620790 - crash [@ nsPluginInstanceOwner::UseLayers() ]

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

It is a new crash signature that exists in trunk.
There is a spike in crashes from 4.0b9pre/20101220.
It is #16 top crasher in this build.

Dupe of bug 620512?

Signature	nsPluginInstanceOwner::UseLayers()
UUID	959025a7-b4d4-489d-91fb-75c1b2101221
Time 	2010-12-21 12:03:42.515484
Uptime	338
Last Crash	342 seconds (5.7 minutes) before submission
Install Age	2890 seconds (48.2 minutes) since version was first installed.
Product	Firefox
Version	4.0b9pre
Build ID	20101221030401
Branch	2.0
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 15 model 4 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION_EXEC
Crash Address	0xffffffffb3c8e904
User Comments	
App Notes 	AdapterVendorID: 8086, AdapterDeviceID: 29c2
MSAFD Tcpip [TCP/IP] : 2 : 1 :
MSAFD Tcpip [UDP/IP] : 2 : 2 : %SystemRoot%\system32\mswsock.dll
MSAFD Tcpip [RAW/IP] : 2 : 3 : %SystemRoot%\system32\mswsock.dll
RSVP UDP Service Provider : 6 : 2 : %SystemRoot%\system32\rsvpsp.dll
RSVP TCP Service Provider : 6 : 1 : %SystemRoot%\system32\rsvpsp.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip_{EFF39E60-AA81-4958-AB2F-F7367C197346}] SEQPACKET 0 : 2 : 5 : %SystemRoot%\system32\mswsock.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip_{EFF39E60-AA81-4958-AB2F-F7367C197346}] DATAGRAM 0 : 2 : 2 : %SystemRoot%\system32\mswsock.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip_{5E976B5B-4C85-4918-A327-E5FCC6439F97}] SEQPACKET 3 : 2 : 5 : %SystemRoot%\system32\mswsock.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip_{5E976B5B-4C85-4918-A327-E5FCC6439F97}] DATAGRAM 3 : 2 : 2 : %SystemRoot%\system32\mswsock.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip_{2DC5AC49-15EA-4499-955B-EE5CE54D12AC}] SEQPACKET 1 : 2 : 5 : %SystemRoot%\syste

Frame 	Module 	Signature [Expand] 	Source
0 		@0xb3c8e904 	
1 	xul.dll 	nsPluginInstanceOwner::UseLayers 	layout/generic/nsObjectFrame.cpp:474
2 	xul.dll 	nsObjectFrame::BuildDisplayList 	layout/generic/nsObjectFrame.cpp:1470
3 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1761
4 	xul.dll 	nsHTMLContainerFrame::DisplayTextDecorationsAndChildren 	layout/generic/nsHTMLContainerFrame.cpp:393
5 	xul.dll 	nsInlineFrame::BuildDisplayList 	layout/generic/nsInlineFrame.cpp:189
6 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1718
7 	xul.dll 	nsBlockFrame::BuildDisplayList 	layout/generic/nsBlockFrame.cpp:6219
...
58 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1716
59 	xul.dll 	nsBoxFrame::BuildDisplayListForChildren 	layout/xul/base/src/nsBoxFrame.cpp:1355
60 	xul.dll 	nsRootBoxFrame::BuildDisplayList 	layout/xul/base/src/nsRootBoxFrame.cpp:250
61 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1718
62 	xul.dll 	nsIFrame::BuildDisplayListForStackingContext 	layout/generic/nsFrame.cpp:1467
63 	xul.dll 	nsRootPresContext::GetPluginGeometryUpdates 	layout/base/nsPresContext.cpp:2530
64 	xul.dll 	nsRootPresContext::UpdatePluginGeometry 	
65 	xul.dll 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:4899
66 	xul.dll 	nsDocument::FlushPendingNotifications 	content/base/src/nsDocument.cpp:6436
67 	mozalloc.dll 	moz_xmalloc 	memory/mozalloc/mozalloc.cpp:98
68 	xul.dll 	nsGenericElement::GetBoundingClientRect 	content/base/src/nsGenericElement.cpp:1739
69 	xul.dll 	nsIDOMNSElement_GetBoundingClientRect 	obj-firefox/js/src/xpconnect/src/dom_quickstubs.cpp:9153
70 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4744

The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=be8006fc9c4a&tochange=fc50c521bf48

More reports at:
http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=nsPluginInstanceOwner%3A%3AUseLayers%28%29

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Yeah I think it's a dup

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=nsPluginInstanceOwner%3A%3AUseLayers%28%29&date=01%2F02%2F2011%2016%3A54%3A43&range_value=2&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=nsPluginInstanceOwner%3A%3AUseLayers%28%29
Spike looks fixed. Only one crash in a build later than 12/23. Fixed per https://bugzilla.mozilla.org/show_bug.cgi?id=620794#c4.

Comment 3

[LegNeato]

As per today's meeting, beta 9 will be a time-based release. Marking these all betaN+. Please move it back to beta9+ if you believe it MUST be in the next beta (ie: trunk is in an unshippable state without this)