Firefox Crash @ nsGenericElement::UnbindFromTree

NEW
Unassigned

Status

()

Core
DOM
--
critical
8 years ago
5 years ago

People

(Reporter: chris hofmann, Unassigned)

Tracking

(Depends on: 1 bug, {crash})

Trunk
crash
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(blocking2.0 -)

Details

(crash signature)

(Reporter)

Description

8 years ago
spotted while digging for 3.6.4 crashes, but looks like it has been around for a while.  maybe some code inspection can figure out what's going in with these.

http://crash-stats.mozilla.com/report/index/43813bda-ee3d-445b-b857-080a92100422

Frame  	Module  	Signature [Expand]  	Source
0 	xul.dll 	nsGenericElement::UnbindFromTree 	content/base/src/nsGenericElement.cpp:2725
1 	xul.dll 	nsGenericDOMDataNode::UnbindFromTree 	content/base/src/nsGenericDOMDataNode.cpp:609
2 	xul.dll 	nsGenericElement::UnbindFromTree 	content/base/src/nsGenericElement.cpp:2725
3 	xul.dll 	nsXULElement::UnbindFromTree 	content/xul/content/src/nsXULElement.cpp:913
4 	xul.dll 	nsXULElement::UnbindFromTree 	content/xul/content/src/nsXULElement.cpp:913
5 	xul.dll 	nsCOMPtr_base::assign_from_qi 	obj-firefox/xpcom/build/nsCOMPtr.cpp:98
6 	xul.dll 	nsXBLBinding::ChangeDocument 	content/xbl/src/nsXBLBinding.cpp:1184
7 	xul.dll 	nsSubDocumentFrame::`scalar deleting destructor' 	
8 	xul.dll 	nsINode::GetFlags 	obj-firefox/dist/include/nsINode.h:736
9 	xul.dll 	nsGenericElement::DestroyContent 	content/base/src/nsGenericElement.cpp:3450
...
... repeated frames like 9 seen in 10-38
...
39 	xul.dll 	nsGenericElement::DestroyContent 	content/base/src/nsGenericElement.cpp:3461
40 	xul.dll 	nsDocument::Destroy 	content/base/src/nsDocument.cpp:6920
41 	xul.dll 	DocumentViewerImpl::Destroy 	layout/base/nsDocumentViewer.cpp:1578
42 	xul.dll 	DocumentViewerImpl::Show 	layout/base/nsDocumentViewer.cpp:1918
43 	xul.dll 	nsPresContext::EnsureVisible 	layout/base/nsPresContext.cpp:1588
44 	xul.dll 	PresShell::UnsuppressAndInvalidate 	layout/base/nsPresShell.cpp:4647
45 	xul.dll 	PresShell::ProcessReflowCommands 	layout/base/nsPresShell.cpp:7470
46 	xul.dll 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:4910
47 	xul.dll 	PresShell::ReflowEvent::Run 	layout/base/nsPresShell.cpp:7099
48 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:527
49 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:118
50 	xul.dll 	xul.dll@0x9a4307 	
51 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:199
52 	xul.dll 	nsComponentManagerImpl::GetServiceByContractID 	xpcom/components/nsComponentManager.cpp:2199
53 	xul.dll 	xul.dll@0x307d13 	
54 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:173
55 	nspr4.dll 	_PR_MD_CLEAN_THREAD 	nsprpub/pr/src/md/windows/w95thred.c:21

more at
http://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&signature=nsGenericElement%3A%3AUnbindFromTree%28int%2C%20int%29&version=Firefox%3A3.6.4

possible related signature list
  42 nsGenericElement::UnbindFromTree(int, int)
   4 nsCOMPtr_base::assign_with_AddRef(nsISupports*) | nsGenericElement::UnbindFromTree(int, int)
   1 _purecall | nsGenericElement::UnbindFromTree(int, int)

Correlation to releases

checking --- nsGenericElement::UnbindFromTree.int 20100421-crashdata.csv
found in: 3.6.3 3.5.9 3.6.4 3.6.3plugin1 3.6 3.5.6 3.5.4 3.0.8 3.0.19
release total-crashes
              nsGenericElement::UnbindFromTree.int crashes
                         pct.
all     383147  47      0.000122668
3.6.3   257898  32      0.00012408
3.5.9   34290   6       0.000174978
3.6.4   16781   3       0.000178774
3.6.3plugin1    397     1       0.00251889
3.6     17989   1       5.55895e-05
3.5.6   1028    1       0.000972763
3.5.4   1294    1       0.000772798
3.0.8   644     1       0.0015528
3.0.19  11658   1       8.5778e-05

os breakdown
nsGenericElement::UnbindFromTree.intTotal 42
Win5.1  0.79
Win6.0  0.07
Win6.1  0.12


   1 https://finanzportal.fiducia.de/ebpp01/entry?rzid=XC&rzbk=1814
   1 https://connect.delta.com/f5-w-687474703a2f2f69637265772e64656c74612e636f6d3a3130303830$$/icrew.html
   1 http://www.webtvenvivo.com/
   1 http://www.tvn24.pl/
   1 http://www.qvc.com/qic/qvcapp.aspx/app.detail/params.item.tsv!.tpl.tsv.cm_scid.TSV?cm_re=PROMOTIONS-_-TSV-_-TSV,TSV&cm_sp=TSV-_-HP-_-IMAGE
   1 http://www.prosieben.de/video/
   1 http://www.orkut.com/Logout?msg=0&hl=pt-BR
   1 http://www.orkut.com.br/Main#Home
   1 http://www.orkut.co.in/Main#Home
   1 http://www.myz99.com/what_song_was_that/view/
(Reporter)

Updated

8 years ago
Severity: normal → critical
Keywords: crash
OS: Mac OS X → All

Updated

8 years ago
Component: DOM: Other → DOM

Updated

7 years ago
blocking2.0: --- → ?

Comment 1

7 years ago
In trunk, since JM merge on 09/12/2010, the crash daily rate has increased from 1 crash/day to 5-21 crashes/day
(Reporter)

Comment 2

7 years ago
not much interesting in recent urls.

domains of sites
  12 http://www.facebook.com  photos, profiles, home

   5 \N//
   3 http://www.youtube.com
   1 http://www.youtube.com/watch?v=ugNQ5uIN09Q
   1 http://www.youtube.com/watch?v=twuzFIUdOd0&feature=related
   1 http://www.youtube.com/watch?v=XJYj1Zti9Ic

   3 //
   2 http://www.google.com.co
   1 https://seguro.cam.es
   1 https://nk.pl
   1 https://mail.google.com
   1 http://xhamster.com
   1 http://www78.hattrick.ws
   1 http://www.yuvutu.com
   1 http://www.wscom.com.br
   1 http://www.twirpx.com
   1 http://www.tumomo.com
   1 http://www.tuenti.com
   1 http://www.target.com
(Reporter)

Comment 3

7 years ago
we might need skip listing to help sort out the new regression.

looks like there are several forms of the stack with these being the top 3.

many of the b7pre stacks I looked at are like this first one.

  10 Firefox    
xul.dll nsGenericElement::UnbindFromTree(int,int)       
xul.dll nsStyledElement::UnbindFromTree(int,int)        
xul.dll nsGenericHTMLElement::UnbindFromTree(int,int)   
xul.dll nsGenericElement::UnbindFromTree(int,int)       
xul.dll nsStyledElement::UnbindFromTree(int,int)        
xul.dll nsGenericHTMLElement::UnbindFromTree(int,int)   

like http://crash-stats.mozilla.com/report/index/39afdf3b-fe4e-471a-8ff0-1df212100919


many of the 3.6.x reports look like this one.

   9 Firefox    
xul.dll nsGenericElement::UnbindFromTree(int,int)       
xul.dll nsGenericElement::UnbindFromTree(int,int)       
xul.dll nsGenericElement::UnbindFromTree(int,int)       
xul.dll nsGenericElement::UnbindFromTree(int,int)       
xul.dll nsContentUtils::AddScriptBlocker()      
xul.dll nsINode::nsSlots::`scalar deleting destructor'(unsigned int)

like  98 http://crash-stats.mozilla.com/report/index/bd46b469-4a32-49df-b9de-da88a2100919


this next one looks like mostly 3.6.x as well.

   5 Firefox            
xul.dll nsGenericElement::UnbindFromTree(int,int)       
xul.dll nsGenericElement::UnbindFromTree(int,int)       
xul.dll nsGenericElement::UnbindFromTree(int,int)
xul.dll nsGenericElement::UnbindFromTree(int,int)       
xul.dll nsContentUtils::AddScriptBlocker()

like http://crash-stats.mozilla.com/report/index/d3a950c4-ebeb-487d-b001-44a552100919
Not blocking Firefox 4 on this unless this raises significantly in frequency.
blocking2.0: ? → -

Comment 5

7 years ago
Is it a dupe of bug 485941 as bug 657455 is?
(Assignee)

Updated

7 years ago
Crash Signature: [@ nsGenericElement::UnbindFromTree(int, int) ]

Updated

6 years ago
Crash Signature: [@ nsGenericElement::UnbindFromTree(int, int) ] → [@ nsGenericElement::UnbindFromTree(int, int) ] [@ nsGenericElement::UnbindFromTree(bool, bool) ]

Comment 6

6 years ago
There's a spike in crashes from 14.0a1/20120315. The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=8d1c74566a0b&tochange=082d016c341f

It's #2 top crasher in 14.0a1 over the last day.

The stack looks like:
Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsGenericElement::UnbindFromTree 	content/base/src/nsGenericElement.cpp:3276
1 	xul.dll 	nsXULElement::UnbindFromTree 	content/xul/content/src/nsXULElement.cpp:925
2 	xul.dll 	nsGenericElement::UnbindFromTree 	content/base/src/nsGenericElement.cpp:3326
3 	xul.dll 	nsXULElement::UnbindFromTree 	content/xul/content/src/nsXULElement.cpp:925
4 	xul.dll 	nsGenericElement::RemoveChildAt 	content/base/src/nsGenericElement.cpp:3845
5 	xul.dll 	nsXULElement::RemoveChildAt 	content/xul/content/src/nsXULElement.cpp:997
6 	xul.dll 	nsINode::ReplaceOrInsertBefore 	content/base/src/nsGenericElement.cpp:4260
7 	xul.dll 	nsINode::ReplaceOrInsertBefore 	obj-firefox/dist/include/nsINode.h:1480
8 	xul.dll 	nsINode::ReplaceChild 	obj-firefox/dist/include/nsINode.h:527
9 	xul.dll 	nsIDOMNode_ReplaceChild 	obj-firefox/js/xpconnect/src/dom_quickstubs.cpp:5311
10 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:514
11 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2710
12 	mozjs.dll 	js::ContextStack::pushInvokeFrame 	js/src/vm/Stack.cpp:778
13 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:529
14 	mozjs.dll 	mozjs.dll@0x789f 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsGenericElement%3A%3AUnbindFromTree%28bool%2C+bool%29
Depends on: 485941
Keywords: topcrash
Hardware: x86 → All
Summary: Firefox Crash [@ nsGenericElement::UnbindFromTree(int, int) ] → Firefox Crash @ nsGenericElement::UnbindFromTree

Updated

6 years ago
Crash Signature: [@ nsGenericElement::UnbindFromTree(int, int) ] [@ nsGenericElement::UnbindFromTree(bool, bool) ] → [@ nsGenericElement::UnbindFromTree(int, int) ] [@ nsGenericElement::UnbindFromTree(bool, bool) ] [@ nsGenericElement::UnbindFromTree ]

Comment 7

6 years ago
Crashes after the spike are correlated to Video DownloadHelper:
    100% (29/29) vs.  17% (64/376) {b9db16a4-6edc-47ec-a1f4-b86292ed211d} (Video DownloadHelper, https://addons.mozilla.org/addon/3006)
tracking-firefox14: --- → ?

Updated

6 years ago
tracking-firefox14: ? → ---
Depends on: 736695
Keywords: topcrash
You need to log in before you can comment on or make changes to this bug.