625247 - Firefox 4.0b10pre crash [@ arena_dalloc | free | nsDisplayListBuilder::LeavePresShell(nsIFrame*, nsRect const&) ][@ RtlEnterCriticalSection ]

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Marcia Knous [:marcia]]

Seen while reviewing crash stats. Crashes started showing up using the 2011011200 build. http://tinyurl.com/4golztg to the reports which are all Windows.

Possible pushlog regression: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4413ed6ba5a5&tochange=c0e05d518f57

Not sure if this belongs in layout?

Frame 	Module 	Signature [Expand] 	Source
0 	mozcrt19.dll 	arena_dalloc 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:4275
1 	mozcrt19.dll 	free 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:6121
2 	xul.dll 	nsDisplayListBuilder::LeavePresShell 	
3 		@0x50 	
4 	xul.dll 	xpc::ResolveNativeProperty 	js/src/xpconnect/wrappers/XrayWrapper.cpp:296
5 	mozjs.dll 	js::JSProxy::call 	js/src/jsproxy.cpp:810
6 	mozcrt19.dll 	arena_dalloc_small 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:4153
7 	mozcrt19.dll 	_getptd_noexit 	obj-firefox/memory/jemalloc/crtsrc/tidtable.c:631
8 	mozcrt19.dll 	_getptd 	obj-firefox/memory/jemalloc/crtsrc/tidtable.c:656
9 	mozcrt19.dll 	_LocaleUpdate::_LocaleUpdate 	obj-firefox/memory/jemalloc/crtsrc/setlocal.h:264
10 	mozcrt19.dll 	_input_l 	obj-firefox/memory/jemalloc/crtsrc/input.c:1086
11 	mozcrt19.dll 	vscan_fn 	obj-firefox/memory/jemalloc/crtsrc/sscanf.c:66
12 	mozcrt19.dll 	sscanf 	obj-firefox/memory/jemalloc/crtsrc/sscanf.c:159
13 	xul.dll 	PresShell::Paint 	layout/base/nsPresShell.cpp:6112
14 	xul.dll 	mozilla::widget::GfxInfo::GetFeatureStatusImpl 	
15 		@0xa4012a3 	
16 	xul.dll 	nsViewManager::Refresh 	view/src/nsViewManager.cpp:413
17 	xul.dll 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:912

Comment 1

[Jonathan Steele]

Attachment: stack trace from apple reports

heres what apple reported of this similar bug

Comment 2

[Scoobidiver (away)]

It is #1 top crasher in today's build.

Comment 3

[Benjamin Smedberg]

We need to find a smaller regression window, a whole lot of stuff landed which could be responsible. Needs to block beta10.

STR: load http://www.minecraftwiki.net/wiki/MCLawl/Commands . Scrolling down the page may be required.

Comment 4

[Benjamin Smedberg]

###!!! ASSERTION: Want to fire mutation events, but it's not safe: '(aNode->IsNodeOfType(nsINode::eCONTENT) && static_cast<nsIContent*>(aNode)-> IsInNativeAnonymousSubtree()) || sScriptBlockerCount == sRemovableScriptBlockerCount', file c:/builds/mozilla-central/ff-debug/content/base/src/../../../../src/content/base/src/nsContentUtils.cpp, line 3625

Comment 5

[Benjamin Smedberg]

Attachment: Stack of debug-CRT assertion

Comment 6

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

This is a regression from Bug 621762.

Comment 7

[Benjamin Smedberg]

I really think this needs to be a hardblocker in that "back out bug 621762 if we can't fix it in 24 hours" kind of way.

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I'm nearly 100% sure the problem is that we're using an nsAutoTArray<ThemeGeometry> inside an nsAutoTArray<PresShellState>. nsAutoTArrays break if you move them around in memory.

Comment 9

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

Almost anyone could review this really.

Comment 10

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 503722 [details] [diff] [review]
fix

First come, first served!

Comment 11

[Timothy Nikkel (:tnikkel)]

Given that we only need this on the top level presshell state, why don't we move this to nsLayoutUtils::PaintFrame and put the theme geometry items on the display list builder?

Comment 12

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

(In reply to comment #8)
> I'm nearly 100% sure the problem is that we're using an
> nsAutoTArray<ThemeGeometry> inside an nsAutoTArray<PresShellState>.
> nsAutoTArrays break if you move them around in memory.

This sounds like something that needs a static or dynamic check to keep people from shooting themselves in the foot.

Comment 13

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: Alternative fix

This does that. It builds, but I haven't tested it on Mac yet.

Comment 14

[Timothy Nikkel (:tnikkel)]

Comment on attachment 503732 [details] [diff] [review]
Alternative fix

Awesome, thanks.

Comment 15

[Timothy Nikkel (:tnikkel)]

(In reply to comment #12)
> This sounds like something that needs a static or dynamic check to keep people
> from shooting themselves in the foot.

Agreed, feel free to file a followup.

Comment 16

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

(In reply to comment #15)
> (In reply to comment #12)
> > This sounds like something that needs a static or dynamic check to keep people
> > from shooting themselves in the foot.
> 
> Agreed, feel free to file a followup.

Bug 625648.

Comment 17

[Markus Stange [:mstange]]

(In reply to comment #13)
> Created attachment 503732 [details] [diff] [review]
> Alternative fix
> 
> This does that. It builds, but I haven't tested it on Mac yet.

Works great, thanks!

Comment 18

[chris hofmann]

are the stacks seen in bug 625753 related?

Comment 19

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Probably not.

Comment 20

[Robert O'Callahan (:roc) (email my personal email if necessary)]

http://hg.mozilla.org/mozilla-central/rev/7307131094a5

Comment 22

[Scott A.]

Looks like this is still showing up on crash-stats with the 18th build.

Comment 23

[Timothy Nikkel (:tnikkel)]

Can you provide a link to some reports?

Comment 24

[Scott A.]

https://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&signature=arena_dalloc%20|%20free%20|%20nsDisplayListBuilder%3A%3ALeavePresShell%28nsIFrame*%2C%20nsRect%20const%26%29&version=Firefox%3A4.0b10pre

Comment 25

[Timothy Nikkel (:tnikkel)]

Thanks, I'm not a frequent users of crash stats.

Comment 26

[Robert O'Callahan (:roc) (email my personal email if necessary)]

The frequency has dropped enormously though.

Comment 27

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

All of the 1/18 crashes are from TM nightlies, which probably haven't merged this fix over.