603886 - Startup crash [@ nsEditor::PostCreate() ]

Status: RESOLVED INCOMPLETE

(Core :: DOM: Editor, defect)

Description

[Ludovic Hirlimann [:Usul]]

Spotted these while looking at Thunderbird 3.1.5 crashers.
0  	 	@0xfe6718d9  	
1 	thunderbird.exe 	nsEditor::PostCreate 	editor/libeditor/base/nsEditor.cpp:296
2 	thunderbird.exe 	nsTextControlFrame::InitEditor 	layout/forms/nsTextControlFrame.cpp:1585
3 	thunderbird.exe 	nsTextControlFrame::DelayedEditorInit 	layout/forms/nsTextControlFrame.cpp:1358
4 	thunderbird.exe 	nsTextControlFrame::EditorInitializer::Run 	layout/forms/nsTextControlFrame.h:232
5 	thunderbird.exe 	nsContentUtils::RemoveScriptBlocker 	content/base/src/nsContentUtils.cpp:4495
6 	thunderbird.exe 	PresShell::DidCauseReflow 	layout/base/nsPresShell.cpp:7155
7 	thunderbird.exe 	PresShell::InitialReflow 	layout/base/nsPresShell.cpp:2663
8 	thunderbird.exe 	nsXULDocument::StartLayout 	content/xul/document/src/nsXULDocument.cpp:2071
9 	thunderbird.exe 	nsXULDocument::DoneWalking 	content/xul/document/src/nsXULDocument.cpp:3216
10 	thunderbird.exe 	nsXULDocument::StyleSheetLoaded 	content/xul/document/src/nsXULDocument.cpp:3302
11 	thunderbird.exe 	CSSLoaderImpl::SheetComplete 	layout/style/nsCSSLoader.cpp:1691
12 	thunderbird.exe 	CSSLoaderImpl::ParseSheet 	layout/style/nsCSSLoader.cpp:1652
13 	thunderbird.exe 	SheetLoadData::OnStreamComplete 	layout/style/nsCSSLoader.cpp:936
14 	thunderbird.exe 	nsUnicharStreamLoader::OnStopRequest 	netwerk/base/src/nsUnicharStreamLoader.cpp:162
15 	thunderbird.exe 	nsJARChannel::OnStopRequest 	modules/libjar/nsJARChannel.cpp:880
16 	thunderbird.exe 	nsInputStreamPump::OnStateStop 	netwerk/base/src/nsInputStreamPump.cpp:578
17 	thunderbird.exe 	nsInputStreamPump::OnInputStreamReady 	netwerk/base/src/nsInputStreamPump.cpp:403
18 	xpcom_core.dll 	nsOutputStreamReadyEvent::Run 	xpcom/io/nsStreamUtils.cpp:112
19 	xpcom_core.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:527
20 	xpcom_core.dll 	NS_ProcessNextEvent_P 	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp:250
21 	thunderbird.exe 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:177
22 	thunderbird.exe 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:183
23 	thunderbird.exe 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3483
24 	thunderbird.exe 	NS_internal_main 	mail/app/nsMailApp.cpp:101
25 	thunderbird.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:120
26 	thunderbird.exe 	__tmainCRTStartup 	objdir-tb/mozilla/memory/jemalloc/crtsrc/crtexe.c:591
27 	kernel32.dll 	BaseProcessStart

Comment 1

[Wayne Mery (:wsmwk)]

also FF back as far as 3.0.1 and as recent as 3.6.10, and Mac in both products
eg. bp-db4d7103-38f0-4d2b-bf41-8305b2101006

Comment 2

[(no longer active)]

Attachment: Patch (v1)

This is an OOM situation.  I'm not sure if this is worth fixing (because we'll most likely crash somewhere down the line), but here's the fix to this particular crash.

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

That 'new' will abort on OOM without even returning here, so this makes no sense for trunk at least. And I suspect not for branch either.

Comment 4

[(no longer active)]

(In reply to comment #3)
> That 'new' will abort on OOM without even returning here, so this makes no
> sense for trunk at least. And I suspect not for branch either.

Yes, this patch doesn't make sense on trunk, but we don't have infallible allocators on branches, so operator new will return null, which could (and according to the crash stacks, does) cause a crash.

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 482861 [details] [diff] [review]
Patch (v1)

ok for branches only then

Comment 6

[(no longer active)]

Comment on attachment 482861 [details] [diff] [review]
Patch (v1)

Hmm, I'm silly.  The code in question doesn't exist on branches at all.  At this point, I don't have a theory on the reason behind this crash...

Comment 7

[Wayne Mery (:wsmwk)]

I don't see any chance of getting a testcase, at least not from thunderbird, with less than 1 crash per month, and even then not for all releases.
bp-df134c91-5e27-4921-8d1b-267f12110907 v6

pretty rare also in firefox
bp-71784ed4-63e2-4ad4-bd07-7c2082120202 v10
0		@0x3244c8bc	
1	xul.dll	nsEditor::PostCreate	
2	xul.dll	nsTextEditorState::PrepareEditor	content/html/content/src/nsTextEditorState.cpp:1359
3	xul.dll	nsHTMLInputElement::GetTextEditor	content/html/content/src/nsHTMLInputElement.cpp:1137
4	xul.dll	nsGenericHTMLElement::GetEditorInternal	content/html/content/src/nsGenericHTMLElement.cpp:3591
5	xul.dll	nsGenericHTMLFormElement::GetDesiredIMEState	content/html/content/src/nsGenericHTMLElement.cpp:2592
6	xul.dll	nsIMEStateManager::OnChangeFocus	content/events/src/nsIMEStateManager.cpp:161
7	xul.dll	nsFocusManager::Focus	
8	xul.dll	nsFocusManager::SetFocusInner	dom/base/nsFocusManager.cpp:1238
9	xul.dll	nsFocusManager::SetFocus	dom/base/nsFocusManager.cpp:463
10	xul.dll	nsGenericHTMLElement::Focus	content/html/content/src/nsGenericHTMLElement.cpp:3397
11	xul.dll	nsHTMLInputElement::Focus	content/html/content/src/nsHTMLInputElement.cpp:1674
12	xul.dll	nsIDOMHTMLElement_Focus	obj-firefox/js/xpconnect/src/dom_quickstubs.cpp:14563 

bp-4c966945-eae9-41fa-8e07-7658e2120125 version 9

Comment 8

[Wayne Mery (:wsmwk)]

(In reply to Wayne Mery (:wsmwk) from comment #7)
> I don't see any chance of getting a testcase, at least not from thunderbird,
> with less than 1 crash per month, and even then not for all releases.

still no testcases for Ehsan. still low crash rate. eg bp-32ba396c-e54e-46ca-9c88-6a13e2130619.  But currently most or all might be caused by McAfee. So hard to tell if any crashes are legit mozilla issue.

perhaps more common are the following signatures
nsEditor::~nsEditor() - also all perhaps McAFee
nsEditor::GetSelection(nsISelection**) no McAFee afaict
nsEditor::DeleteSelectionAndPrepareToCreateNode - all linux/Mac

Comment 9

[Paul Pasca[Away. Please needinfo? Paul Oiegas [:pauloiegasSV]]]

Socorro reports show that this crash signature: [@ nsEditor::PostCreate ] appears only 5 time in the last 7 days. All crashes were recorded on Windows 7 x32. I don't think we should close this issue until this crash signature is no longer present. Steps to reproduce or a test case could be very helpful.

Comment 10

[Wayne Mery (:wsmwk)]

(In reply to Paul Pasca[:PoollyMcklayn] from comment #9)
> Socorro reports show that this crash signature: [@ nsEditor::PostCreate ]
> appears only 5 time in the last 7 days. All crashes were recorded on Windows
> 7 x32. I don't think we should close this issue until this crash signature
> is no longer present. Steps to reproduce or a test case could be very
> helpful.

It is indeed extremely rare - only 12 in 8 weeks. And 3/4 of the Firefox crashes are startup. 
But afaict almost none are OOM :(

I suggest we just close it

Comment 11

[(no longer active)]

I don't know, I don't work on this code any more.

Comment 12

[Wayne Mery (:wsmwk)]

Toss up between WFM and Incomplete. WFM doesn't feel quite right, so chosing the later.