552853 - Crash [@ nsRefPtr<nsSMILInstanceTime>::get() const] during SMIL reftests

Status: RESOLVED DUPLICATE of bug 554141

(Core :: SVG, defect)

Description

[Daniel Holbert [:dholbert]]

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1268785497.1268787964.6512.gz
Linux mozilla-central debug test reftest on 2010/03/16 17:24:57
s: moz2-linux-slave21

{
Thread 0 (crashed)
 0  libxul.so!nsRefPtr<nsSMILInstanceTime>::get() const [nsAutoPtr.h : 1080 + 0x3]
    eip = 0x01c02356   esp = 0xbf99a0cc   ebp = 0xbf99a0cc   ebx = 0x02a16fdc
    esi = 0x0a1e8030   edi = 0x00000000   eax = 0x049862e4   ecx = 0x0a1d4d18
    edx = 0x02949c9c   efl = 0x00210286
    Found by: given as instruction pointer in context
 1  libxul.so!nsRefPtr<nsSMILInstanceTime>::operator nsSMILInstanceTime*() const [nsAutoPtr.h : 1093 + 0xa]
    eip = 0x01c0236b   esp = 0xbf99a0d4   ebp = 0xbf99a0d8
    Found by: previous frame's frame pointer
 2  libxul.so!int nsTArray<nsRefPtr<nsSMILInstanceTime> >::GreatestIndexLtEq<nsSMILInstanceTime*, nsSMILTimedElement::InstanceTimeComparator>(nsSMILInstanceTime* const&, nsSMILTimedElement::InstanceTimeComparator const&, unsigned int*) const [nsTArray.h : 567 + 0x1e]
    eip = 0x01c0d547   esp = 0xbf99a0e0   ebp = 0xbf99a108
    Found by: previous frame's frame pointer
 3  libxul.so!int nsTArray<nsRefPtr<nsSMILInstanceTime> >::RemoveElementSorted<nsSMILInstanceTime*, nsSMILTimedElement::InstanceTimeComparator>(nsSMILInstanceTime* const&, nsSMILTimedElement::InstanceTimeComparator const&) [nsTArray.h : 741 + 0x1f]
    eip = 0x01c0d6f0   esp = 0xbf99a110   ebp = 0xbf99a138
    Found by: previous frame's frame pointer
 4  libxul.so!nsSMILTimedElement::RemoveInstanceTime(nsSMILInstanceTime*, int) [nsSMILTimedElement.cpp:9e96f8553258 : 331 + 0x18]
    eip = 0x01c0ac06   esp = 0xbf99a140   ebp = 0xbf99a178
    Found by: previous frame's frame pointer
 5  libxul.so!nsSMILTimeValueSpec::HandleDeletedInstanceTime(nsSMILInstanceTime&) [nsSMILTimeValueSpec.cpp:9e96f8553258 : 225 + 0x21]
    eip = 0x01c0e54a   esp = 0xbf99a180   ebp = 0xbf99a198
    Found by: previous frame's frame pointer
 6  libxul.so!nsSMILInstanceTime::HandleDeletedInterval() [nsSMILInstanceTime.cpp:9e96f8553258 : 161 + 0x14]
    eip = 0x01c017f7   esp = 0xbf99a1a0   ebp = 0xbf99a1c8
    Found by: previous frame's frame pointer
 7  libxul.so!nsSMILInterval::NotifyDeleting() [nsSMILInterval.cpp:9e96f8553258 : 82 + 0x24]
    eip = 0x01c01fbb   esp = 0xbf99a1d0   ebp = 0xbf99a1e8
    Found by: previous frame's frame pointer
 8  libxul.so!nsSMILTimedElement::~nsSMILTimedElement() [nsSMILTimedElement.cpp:9e96f8553258 : 152 + 0x15]
    eip = 0x01c0c542   esp = 0xbf99a1f0   ebp = 0xbf99a208
    Found by: previous frame's frame pointer
 9  libxul.so!nsSVGAnimationElement::~nsSVGAnimationElement() [nsSVGAnimationElement.h:9e96f8553258 : 57 + 0x3c]
    eip = 0x01bef97d   esp = 0xbf99a210   ebp = 0xbf99a228
    Found by: previous frame's frame pointer
10  libxul.so!nsSVGAnimateElement::~nsSVGAnimateElement() [nsSVGAnimateElement.cpp:9e96f8553258 : 46 + 0x58]
    eip = 0x01befaad   esp = 0xbf99a230   ebp = 0xbf99a248
    Found by: previous frame's frame pointer
11  libxul.so!nsNodeUtils::LastRelease(nsINode*) [nsNodeUtils.cpp:9e96f8553258 : 274 + 0x17]
    eip = 0x015c4478   esp = 0xbf99a250   ebp = 0xbf99a2a8
    Found by: previous frame's frame pointer
12  libxul.so!nsGenericElement::Release() [nsGenericElement.cpp:9e96f8553258 : 4201 + 0x100]
    eip = 0x015a33f2   esp = 0xbf99a2b0   ebp = 0xbf99a2e8
    Found by: previous frame's frame pointer
13  libxul.so!nsSVGElement::Release() [nsSVGElement.cpp:9e96f8553258 : 188 + 0xa]
    eip = 0x01b67b53   esp = 0xbf99a2f0   ebp = 0xbf99a318
    Found by: previous frame's frame pointer
14  libxul.so!nsSVGAnimationElement::Release() [nsSVGAnimationElement.cpp:9e96f8553258 : 50 + 0xa]
    eip = 0x01bf1f63   esp = 0xbf99a320   ebp = 0xbf99a348
    Found by: previous frame's frame pointer
15  libxul.so!nsSVGAnimateElement::Release() [nsSVGAnimateElement.cpp:9e96f8553258 : 77 + 0xa]
    eip = 0x01beebdb   esp = 0xbf99a350   ebp = 0xbf99a378
    Found by: previous frame's frame pointer
16  libxul.so!nsXPCOMCycleCollectionParticipant::Unroot(void*) [nsCycleCollectionParticipant.cpp : 74 + 0x11]
    eip = 0x0224661e   esp = 0xbf99a380   ebp = 0xbf99a398
    Found by: previous frame's frame pointer
17  libxul.so!nsCycleCollector::CollectWhite() [nsCycleCollector.cpp:9e96f8553258 : 1868 + 0x20]
    eip = 0x022ca9d1   esp = 0xbf99a3a0   ebp = 0xbf99a3d8
    Found by: previous frame's frame pointer
18  libxul.so!nsCycleCollector::FinishCollection() [nsCycleCollector.cpp:9e96f8553258 : 2708 + 0xa]
    eip = 0x022caa31   esp = 0xbf99a3e0   ebp = 0xbf99a3f8
    Found by: previous frame's frame pointer
}

See also bug 551549 & bug 549715.

This crash happened right after "sandwich-priority-8.svg" passed, FWIW. (though I doubt it's very test-specific, judging by bug 549715)

Comment 1

[Phil Ringnalda (:philor)]

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1272056360.1272057988.1051.gz
Linux mozilla-central debug test reftest on 2010/04/23 13:59:20
s: moz2-linux-slave25

REFTEST TEST-PASS | file:///builds/slave/mozilla-central-linux-debug-unittest-reftest/build/reftest/tests/layout/reftests/svg/smil/syncbase/cycle-delete-1.svg |
REFTEST INFO | Loading a blank page
++DOMWINDOW == 64 (0x8f19810) [serial = 9565] [outer = 0x8b6f818]
REFTEST INFO | Loading file:///builds/slave/mozilla-central-linux-debug-unittest-reftest/build/reftest/tests/layout/reftests/svg/smil/syncbase/cycle-recursion-1.svg
--DOMWINDOW == 63 (0x9efbfc8) [serial = 9510] [outer = 0x8b6f818] [url = file:///builds/slave/mozilla-central-linux-debug-unittest-reftest/build/reftest/tests/layout/reftests/svg/smil/syncbase/changed-interval-simple-4.svg]
NEXT ERROR TEST-UNEXPECTED-FAIL | automation.py | Exited with code 11 during test run

Comment 2

[Brian Birtles (:birtles, Feb 26~ parental leave)]

This looks very much like a dupe of bug 554141 but I'll leave it open for a few weeks to see if it crops again.

Comment 3

[Brian Birtles (:birtles, Feb 26~ parental leave)]

This appears to have been fixed with the fix to bug 554141.