558101 - startup crash [@ nsTextBoxFrame::GetTextSize(nsPresContext*, nsIRenderingContext&, nsString const&, nsSize&, int&)]

Status: RESOLVED WORKSFORME

(Core :: Layout: Text and Fonts, defect)

Description

[Wayne Mery (:wsmwk)]

(mostly) startup crash [@ nsTextBoxFrame::GetTextSize(nsPresContext*, nsIRenderingContext&, nsString const&, nsSize&, int&)]

#88 crash for Thunderbird v3.03. #10 crash of Thunderbird Mac crash reports.  For firefox, this does not break into top 300.

bp-fee45c22-a3ed-437d-9cad-927c72100401 windows (bobxm) no extensions
"[thunderbird] Crashed ... Repeated and the same. Browser Mozilla does likewise: uninstalling and reinstalling make no difference. Other browsers work OK"
0	thunderbird.exe	nsTextBoxFrame::GetTextSize	 layout/xul/base/src/nsTextBoxFrame.cpp:982
1	thunderbird.exe	nsTextBoxFrame::CalcTextSize	layout/xul/base/src/nsTextBoxFrame.cpp:999
2	thunderbird.exe	nsTextBoxFrame::GetBoxAscent	layout/xul/base/src/nsTextBoxFrame.cpp:1079
3	thunderbird.exe	nsSprocketLayout::GetAscent	layout/xul/base/src/nsSprocketLayout.cpp:1525
4	thunderbird.exe	nsBoxFrame::GetBoxAscent	layout/xul/base/src/nsBoxFrame.cpp:838
5	thunderbird.exe	nsSprocketLayout::GetAscent	layout/xul/base/src/nsSprocketLayout.cpp:1525
6	thunderbird.exe	nsBoxFrame::GetBoxAscent	layout/xul/base/src/nsBoxFrame.cpp:838
7	thunderbird.exe	nsSprocketLayout::GetAscent	layout/xul/base/src/nsSprocketLayout.cpp:1525
8	thunderbird.exe	nsBoxFrame::GetBoxAscent	layout/xul/base/src/nsBoxFrame.cpp:838
9	thunderbird.exe	nsSprocketLayout::GetAscent	layout/xul/base/src/nsSprocketLayout.cpp:1525
10	thunderbird.exe	nsBoxFrame::GetBoxAscent	layout/xul/base/src/nsBoxFrame.cpp:838
11	thunderbird.exe	nsSprocketLayout::GetAscent	layout/xul/base/src/nsSprocketLayout.cpp:1525
12	thunderbird.exe	nsBoxFrame::GetBoxAscent	layout/xul/base/src/nsBoxFrame.cpp:838
13	thunderbird.exe	nsSprocketLayout::GetAscent	layout/xul/base/src/nsSprocketLayout.cpp:1525
14	thunderbird.exe	nsBoxFrame::GetBoxAscent	layout/xul/base/src/nsBoxFrame.cpp:838
15	thunderbird.exe	nsSprocketLayout::Layout	layout/xul/base/src/nsSprocketLayout.cpp:244
16	thunderbird.exe	nsBoxFrame::DoLayout	layout/xul/base/src/nsBoxFrame.cpp:940
17	thunderbird.exe	nsIFrame::Layout	layout/xul/base/src/nsBox.cpp:561
18	thunderbird.exe	nsStackLayout::Layout	layout/xul/base/src/nsStackLayout.cpp:295
19	thunderbird.exe	nsBoxFrame::DoLayout	layout/xul/base/src/nsBoxFrame.cpp:940
20	thunderbird.exe	nsIFrame::Layout	layout/xul/base/src/nsBox.cpp:561
21	thunderbird.exe	nsBoxFrame::Reflow	layout/xul/base/src/nsBoxFrame.cpp:751
22	thunderbird.exe	nsContainerFrame::ReflowChild	layout/generic/nsContainerFrame.cpp:821
23	thunderbird.exe	ViewportFrame::Reflow	layout/generic/nsViewportFrame.cpp:282
24	thunderbird.exe	PresShell::DoReflow	layout/base/nsPresShell.cpp:6717
25	thunderbird.exe	PresShell::ProcessReflowCommands	layout/base/nsPresShell.cpp:6823
26	thunderbird.exe	PresShell::DoFlushPendingNotifications	layout/base/nsPresShell.cpp:4870
27	thunderbird.exe	PresShell::ReflowEvent::Run	layout/base/nsPresShell.cpp:6594
28	xpcom_core.dll	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:521
29	xpcom_core.dll	NS_ProcessNextEvent_P	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp:247
30	xpcom_core.dll	nsThread::Shutdown	xpcom/threads/nsThread.cpp:468
31	xpcom_core.dll	NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102 
32  	xpcom_core.dll  	nsProxyObjectCallInfo::Run  	 xpcom/proxy/src/nsProxyEvent.cpp:181
(stack repeats last 5 frames)


Note: Most Mac crashes are 10.6.3, and some comments suggest it only started crashing on Mac starting v1.6 [1]. But, other version are reported [2].
[1] Mac 10.6
bp-11871755-4fbe-4bd1-8f07-9463a2100401
"Thunder ceashes when starting up after upgrade of MacOS 10.6.3"
bp-21b6b99b-cbd6-4f6a-a7da-c5c692100330
crashed and can not be operate under the new version of snow leopard 10.6.3
[2] prior to Mac 10.6
bp-23a3663c-9ae9-4baa-9b8a-482572100408 Mac 10.5.8 9L31a


reporters notified of bug report:
bp-79f24a6e-80e2-4a6c-8a39-7d1702100311 (manfred)
bp-d789e32a-bbe6-44e4-8cef-08dea2100331 (brendan)
bp-f2785201-7bc2-4326-af9e-7534e2100313 (ru4)
bp-1885caff-fc15-4439-8eb5-7f1092100331 (lavran) "this has never worked. ever."  no extensions

Comment 1

[Steven Michaud [:smichaud] (Retired)]

On both Windows and OS X, these are crashes dereferencing a NULL
nsIFontMetrics pointer.

As such they seem related to bug 554544.

Comment 2

[Wayne Mery (:wsmwk)]

bug 554544 fixed on trunk 2010-04-11, and 1.9.2.5 as of 2010-05-13, so it isn't in 3.1 release candidates.  none of the dudes in comment 0 came forward.
pming 3 others
bp-78ae9a27-2e08-41d8-8eea-0b9d52100610 (dennis)
bp-dbc6683c-ba02-4bab-9abf-7606e2100610 (gdin)
bp-d8ec9102-9095-4e8d-b836-4f3312100531 (jssevestre)

Comment 3

[robert badger]

After many days work I solved this problem by re-installing the font: Microsoft sans-serif.

Apparently all of the Mozilla applications will crash on startup with out this font available. 

[e-mail]

Comment 4

[Wayne Mery (:wsmwk)]

Nice work robert.

Comment 5

[Wayne Mery (:wsmwk)]

a few firefox 3.6.10 crashes, all with email addresses
bp-2d3e23fb-2f62-40a3-8e23-ca3a72101015
bp-a90bb0e3-8ece-4f0c-b9b1-47b5a2101018
bp-8e2313f5-b955-43d9-b07a-ad1a42101017

Comment 6

[Joe Drew (not getting mail)]

This seems to happen a lot less frequently in newer versions of Firefox, but it is indeed still happening: https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&query=nsTextBoxFrame%3A%3AGetTextSize&reason_type=contains&date=12%2F02%2F2011%2010%3A58%3A28&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=nsTextBoxFrame%3A%3AGetTextSize%28nsPresContext*%2C%20nsIRenderingContext%26%2C%20nsString%20const%26%2C%20nsSize%26%2C%20int%26%29

Since it's a simple NULL dereference, should we just paper over this bug?

Also, this seems to properly be a Layout: Text bug.

Comment 7

[Wayne Mery (:wsmwk)]

for thunderbird, crash rate peaked with 3.1.10 	20110414.
And disappears starting with Tbird version 5.

ditto for firefox - one firefox crash in past month is probably just a freak. no firefox crashes for version 6 or newer in past 4 months.