Closed Bug 551549 Opened 14 years ago Closed 14 years ago

sporadic crash [@ nsSMILTimedElement::RemoveInstanceTime] after SMIL reftest anim-remove-2.svg

Categories

(Core :: SVG, defect)

Product:
Core
Component:
SVG
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 554141

People

(Reporter: dholbert, Unassigned)

References

Details

(Keywords: crash, intermittent-failure, Whiteboard: [test which aborts the suite])

Crash Data

OS X 10.5.2 mozilla-central opt test reftest on 2010/03/10 12:36:10
s: moz2-darwin9-slave10

Crash is during cycle collection. Stack below:
{
REFTEST TEST-PASS | file:///builds/slave/mozilla-central-macosx-opt-unittest-reftest/build/reftest/tests/layout/reftests/svg/smil/anim-remove-2.svg |
REFTEST INFO | Loading a blank page
TEST-UNEXPECTED-FAIL | automation.py | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:09:34.957431
INFO | automation.py | Reading PID log: /var/folders/TL/TLg3RrMbFAur2hBCXvCeqk+++TM/-Tmp-/tmpFni3Itpidlog
PROCESS-CRASH | automation.py | application crashed (minidump found)
Operating system: Mac OS X
                  10.5.2 9C31
CPU: x86
     GenuineIntel family 6 model 15 stepping 2
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE
Crash address: 0x54

Thread 0 (crashed)
 0  XUL!nsSMILTimedElement::RemoveInstanceTime(nsSMILInstanceTime*, int) [mozilla-central::ba67224d0e8d : 66 + 0x0]
    eip = 0x027cde9c   esp = 0xbfff95b0   ebp = 0xbfff95f8   ebx = 0x027bcb1e
    esi = 0x0aa2f280   edi = 0x00000000   eax = 0x00000054   ecx = 0x00000000
    edx = 0x0aa2f280   efl = 0x00210246
    Found by: given as instruction pointer in context
 1  XUL!nsSMILTimeValueSpec::HandleDeletedInstanceTime(nsSMILInstanceTime&) [nsSMILTimeValueSpec.cpp:ba67224d0e8d : 225 + 0x14]
    eip = 0x027cfa0f   esp = 0xbfff9600   ebp = 0xbfff9618
    Found by: previous frame's frame pointer
 2  XUL!nsSMILInstanceTime::HandleDeletedInterval() [nsSMILInstanceTime.cpp:ba67224d0e8d : 161 + 0xe]
    eip = 0x027c72ec   esp = 0xbfff9620   ebp = 0xbfff9638
    Found by: previous frame's frame pointer
 3  XUL!nsSMILInterval::NotifyDeleting() [nsSMILInterval.cpp:ba67224d0e8d : 82 + 0xb]
    eip = 0x027c8172   esp = 0xbfff9640   ebp = 0xbfff9678
    Found by: previous frame's frame pointer
 4  XUL + 0x88c467
    eip = 0x027cf468   esp = 0xbfff9680   ebp = 0xbfff96f8
    Found by: previous frame's frame pointer
 5  XUL + 0x879c42
    eip = 0x027bcc43   esp = 0xbfff9700   ebp = 0xbfff9738
    Found by: previous frame's frame pointer
 6  XUL!nsNodeUtils::LastRelease(nsINode*) [nsNodeUtils.cpp:ba67224d0e8d : 274 + 0x7]
    eip = 0x023bcb3a   esp = 0xbfff9740   ebp = 0xbfff9788
    Found by: previous frame's frame pointer
 7  XUL!nsGenericElement::Release() [nsGenericElement.cpp:ba67224d0e8d : 4202 + 0x7]
    eip = 0x023b099f   esp = 0xbfff9790   ebp = 0xbfff97a8
    Found by: previous frame's frame pointer
 8  XUL!nsXPCOMCycleCollectionParticipant::Unroot(void*) [nsCycleCollectionParticipant.cpp : 74 + 0x7]
    eip = 0x02aba6e1   esp = 0xbfff97b0   ebp = 0xbfff97c8
    Found by: previous frame's frame pointer
 9  XUL!nsCycleCollector::CollectWhite() [nsCycleCollector.cpp:ba67224d0e8d : 1868 + 0x10]
    eip = 0x02b06edd   esp = 0xbfff97d0   ebp = 0xbfff9808
    Found by: previous frame's frame pointer
}
Summary: Crash at nsSMILTimedElement::RemoveInstanceTime after SMIL reftest anim-remove-2.svg → sporadic crash [@ nsSMILTimedElement::RemoveInstanceTime] after SMIL reftest anim-remove-2.svg
Severity: normal → critical
Keywords: crash
I think this is an optimized-build version of bug 549715, actually.
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1271203916.1271204488.11737.gz
Rev3 MacOSX Leopard 10.5.8 mozilla-central opt test reftest on 2010/04/13 17:11:56
s: talos-r3-leopard-016

REFTEST INFO | Loading file:///Users/cltbld/talos-slave/mozilla-central-leopard-opt-u-reftest/build/reftest/tests/layout/reftests/svg/svg-integration/clipPath-html-05.xhtml

Thread 0 (crashed)
 0  XUL!nsSMILTimedElement::RemoveInstanceTime(nsSMILInstanceTime*, int) [mozilla-central::f98fb959bc3a : 66 + 0x2]
    eip = 0x0298343e   esp = 0xbfff97f0   ebp = 0xbfff9838   ebx = 0x02970ffe
    esi = 0x12e4bcf0   edi = 0x00000000   eax = 0xc3a1800f   ecx = 0x00000000
    edx = 0x12e4bcf0   efl = 0x00210246
    Found by: given as instruction pointer in context
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1271300294.1271300891.13271.gz
Rev3 MacOSX Leopard 10.5.8 mozilla-central opt test reftest on 2010/04/14 19:58:14
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1272222624.1272223416.12343.gz
Rev3 MacOSX Leopard 10.5.8 mozilla-central opt test reftest on 2010/04/25 12:10:24
s: talos-r3-leopard-026

REFTEST INFO | Loading file:///Users/cltbld/talos-slave/mozilla-central-leopard-opt-u-reftest/build/reftest/tests/layout/reftests/svg/moz-only/xbl-grad-ref--grad-in-binding-01.svg

Thread 0 (crashed)
 0  XUL!nsSMILTimedElement::RemoveInstanceTime(nsSMILInstanceTime*, int) [mozilla-central::2ef9c0ee3a71 : 66 + 0x0]
    eip = 0x0297cdcc   esp = 0xbfff9240   ebp = 0xbfff9288   ebx = 0x0296a99e
    esi = 0x0e677ac0   edi = 0x00000000   eax = 0x00000054   ecx = 0x00000000
    edx = 0x0e677ac0   efl = 0x00210246
    Found by: given as instruction pointer in context
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1272328259.1272328991.2975.gz
Rev3 MacOSX Leopard 10.5.8 mozilla-central opt test reftest on 2010/04/26 17:30:59
s: talos-r3-leopard-023

REFTEST INFO | Loading file:///Users/cltbld/talos-slave/mozilla-central-leopard-opt-u-reftest/build/reftest/tests/layout/reftests/svg/svg-integration/mask-html-01-ref.svg
REFTEST TEST-PASS | file:///Users/cltbld/talos-slave/mozilla-central-leopard-opt-u-reftest/build/reftest/tests/layout/reftests/svg/svg-integration/mask-html-01.xhtml |
REFTEST INFO | Loading a blank page
TEST-UNEXPECTED-FAIL | automation.py | Exited with code 1 during test run

Thread 0 (crashed)
 0  XUL!nsSMILTimedElement::RemoveInstanceTime(nsSMILInstanceTime*, int) [mozilla-central::fa53318b87aa : 66 + 0x0]
    eip = 0x0299284c   esp = 0xbfff9800   ebp = 0xbfff9848   ebx = 0x0298041e
    esi = 0x0f2265f0   edi = 0x00000000   eax = 0x00000054   ecx = 0x00000000
    edx = 0x0f2265f0   efl = 0x00210246
    Found by: given as instruction pointer in context
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1273252603.1273253127.9448.gz
Rev3 MacOSX Leopard 10.5.8 mozilla-central opt test reftest on 2010/05/07 10:16:43
s: talos-r3-leopard-026

REFTEST INFO | Loading file:///Users/cltbld/talos-slave/mozilla-central-leopard-opt-u-reftest/build/reftest/tests/layout/reftests/svg/smil/anim-height-interp-3.svg
TEST-UNEXPECTED-FAIL | automation.py | Exited with code 1 during test run

Thread 0 (crashed)
 0  XUL!nsSMILTimedElement::RemoveInstanceTime(nsSMILInstanceTime*, int) [mozilla-central::ca591da19a26 : 66 + 0x0]
    eip = 0x0291475c   esp = 0xbfff9820   ebp = 0xbfff9868   ebx = 0x028fbfee
    esi = 0x00000000   edi = 0x00000000   eax = 0x00000054   ecx = 0x0f6cc9c0
    edx = 0x082da770   efl = 0x00210246
    Found by: given as instruction pointer in context
This hasn't popped up again since mid-May when bug 554141 was fixed so I believe it is the same bug.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ nsSMILTimedElement::RemoveInstanceTime]
Whiteboard: [orange][test which aborts the suite] → [test which aborts the suite]
You need to log in before you can comment on or make changes to this bug.