606860 - 4.0b8pre crash [@ PL_DHashTableOperate | nsTHashtable<nsBaseHashtableET<nsPtrHashKey<void const >, nsRefPtr<nsAccessible> > >::RemoveEntry(void const*) ]

Status: RESOLVED DUPLICATE of bug 599341

(Core Graveyard :: Plug-ins, defect)

Description

[chris hofmann]

new crash that just appeared on 4.0b8pre build 2010102304 with 50 crashes yesterday, and more today.

stack looks like

http://crash-stats.mozilla.com/report/index/c87238d2-351a-45d4-8119-5806e2101024

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	PL_DHashTableOperate 	obj-firefox/xpcom/build/pldhash.c:615
1 	xul.dll 	nsTHashtable<nsBaseHashtableET<nsPtrHashKey<void const >,nsRefPtr<nsAccessible> > >::RemoveEntry 	obj-firefox/dist/include/nsTHashtable.h:201
2 	xul.dll 	nsObjectFrame::StopPluginInternal 	layout/generic/nsObjectFrame.cpp:2547
3 	xul.dll 	nsObjectFrame::DestroyFrom 	layout/generic/nsObjectFrame.cpp:675
4 	xul.dll 	nsContainerFrame::DestroyFrom 	layout/generic/nsContainerFrame.cpp:272
5 	xul.dll 	nsBlockFrame::DestroyFrom 	layout/generic/nsBlockFrame.cpp:320
6 	xul.dll 	nsBlockFrame::DestroyFrom 	layout/generic/nsBlockFrame.cpp:320
7 	xul.dll 	nsBlockFrame::DestroyFrom 	layout/generic/nsBlockFrame.cpp:320
8 	xul.dll 	nsContainerFrame::DestroyFrom 	layout/generic/nsContainerFrame.cpp:272
9 	xul.dll 	nsHTMLScrollFrame::DestroyFrom 	layout/generic/nsGfxScrollFrame.cpp:122
10 	xul.dll 	nsBlockFrame::DestroyFrom 	layout/generic/nsBlockFrame.cpp:316
11 	xul.dll 	nsBlockFrame::DestroyFrom 	layout/generic/nsBlockFrame.cpp:320
12 	xul.dll 	nsContainerFrame::DestroyFrom 	layout/generic/nsContainerFrame.cpp:272
13 	xul.dll 	nsHTMLScrollFrame::DestroyFrom 	layout/generic/nsGfxScrollFrame.cpp:122
14 	xul.dll 	nsBlockFrame::DestroyFrom 	layout/generic/nsBlockFrame.cpp:320
15 	xul.dll 	nsBlockFrame::DestroyFrom 	layout/generic/nsBlockFrame.cpp:320
16 	xul.dll 	nsContainerFrame::DestroyFrom 	layout/generic/nsContainerFrame.cpp:272
17 	xul.dll 	nsCanvasFrame::DestroyFrom 	layout/generic/nsCanvasFrame.cpp:95
18 	xul.dll 	nsContainerFrame::DestroyFrom 	layout/generic/nsContainerFrame.cpp:272
19 	xul.dll 	nsHTMLScrollFrame::DestroyFrom 	layout/generic/nsGfxScrollFrame.cpp:122
20 	xul.dll 	nsContainerFrame::DestroyFrom 	layout/generic/nsContainerFrame.cpp:272
21 	xul.dll 	ViewportFrame::DestroyFrom 	layout/generic/nsViewportFrame.cpp:73
22 	xul.dll 	nsFrameManager::Destroy 	layout/base/nsFrameManager.cpp:253
23 	xul.dll 	PresShell::Destroy 	layout/base/nsPresShell.cpp:2006
24 	xul.dll 	DocumentViewerImpl::DestroyPresShell 	layout/base/nsDocumentViewer.cpp:4272
25 	xul.dll 	DocumentViewerImpl::Destroy 	layout/base/nsDocumentViewer.cpp:1618
26 	xul.dll 	nsSHEntry::SyncPresentationState 	docshell/shistory/src/nsSHEntry.cpp:739
27 	xul.dll 	nsSHistory::EvictContentViewers 	docshell/shistory/src/nsSHistory.cpp:673
28 	xul.dll 	nsPresContext::EnsureVisible 	layout/base/nsPresContext.cpp:1665
29 	xul.dll 	nsPluginInstanceOwner::Init 	layout/generic/nsObjectFrame.cpp:6068
30 	xul.dll 	nsPluginHost::NewPluginNativeWindow 	modules/plugin/base/src/nsPluginHost.cpp:3535
31 	xul.dll 	nsObjectFrame::PrepareInstanceOwner 	layout/generic/nsObjectFrame.cpp:2245
32 	xul.dll 	nsObjectFrame::Instantiate 	layout/generic/nsObjectFrame.cpp:2317
33 	xul.dll 	nsHTMLObjectElement::QueryInterface 	content/html/content/src/nsHTMLObjectElement.cpp:226
34 	xul.dll 	nsCOMPtr_base::assign_from_qi 	obj-firefox/xpcom/build/nsCOMPtr.cpp:96
35 	xul.dll 	nsCOMPtr<nsIContent>::nsCOMPtr<nsIContent> 	obj-firefox/dist/include/nsCOMPtr.h:595
36 	xul.dll 	nsObjectLoadingContent::Instantiate 	content/base/src/nsObjectLoadingContent.cpp:1895
37 	xul.dll 	nsObjectLoadingContent::EnsureInstantiation 	content/base/src/nsObjectLoadingContent.cpp:919
38 	xul.dll 	nsHTMLPluginObjElementSH::GetPluginInstanceIfSafe 	dom/base/nsDOMClassInfo.cpp:9421
39 	xul.dll 	nsHTMLPluginObjElementSH::NewResolve 	dom/base/nsDOMClassInfo.cpp:9780
40 	xul.dll 	XPC_WN_Helper_NewResolve

more at

http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&query=PL_DHashTableOperate%20|%20nsTHashtable%3CnsBaseHashtableET%3CnsPtrHashKey%3Cvoid%20const%20%3E%2C%20nsRefPtr%3CnsAccessible%3E%20%3E%20%3E%3A%3ARemoveEntry%28void%20const*%29&date=10%2F24%2F2010%2016%3A06%3A52&range_value=1&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=PL_DHashTableOperate%20|%20nsTHashtable%3CnsBaseHashtableET%3CnsPtrHashKey%3Cvoid%20const%20%3E%2C%20nsRefPtr%3CnsAccessible%3E%20%3E%20%3E%3A%3ARemoveEntry%28void%20const*%29

none of the lines at the top of the stack have changed for a while, but there is this work going on in layout/generic/nsObjectFrame.cpp

54b9b52337b7
2010-10-22 21:16 -0400	Boris Zbarsky - Bug 484992 and bug 604420. Don't start a new network request when instantiating the plug-in for <object>s. r=josh, a=blocker
diff
browse
annotate	93e95f4f73af
2010-10-21 13:16 +0900	Alexander Surkov - Bug 570275 - rework accessible tree update code, r=marcoz, davidb, bz, a=blocking


os breakdown
Win5.1  0.16
Win6.0  0.08
Win6.1  0.76

one comment says 

   something to do with flash

but flash versions are largely absent

flash versions around at time of crash
  49 [blank]
   1 10.1.85.3

another coment says:

   The snowsnowforlucy site crashes ALOT when mousing around the page. Debug that :P

and url list has

   5 http://www.snowsnowforlucy.com
     http://www.snowsnowforlucy.com/trailer.html
     http://www.snowsnowforlucy.com/movie.html
     http://www.snowsnowforlucy.com/games.html
     http://www.snowsnowforlucy.com/ost.html

   4 \N//
   3 http://us.blizzard.com
   2 http://www.nvidia.co.uk
   2 http://www.monalisazene.hu
   2 http://www.lolicon-soul.com

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Which frame gets skipped near the top of the stack varies from build to build, but it looks like the same crash.