bba903   esp = 0xbfbbc564   ebp = 0xbfbbc578
    Found by: previous frame's frame pointer
25  libxul.so!nsProxyObjectCallInfo::Run() [nsProxyEvent.cpp:71aca77cf17a : 181 + 0x13]
    eip = 0xb7bb228d   esp = 0xbfbbc580   ebp = 0xbfbbc598
    Found by: previous frame's frame pointer
26  libxul.so!nsThread::ProcessNextEvent(int, int*) [nsThread.cpp:71aca77cf17a : 527 + 0xa]
    eip = 0xb7bad82a   esp = 0xbfbbc5a0   ebp = 0xbfbbc5d8
    Found by: previous frame's frame pointer
27  libxul.so!NS_ProcessNextEvent_P(nsIThread*, int) [nsThreadUtils.cpp : 250 + 0xd]
    eip = 0xb7b7d54c   esp = 0xbfbbc5e0   ebp = 0xbfbbc608
    Found by: previous frame's frame pointer
28  libxul.so!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) [MessagePump.cpp:71aca77cf17a : 118 + 0xb]
    eip = 0xb7b04960   esp = 0xbfbbc610   ebp = 0xbfbbc648
    Found by: previous frame's frame pointer
29  libxul.so!MessageLoop::RunInternal() [message_loop.cc:71aca77cf17a : 211 + 0x8]
    eip = 0xb7b4c5dc   esp = 0xbfbbc650   ebp = 0xbfbbc668
    Found by: previous frame's frame pointer
30  libxul.so!MessageLoop::RunHandler() [message_loop.cc:71aca77cf17a : 194 + 0x7]
    eip = 0xb7b4c600   esp = 0xbfbbc670   ebp = 0xbfbbc688
    Found by: previous frame's frame pointer
31  libxul.so!MessageLoop::Run() [message_loop.cc:71aca77cf17a : 168 + 0x7]
    eip = 0xb7b4c677   esp = 0xbfbbc690   ebp = 0xbfbbc6c8
    Found by: previous frame's frame pointer
32  libxul.so!nsBaseAppShell::Run() [nsBaseAppShell.cpp:71aca77cf17a : 174 + 0xd]
    eip = 0xb7a652d0   esp = 0xbfbbc6d0   ebp = 0xbfbbc6e8
    Found by: previous frame's frame pointer
33  libxul.so!nsAppStartup::Run() [nsAppStartup.cpp:71aca77cf17a : 183 + 0x5]
    eip = 0xb7934d54   esp = 0xbfbbc6f0   ebp = 0xbfbbc708
    Found by: previous frame's frame pointer
34  libxul.so!XRE_main [nsAppRunner.cpp:71aca77cf17a : 3476 + 0x8]
    eip = 0xb724f47f   esp = 0xbfbbc710   ebp = 0xbfbbcc98
    Found by: previous frame's frame pointer
35  firefox-bin!main [nsBrowserApp.cpp:71aca77cf17a : 158 + 0xc]
    eip = 0x080495c7   esp = 0xbfbbcca0   ebp = 0xbfbbccf8
    Found by: previous frame's frame pointer
36  libc-2.6.1.so + 0x1604f
    eip = 0xb657a050   esp = 0xbfbbcd00   ebp = 0xbfbbcd68
    Found by: previous frame's frame pointer
37  firefox-bin + 0x1400
    eip = 0x08049401   esp = 0xbfbbcd70   ebp = 0x00000000
    Found by: previous frame's frame pointer
38  firefox-bin!_ZL6OutputPKcz [nsBrowserApp.cpp:71aca77cf17a : 77 + 0x4]
    eip = 0x080494e2   esp = 0xbfbbcd74   ebp = 0x00000000
    Found by: stack scanning
39  ld-2.6.1.so + 0xd7ff
    eip = 0xb7f84800   esp = 0xbfbbcd88   ebp = 0x00000000
    Found by: stack scanning
40  ld-2.6.1.so + 0x17eac
    eip = 0xb7f8eead   esp = 0xbfbbcd90   ebp = 0x00000000
    Found by: stack scanning

Comment 1

[Phil Ringnalda (:philor)]

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1265915086.1265915574.23318.gz
Linux mozilla-central talos jss on 2010/02/11 11:04:46  
s: talos-rev2-linux09

Comment 2

[Ed Morley [:emorley]]

Mass marking whiteboard:[orange] bugs WFM (to clean up TBPL bug suggestions) that:
* Haven't changed in > 6months
* Whose whiteboard contains none of the strings: {disabled,marked,random,fuzzy,todo,fails,failing,annotated,leave open,time-bomb}
* Passed a (quick) manual inspection of bug summary/whiteboard to ensure they weren't a false positive.

I've also gone through and searched for cases where the whiteboard wasn't labelled correctly after test disabling, by using attachment description & basic comment searches. However if the test for which this bug was about has in fact been disabled/annotated/..., please accept my apologies & reopen/mark the whiteboard appropriately so this doesn't get re-closed in the future (and please ping me via IRC or email so I can try to tweak the saved searches to avoid more edge cases).

Sorry for the spam! Filter on: #FFA500