618832 - spike in crashes [@ nsIFrame::InvalidateWithFlags(nsRect const&, unsigned int) ] [@ nsIFrame::InvalidateWithFlags ]

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

It is a residual crash signature, but from today there is a spike in crashes.
It became #1 top crasher in today's build: 4.0b8pre/20101213.

Signature	nsIFrame::InvalidateWithFlags(nsRect const&, unsigned int)
UUID	df01a825-190f-4bd8-b061-9ef5c2101213
Time 	2010-12-13 07:51:30.666704
Uptime	151
Last Crash	175 seconds before submission
Install Age	4712 seconds (1.3 hours) since version was first installed.
Product	Firefox
Version	4.0b8pre
Build ID	20101213030326
Branch	2.0
OS	Windows NT
OS Version	6.1.7600
CPU	x86
CPU Info	GenuineIntel family 6 model 30 stepping 5
Crash Reason	EXCEPTION_ACCESS_VIOLATION_WRITE
Crash Address	0x2f1
User Comments	
App Notes 	AdapterVendorID: 000b, AdapterDeviceID: 000b
Tcpip MSAFD [TCP/IP] : 2 : 1 :
Tcpip MSAFD [UDP/IP] : 2 : 2 : %SystemRoot%\system32\mswsock.dll
Tcpip MSAFD [RAW/IP] : 2 : 3 :
MSAFD Tcpip [TCP/IPv6] : 2 : 1 : %SystemRoot%\system32\mswsock.dll
MSAFD Tcpip [UDP/IPv6] : 2 : 2 :
MSAFD Tcpip [RAW/IPv6] : 2 : 3 : %SystemRoot%\system32\mswsock.dll
Provedor de Serviço de TCPv6 de RSVP : 2 : 1 :
Provedor de Serviço de TCP de RSVP : 2 : 1 : %SystemRoot%\system32\mswsock.dll
Provedor de Serviço de UDPv6 de RSVP : 2 : 2 :
Provedor de Serviço de UDP de RSVP : 2 : 2 : %SystemRoot%\system32\mswsock.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip_{DAE258FF-844B-4A2F-BB54-AB67A82A422B}] SEQPACKET 3 : 2 : 5 :
MSAFD NetBIOS [\Device\NetBT_Tcpip_{DAE258FF-844B-4A2F-BB54-AB67A82A422B}] DATAGRAM 3 : 2 : 2 : %SystemRoot%\system32\mswsock.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip_{BA65C38B-440C-4E0F-B753-37F39267D58B}] SEQPACKET 1 : 2 : 5 :
MSAFD NetBIOS [\Device\NetBT_Tcpip_{BA65C38B-440C-4E

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsIFrame::InvalidateWithFlags 	layout/generic/nsFrame.cpp:4063
1 	xul.dll 	nsIFrame::Invalidate 	layout/generic/nsIFrame.h:1982
2 	xul.dll 	PresShell::DoReflow 	layout/base/nsPresShell.cpp:7734
3 	xul.dll 	PresShell::ProcessReflowCommands 	layout/base/nsPresShell.cpp:7922
4 	xul.dll 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:4884
5 	xul.dll 	nsPrintEngine::ReflowPrintObject 	layout/printing/nsPrintEngine.cpp:2035
6 	xul.dll 	nsPrintEngine::ReflowDocList 	layout/printing/nsPrintEngine.cpp:1873
7 	xul.dll 	nsPrintEngine::SetupToPrintContent 	layout/printing/nsPrintEngine.cpp:1682
8 	xul.dll 	nsPrintEngine::DocumentReadyForPrinting 	layout/printing/nsPrintEngine.cpp:1514
9 	xul.dll 	nsPrintEngine::Observe 	layout/printing/nsPrintEngine.cpp:3351
10 	xul.dll 	nsPrintProgress::DoneIniting 	embedding/components/printingui/src/win/nsPrintProgress.cpp:221
11 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
12 	xul.dll 	XPC_WN_CallMethod 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1588
13 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4748
14 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:657
15 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:737
16 	mozjs.dll 	js::ExternalInvoke 	js/src/jsinterp.cpp:858
17 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5029
18 	xul.dll 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:2177
19 	xul.dll 	nsGlobalWindow::RunTimeout 	dom/base/nsGlobalWindow.cpp:8966
20 	xul.dll 	nsGlobalWindow::TimerCallback 	dom/base/nsGlobalWindow.cpp:9311
21 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:425
22 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:517
23 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:626
24 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
25 	xul.dll 	xul.dll@0xb1791b 	
26 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:202
27 	mozcrt19.dll 	_VEC_memzero 	
28 	xul.dll 	xul.dll@0x3574fd 	
29 	firefox.exe 	firefox.exe@0x1bb7 	
30 	ntdll.dll 	LdrpGetShimEngineInterface 	
31 	ntdll.dll 	_RtlUserThreadStart 	
32 	firefox.exe 	firefox.exe@0x186f 	
33 	firefox.exe 	firefox.exe@0x186f 	

The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=25d77f95d92c&tochange=210237f7d626
The likely culprit is bug 615870.

More reports at:
http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=nsIFrame%3A%3AInvalidateWithFlags%28nsRect%20const%26%2C%20unsigned%20int%29

Comment 1

[Oleg Romashin (:romaxa)]

Sounds like rootPC can be null there... don't remember where , but somewhere I've heard that if it is null then we are dead....
null check  needed.

Comment 2

[Alice0775 White]

[STR]
1. Start Minefield with new profile
2. Open Web (ex. http://www.mozilla.org/projects/firefox/prerelease.html )
3. Execute print( Ctrl+P )
4. Coose printer (ex. "Microsoft XPS Document Writer") and "OK"

[Actual]
Vrowser Crashes with crash reports
bp-3d286d4c-7cb9-404c-b820-ba3cc2101213

Comment 3

[Oleg Romashin (:romaxa)]

Attachment: Null check

Comment 5

[Marcia Knous [:marcia]]

I believe this may need to block B8 based on the volume I am seeing in crash stats as well as how easy it is to repro on a common operation - printing. On Mac all you have to do is print and save to PDF and you crash.

Comment 6

[LegNeato]

Can we get a tryserver build with this patch and have it submitted to m-c asap today? Thanks!

Comment 7

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Anyone can land this. Find someone on #developers?

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Fixed by backout.

Comment 10

[Marcia Knous [:marcia]]

Verifying fixed. I tested the latest Mac build and I am not able to crash using the latest nightly. There doesn't appear to be any instances of this crash using a build ID after 20101213 in crash stats as well.