625723 - crash [@ free | nsTArray<nsDisplayListBuilder::PresShellState, nsTArrayDefaultAllocator>::RemoveElementsAt ] [@ free | moz_free | nsTArray_base<nsTArrayDefaultAllocator>::~nsTArray_base ]

Status: RESOLVED DUPLICATE of bug 625247

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

They are two new crash signatures that have similar stack traces, one for 32-bit builds and the other one for 64-bit builds.
32-bit crashes appeared in 4.0b10pre/20110112.
They are #2 and #5 top crasher on Linux in today's build.

Signature	free | nsTArray<nsDisplayListBuilder::PresShellState, nsTArrayDefaultAllocator>::RemoveElementsAt
UUID	2c19e3dc-5f88-4497-b3ab-39d922110113
Time 	2011-01-13 10:54:00.714572
Uptime	3575
Last Crash	4409119 seconds (7.3 weeks) before submission
Install Age	10110 seconds (2.8 hours) since version was first installed.
Product	Firefox
Version	4.0b10pre
Build ID	20110113030355
Branch	2.0
OS	Linux
OS Version	0.0.0 Linux 2.6.35.6-48.fc14.x86_64 #1 SMP Fri Oct 22 15:36:08 UTC 2010 x86_64
CPU	amd64
CPU Info	family 15 model 35 stepping 2
Crash Reason	SIGSEGV
Crash Address	0x7fff42500000

Frame 	Module 	Signature [Expand] 	Source
0 	firefox-bin 	free 	memory/jemalloc/jemalloc.c:4271
1 	libxul.so 	nsTArray<nsDisplayListBuilder::PresShellState, nsTArrayDefaultAllocator>::RemoveElementsAt 	nsTArray.h:373
2 	libxul.so 	nsSubDocumentFrame::BuildDisplayList 	layout/generic/nsSubDocumentFrame.cpp:436
3 	libxul.so 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1761
4 	libxul.so 	DisplayLine 	layout/generic/nsBlockFrame.cpp:6172
5 	libxul.so 	nsBlockFrame::BuildDisplayList 	layout/generic/nsBlockFrame.cpp:6260
6 	libxul.so 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1718
7 	libxul.so 	DisplayLine 	layout/generic/nsBlockFrame.cpp:6172
8 	libxul.so 	nsBlockFrame::BuildDisplayList 	layout/generic/nsBlockFrame.cpp:6260
9 	libxul.so 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1718
...

The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4413ed6ba5a5&tochange=c0e05d518f57

More reports at:
http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=free%20|%20nsTArray%3CnsDisplayListBuilder%3A%3APresShellState%2C%20nsTArrayDefaultAllocator%3E%3A%3ARemoveElementsAt
http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=free%20|%20moz_free%20|%20nsTArray_base%3CnsTArrayDefaultAllocator%3E%3A%3A~nsTArray_base

Comment 1

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

I think this is a dupe of Bug 625247.