Closed Bug 609243 Opened 14 years ago Closed 7 years ago

crash [@ nsRuleNode::DestroyInternal(nsRuleNode***) ]

Categories

(Core :: CSS Parsing and Computation, defect)

Product:
Core
Component:
CSS Parsing and Computation
Version:
43 Branch
Platform:
All
Windows
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED INCOMPLETE
Tracking Flags:
Tracking Status
firefox40 --- wontfix
firefox41 --- wontfix
firefox42 --- wontfix
firefox43 --- wontfix
firefox44 --- wontfix
firefox45 --- wontfix
firefox-esr45 --- wontfix

People

(Reporter: scoobidiver, Unassigned)

Details

(Keywords: crash, Whiteboard: ShutDownKill)

Crash Data

It is a residual crash signature that exist in 3.5, 3.6 and trunk builds. It is #298 top crasher in 4.0b8pre for the last week. Signature nsRuleNode::DestroyInternal(nsRuleNode***) UUID cc918e9a-5b04-4736-9a0a-39fbc2101102 Time 2010-11-02 12:06:52.791013 Uptime 805 Install Age 806 seconds (13.4 minutes) since version was first installed. Product Firefox Version 4.0b8pre Build ID 20101102042148 Branch 2.0 OS Windows NT OS Version 5.1.2600 Service Pack 3 CPU x86 CPU Info GenuineIntel family 6 model 15 stepping 13 Crash Reason EXCEPTION_ACCESS_VIOLATION_READ Crash Address 0x4c App Notes AdapterVendorID: 0000, AdapterDeviceID: 0000 Frame Module Signature [Expand] Source 0 xul.dll nsRuleNode::DestroyInternal layout/style/nsRuleNode.cpp:1124 1 xul.dll nsRuleNode::DestroyInternal layout/style/nsRuleNode.cpp:1119 2 xul.dll PL_DHashTableEnumerate obj-firefox/xpcom/build/pldhash.c:789 3 xul.dll PresShell::Destroy layout/base/nsPresShell.cpp:2031 4 xul.dll DocumentViewerImpl::DestroyPresShell layout/base/nsDocumentViewer.cpp:4275 5 xul.dll DocumentViewerImpl::Destroy layout/base/nsDocumentViewer.cpp:1618 6 xul.dll nsSHEntry::SyncPresentationState docshell/shistory/src/nsSHEntry.cpp:739 7 xul.dll nsSHistory::EvictWindowContentViewers docshell/shistory/src/nsSHistory.cpp:858 More reports at: http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=&range_value=4&range_unit=days&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=nsRuleNode%3A%3ADestroyInternal%28nsRuleNode***%29
Crash Signature: [@ nsRuleNode::DestroyInternal(nsRuleNode***) ]
¡Hola! So I was checking about:crashes on Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:43.0) Gecko/20100101 Firefox/43.0 ID:20150831030209 CSet: f2518b8a7b97b5bb477e94bc9131584007aac887 and spotted this one: Report ID Date Submitted bp-086a41a6-5754-4813-a3c0-5e1302150831 31/08/2015 04:03 p.m. Crashing Thread Frame Module Signature Source 0 xul.dll nsRuleNode::DestroyInternal(nsRuleNode***) layout/style/nsRuleNode.cpp 1 xul.dll nsRuleNode::DestroyInternal(nsRuleNode***) layout/style/nsRuleNode.cpp 2 xul.dll nsStyleSet::Shutdown() layout/style/nsStyleSet.cpp 3 xul.dll PresShell::Destroy() layout/base/nsPresShell.cpp 4 xul.dll nsDocumentViewer::DestroyPresShell() layout/base/nsDocumentViewer.cpp 5 xul.dll nsDocumentViewer::Destroy() layout/base/nsDocumentViewer.cpp 6 xul.dll nsDocShell::Destroy() docshell/base/nsDocShell.cpp 7 xul.dll nsWebBrowser::SetDocShell(nsIDocShell*) embedding/browser/nsWebBrowser.cpp 8 xul.dll nsWebBrowser::InternalDestroy() embedding/browser/nsWebBrowser.cpp 9 xul.dll nsWebBrowser::Destroy() embedding/browser/nsWebBrowser.cpp 10 xul.dll mozilla::dom::TabChild::DestroyWindow() dom/ipc/TabChild.cpp 11 xul.dll mozilla::dom::TabChild::RecvDestroy() dom/ipc/TabChild.cpp 12 xul.dll mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) obj-firefox/ipc/ipdl/PBrowserChild.cpp 13 xul.dll mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) obj-firefox/ipc/ipdl/PContentChild.cpp 14 xul.dll mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) ipc/glue/MessageChannel.cpp 15 xul.dll mozilla::ipc::MessageChannel::DispatchMessageW(IPC::Message const&) ipc/glue/MessageChannel.cpp 16 xul.dll mozilla::ipc::MessageChannel::OnMaybeDequeueOne() ipc/glue/MessageChannel.cpp 17 xul.dll RunnableMethod<mozilla::ipc::MessageChannel, bool ( mozilla::ipc::MessageChannel::*)(void), Tuple0>::Run() ipc/chromium/src/base/task.h 18 xul.dll MessageLoop::DoWork() ipc/chromium/src/base/message_loop.cc 19 xul.dll mozilla::ipc::DoWorkRunnable::Run() ipc/glue/MessagePump.cpp 20 xul.dll nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp 21 xul.dll NS_ProcessNextEvent(nsIThread*, bool) xpcom/glue/nsThreadUtils.cpp 22 xul.dll nsXMLHttpRequest::Send(nsIVariant*, mozilla::dom::Nullable<nsXMLHttpRequest::RequestBody> const&) dom/base/nsXMLHttpRequest.cpp 23 xul.dll nsXMLHttpRequest::Send(nsXMLHttpRequest::RequestBody const&) dom/base/nsXMLHttpRequest.h 24 xul.dll nsXMLHttpRequest::Send(JSContext*, nsAString_internal const&, mozilla::ErrorResult&) dom/base/nsXMLHttpRequest.h 25 xul.dll mozilla::dom::XMLHttpRequestBinding::send obj-firefox/dom/bindings/XMLHttpRequestBinding.cpp 26 xul.dll mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) dom/bindings/BindingUtils.cpp 27 xul.dll js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) js/src/vm/Interpreter.cpp 28 xul.dll Interpret js/src/vm/Interpreter.cpp 29 xul.dll js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp 30 xul.dll js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) js/src/vm/Interpreter.cpp 31 xul.dll js::fun_apply(JSContext*, unsigned int, JS::Value*) js/src/jsfun.cpp 32 xul.dll js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) js/src/vm/Interpreter.cpp 33 xul.dll Interpret js/src/vm/Interpreter.cpp 34 xul.dll js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp 35 xul.dll js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) js/src/vm/Interpreter.cpp 36 xul.dll js::fun_apply(JSContext*, unsigned int, JS::Value*) js/src/jsfun.cpp 37 xul.dll js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) js/src/vm/Interpreter.cpp 38 xul.dll Interpret js/src/vm/Interpreter.cpp 39 xul.dll js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp 40 xul.dll js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) js/src/vm/Interpreter.cpp 41 xul.dll js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 42 xul.dll mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) obj-firefox/dom/bindings/EventListenerBinding.cpp 43 xul.dll mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) dom/events/EventListenerManager.cpp 44 xul.dll mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) dom/events/EventDispatcher.cpp 45 xul.dll mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) dom/events/EventDispatcher.cpp 46 xul.dll nsDocumentViewer::PageHide(bool) layout/base/nsDocumentViewer.cpp 47 xul.dll nsDocShell::FirePageHideNotification(bool) docshell/base/nsDocShell.cpp 48 xul.dll nsDocShell::Destroy() docshell/base/nsDocShell.cpp 49 xul.dll nsWebBrowser::SetDocShell(nsIDocShell*) embedding/browser/nsWebBrowser.cpp 50 xul.dll nsWebBrowser::InternalDestroy() embedding/browser/nsWebBrowser.cpp 51 xul.dll nsWebBrowser::Destroy() embedding/browser/nsWebBrowser.cpp 52 xul.dll mozilla::dom::TabChild::DestroyWindow() dom/ipc/TabChild.cpp 53 xul.dll mozilla::dom::TabChild::RecvDestroy() dom/ipc/TabChild.cpp 54 xul.dll mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) obj-firefox/ipc/ipdl/PBrowserChild.cpp 55 xul.dll mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) obj-firefox/ipc/ipdl/PContentChild.cpp 56 xul.dll mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) ipc/glue/MessageChannel.cpp 57 xul.dll mozilla::ipc::MessageChannel::DispatchMessageW(IPC::Message const&) ipc/glue/MessageChannel.cpp 58 xul.dll mozilla::ipc::MessageChannel::OnMaybeDequeueOne() ipc/glue/MessageChannel.cpp 59 xul.dll RunnableMethod<mozilla::ipc::MessageChannel, bool ( mozilla::ipc::MessageChannel::*)(void), Tuple0>::Run() ipc/chromium/src/base/task.h 60 xul.dll MessageLoop::DoWork() ipc/chromium/src/base/message_loop.cc 61 xul.dll mozilla::ipc::DoWorkRunnable::Run() ipc/glue/MessagePump.cpp 62 xul.dll nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp 63 xul.dll mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp 64 xul.dll mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp 65 xul.dll MessageLoop::RunHandler() ipc/chromium/src/base/message_loop.cc 66 xul.dll MessageLoop::Run() ipc/chromium/src/base/message_loop.cc 67 xul.dll nsBaseAppShell::Run() widget/nsBaseAppShell.cpp 68 xul.dll nsAppShell::Run() widget/windows/nsAppShell.cpp 69 xul.dll XRE_RunAppShell toolkit/xre/nsEmbedFunctions.cpp 70 xul.dll mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp 71 xul.dll MessageLoop::RunHandler() ipc/chromium/src/base/message_loop.cc 72 xul.dll MessageLoop::Run() ipc/chromium/src/base/message_loop.cc 73 xul.dll XRE_InitChildProcess toolkit/xre/nsEmbedFunctions.cpp 74 plugin-container.exe wmain toolkit/xre/nsWindowsWMain.cpp 75 plugin-container.exe __tmainCRTStartup f:/dd/vctools/crt/crtw32/startup/crt0.c:255 76 kernel32.dll BaseThreadInitThunk 77 ntdll.dll RtlUserThreadStart
status-firefox43: --- → affected
OS: Windows XP → Windows 7
¡Hola! This bite me again on Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:43.0) Gecko/20100101 Firefox/43.0 ID:20150916030203 CSet: 3e8dde8f8c174cce2c0b65c951808f88e35d1875 Report ID Date Submitted bp-211ac9a8-eba9-430f-90cd-a0efe2150916 16/09/2015 05:42 p.m. Crashing Thread Frame Module Signature Source 0 xul.dll nsRuleNode::DestroyInternal(nsRuleNode***) layout/style/nsRuleNode.cpp 1 xul.dll nsRuleNode::DestroyInternal(nsRuleNode***) layout/style/nsRuleNode.cpp 2 xul.dll nsStyleSet::Shutdown() layout/style/nsStyleSet.cpp 3 xul.dll PresShell::Destroy() layout/base/nsPresShell.cpp 4 xul.dll nsDocumentViewer::DestroyPresShell() layout/base/nsDocumentViewer.cpp 5 xul.dll nsDocumentViewer::Destroy() layout/base/nsDocumentViewer.cpp 6 xul.dll nsDocShell::Destroy() docshell/base/nsDocShell.cpp 7 xul.dll nsWebBrowser::SetDocShell(nsIDocShell*) embedding/browser/nsWebBrowser.cpp 8 xul.dll nsWebBrowser::InternalDestroy() embedding/browser/nsWebBrowser.cpp 9 xul.dll nsWebBrowser::Destroy() embedding/browser/nsWebBrowser.cpp 10 xul.dll mozilla::dom::TabChild::DestroyWindow() dom/ipc/TabChild.cpp 11 xul.dll mozilla::dom::TabChild::RecvDestroy() dom/ipc/TabChild.cpp 12 xul.dll mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) obj-firefox/ipc/ipdl/PBrowserChild.cpp 13 xul.dll mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) obj-firefox/ipc/ipdl/PContentChild.cpp 14 xul.dll mozilla::ipc::MessageChannel::DispatchMessageW(IPC::Message const&) ipc/glue/MessageChannel.cpp 15 xul.dll mozilla::ipc::MessageChannel::OnMaybeDequeueOne() ipc/glue/MessageChannel.cpp 16 xul.dll RunnableMethod<mozilla::ipc::MessageChannel, void ( mozilla::ipc::MessageChannel::*)(void), Tuple0>::Run() ipc/chromium/src/base/task.h 17 xul.dll MessageLoop::DoWork() ipc/chromium/src/base/message_loop.cc 18 xul.dll mozilla::ipc::DoWorkRunnable::Run() ipc/glue/MessagePump.cpp 19 xul.dll nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp 20 xul.dll mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp 21 xul.dll mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp 22 xul.dll MessageLoop::RunHandler() ipc/chromium/src/base/message_loop.cc 23 xul.dll MessageLoop::Run() ipc/chromium/src/base/message_loop.cc 24 xul.dll nsBaseAppShell::Run() widget/nsBaseAppShell.cpp 25 xul.dll nsAppShell::Run() widget/windows/nsAppShell.cpp 26 xul.dll XRE_RunAppShell toolkit/xre/nsEmbedFunctions.cpp 27 xul.dll mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp 28 xul.dll MessageLoop::RunHandler() ipc/chromium/src/base/message_loop.cc 29 xul.dll MessageLoop::Run() ipc/chromium/src/base/message_loop.cc 30 xul.dll XRE_InitChildProcess toolkit/xre/nsEmbedFunctions.cpp 31 plugin-container.exe wmain toolkit/xre/nsWindowsWMain.cpp 32 plugin-container.exe __tmainCRTStartup f:/dd/vctools/crt/crtw32/startup/crt0.c:255 33 kernel32.dll BaseThreadInitThunk 34 ntdll.dll RtlUserThreadStart Per https://crash-stats.mozilla.com/report/list?date=2015-09-16&range_unit=days&range_value=28&signature=nsRuleNode%3A%3ADestroyInternal%28nsRuleNode***%29 there have been ~800 crashes across all platforms in the past month and 127 were startup crashes like mine.
status-firefox40: --- → affected
status-firefox41: --- → affected
status-firefox42: --- → affected
Component: Layout → IPC
OS: Windows 7 → All
Hardware: x86 → All
Version: Trunk → 43 Branch
Crash Signature: [@ nsRuleNode::DestroyInternal(nsRuleNode***) ] → [@ nsRuleNode::DestroyInternal(nsRuleNode***) ] [@ nsRuleNode::DestroyInternal ]
> Component: Layout → IPC I guess it should be under "Layout" ... [@ nsRuleNode::DestroyInternal ] Win7, FF45.0a1, 64bit https://crash-stats.mozilla.com/report/index/7ad09884-abfe-4fb3-9de8-d0ca52151119 Crashing Thread Frame Module Signature Source 0 xul.dll nsRuleNode::DestroyInternal(nsRuleNode***) layout/style/nsRuleNode.cpp 1 xul.dll nsRuleNode::DestroyInternal(nsRuleNode***) layout/style/nsRuleNode.cpp 2 xul.dll nsRuleNode::DestroyIfNotMarked() layout/style/nsRuleNode.cpp 3 xul.dll nsRuleNode::SweepChildren(nsTArray<nsRuleNode*>&) layout/style/nsRuleNode.cpp 4 xul.dll nsRuleNode::Sweep() layout/style/nsRuleNode.cpp 5 xul.dll nsStyleSet::GCRuleTrees() layout/style/nsStyleSet.cpp 6 xul.dll nsStyleContext::Destroy() layout/style/nsStyleContext.cpp 7 xul.dll nsTHashtable<nsBaseHashtableET<nsRefPtrHashKey<nsIContent>, RefPtr<nsStyleContext> > >::s_ClearEntry(PLDHashTable*, PLDHashEntryHdr*) xpcom/glue/nsTHashtable.h 8 xul.dll PLDHashTable::~PLDHashTable() xpcom/glue/PLDHashTable.cpp 9 xul.dll mozilla::RestyleTracker::DoProcessRestyles() layout/base/RestyleTracker.cpp 10 xul.dll mozilla::RestyleManager::ProcessPendingRestyles() layout/base/RestyleManager.cpp 11 xul.dll PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) layout/base/nsPresShell.cpp 12 xul.dll nsDocument::FlushPendingNotifications(mozFlushType) dom/base/nsDocument.cpp 13 xul.dll nsGlobalWindow::FlushPendingNotifications(mozFlushType) dom/base/nsGlobalWindow.cpp 14 xul.dll nsGlobalWindow::ScrollTo(mozilla::gfx::IntPointTyped<mozilla::CSSPixel> const&, mozilla::dom::ScrollOptions const&) dom/base/nsGlobalWindow.cpp 15 xul.dll nsGlobalWindow::ScrollTo(double, double) dom/base/nsGlobalWindow.cpp 16 xul.dll mozilla::dom::WindowBinding::scrollTo obj-firefox/dom/bindings/WindowBinding.cpp 17 xul.dll mozilla::dom::WindowBinding::genericMethod obj-firefox/dom/bindings/WindowBinding.cpp 18 xul.dll js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) js/src/vm/Interpreter.cpp 19 xul.dll Interpret js/src/vm/Interpreter.cpp 20 xul.dll js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp 21 xul.dll js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) js/src/vm/Interpreter.cpp 22 xul.dll js::fun_apply(JSContext*, unsigned int, JS::Value*) js/src/jsfun.cpp 23 xul.dll js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) js/src/vm/Interpreter.cpp 24 xul.dll js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 25 xul.dll js::jit::DoCallFallback js/src/jit/BaselineIC.cpp 26 @0x2a8b6211a5c
Blocks: shutdownkill
status-firefox44: --- → ?
status-firefox45: --- → affected
Component: IPC → Layout
OS: All → Windows
Whiteboard: ShutDownKill
From the crash signature [@ nsRuleNode::DestroyInternal ] , the affected versions are: - Nightly: 47.0a1, 46.0a1 - Aurora: 46.0a2, - Firefox: 44.0 - Beta: 45.0b2, 45.0b1, 44.0b99, 44.0b9, 44.0b8, 44.0b4, 44.0b2, 44.0b1 In the crash signature [@ nsRuleNode::DestroyInternal(nsRuleNode***) ] were no reports.
Looking at one example: bp-4ca391a7-11f6-4766-99ea-c6e6c2160318 : We're crashing in nsRuleNode::DestroyInternal because this (EDI) is 0x12c1d4a0, this->mRule (ECX) is 0x0da192d0, this->mRule's vtable (EAX) is 0x3a080000, and that's a bad address so we crash trying to call the this->mRule->Release().
Component: Layout → CSS Parsing and Computation
Crash volume for signature 'nsRuleNode::DestroyInternal': - nightly (version 50): 0 crash from 2016-06-06. - aurora (version 49): 0 crash from 2016-06-07. - beta (version 48): 0 crash from 2016-06-06. - release (version 47): 0 crash from 2016-05-31. - esr (version 45): 209 crashes from 2016-04-07. Crash volume on the last weeks: Week N-1 Week N-2 Week N-3 Week N-4 Week N-5 Week N-6 Week N-7 - nightly 0 0 0 0 0 0 0 - aurora 0 0 0 0 0 0 0 - beta 0 0 0 0 0 0 0 - release 0 0 0 0 0 0 0 - esr 23 17 21 28 27 27 13 Affected platform: Windows
status-firefox-esr45: --- → affected
nsRuleNode is gone so it's not worth tracking these signatures anymore. Please file new bugs as appropriate.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.