629982 - Constant crashes (possibly) due to recent nightly build changes [@ nsGenericElement::GetBaseURI()]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Ron]

User-Agent:       Mozilla/5.0 (Windows NT 6.1; rv:2.0b11pre) Gecko/20110129 Firefox/4.0b11pre
Build Identifier: Mozilla/5.0 (Windows NT 6.1; rv:2.0b11pre) Gecko/20110129 Firefox/4.0b11pre

Sorry, but I have to be real fast in writing this bug as Minefield has already crashed during one attempt of trying to post this issue.
Unfortunately, I can't give many details, but the following crash reports may help:
Report ID
        Date Submitted
      
    
    
    bp-89345f2e-37cf-4269-b78f-b2c73211012930/01/201108:37bp-3c9f343f-5958-4652-8a90-63239211012930/01/201108:29bp-749dde1e-3f1c-4107-9fee-cfc8f211012930/01/201108:21bp-73f1be98-4cc6-42eb-9ea2-06c02211012930/01/201101:09bp-2119a058-bc65-457e-8a87-13dac211012930/01/201100:57bp-be3797b0-9507-4096-9b7b-41951211012930/01/201100:51bp-24cdb9b2-e6e0-40f0-b978-045a7211012930/01/201100:42bp-79e7684c-9e5f-4cd7-bde9-1c417211012829/01/201101:11bp-de4bb29e-f361-4314-993d-88bfa211012222/01/201119:39bp-43d880d1-702b-4d21-a629-ceb83211012222/01/201119:338a30a791-3d05-4f23-a9b0-74c187c2dd9b22/01/201119:27bp-5df64f82-68bf-4dd1-b35f-5ce88211012222/01/201119:21

I apologize for the disarray of the report, I just want to make sure it's posted before another crash happens.

Feel free to contact me for further details.

Reproducible: Always

Comment 1

[Ron]

Attachment: Crash Reports

The whole crash reports file. Managed to save it before (yet another) crash. Using Chrome to upload it :-/

Comment 2

[timeless]

Comment on attachment 508211 [details]
Crash Reports

bp-37567f44-b90a-4d02-8952-273472110130	30/01/2011	10:36
bp-cf913bcb-48b8-4ee0-8714-875a32110130	30/01/2011	10:29
bp-2f4c6a31-b259-40a3-b5e8-a5e8d2110129	30/01/2011	08:49
bp-89345f2e-37cf-4269-b78f-b2c732110129	30/01/2011	08:37
bp-3c9f343f-5958-4652-8a90-632392110129	30/01/2011	08:29
bp-749dde1e-3f1c-4107-9fee-cfc8f2110129	30/01/2011	08:21
bp-73f1be98-4cc6-42eb-9ea2-06c022110129	30/01/2011	01:09
bp-2119a058-bc65-457e-8a87-13dac2110129	30/01/2011	00:57
bp-be3797b0-9507-4096-9b7b-419512110129	30/01/2011	00:51
bp-24cdb9b2-e6e0-40f0-b978-045a72110129	30/01/2011	00:42
bp-79e7684c-9e5f-4cd7-bde9-1c4172110128	29/01/2011	01:11
bp-de4bb29e-f361-4314-993d-88bfa2110122	22/01/2011	19:39
bp-43d880d1-702b-4d21-a629-ceb832110122	22/01/2011	19:33
8a30a791-3d05-4f23-a9b0-74c187c2dd9b	22/01/2011	19:27
bp-5df64f82-68bf-4dd1-b35f-5ce882110122	22/01/2011	19:21
bp-b709cd2c-235c-487c-a24a-e8fbf2110122	22/01/2011	17:47
bp-1eea364d-4196-43ed-9773-50b242110122	22/01/2011	15:35
bp-c3cb2475-3128-4f5f-b8fe-8bb0d2110115	15/01/2011	11:57
bp-29c15bbf-6d76-4fc5-859c-3ec742110112	12/01/2011	22:13
bp-f18103c8-1983-4a7f-a9e6-757c52110111	11/01/2011	15:27
bp-cf487e0e-57fa-4f36-9442-0c97e2110111	11/01/2011	10:00
bp-2067b372-3562-4703-84b2-b10072110106	06/01/2011	11:02
bp-f7cd8e45-2ef0-40f5-9309-fde2b2101206	06/12/2010	10:27
d9ef4640-3a05-4ce9-81b8-d0f20b612219	05/12/2010	20:42
bp-6e422ca2-c20b-4a13-ab30-142772101205	05/12/2010	20:31
bp-f7627f05-4019-49da-8943-a78b52101204	04/12/2010	12:49
bp-1849699c-06b3-4eb4-848d-d4d3c2101124	25/11/2010	09:41
bp-2db78e6e-c233-4d78-83f7-e5e852101123	23/11/2010	21:48
9e21e5f6-5c38-420f-86a3-a8bac2f3da9c	23/11/2010	14:08
bp-95b254dd-5284-4fe4-b4c8-c4f1e2101116	16/11/2010	17:46
bp-462409d5-4796-427f-b588-93efa2101116	16/11/2010	16:55
bp-5516aea3-61ec-4c55-a2a0-352852101116	16/11/2010	15:55
bp-dfc1f3ce-d6dc-40f7-8179-c28e82101116	16/11/2010	11:46
bp-b561769f-8223-4560-8f6d-9b4812101116	16/11/2010	10:07
bp-604ece6a-7c0a-4c27-aacc-3e8b02101114	15/11/2010	08:57
bp-bed24f60-b456-498c-a706-4d2d22101114	15/11/2010	07:13
bp-d2490212-05e0-42af-80de-008992101113	14/11/2010	08:25
bp-2011b065-e70c-4cda-969c-abcd12101112	13/11/2010	00:43
bp-04e49358-b27e-488e-9255-482982101112	13/11/2010	00:34
bp-579de37f-ce94-4bf4-bccc-4f0452101112	13/11/2010	00:31
bp-8007799c-e792-439f-aa23-3a7582101112	12/11/2010	20:32
bp-1ca5a4b6-708d-47f1-a970-8e51b2101112	12/11/2010	15:40
bp-f2940dab-f239-43d1-8931-078fe2101112	12/11/2010	15:29
592c3b53-181e-42ca-8f1b-94990b2848e5	09/11/2010	10:20
bp-3dd3280f-c34f-4591-9148-830502101105	05/11/2010	23:30
bp-9aef8552-42cf-4d68-9d71-ea2802101031	31/10/2010	10:04
8d3a2ffa-b639-40e8-b6e1-fb08adefe146	28/10/2010	23:07
bp-34de883a-6019-41bf-9fa5-9bb332101028	28/10/2010	15:45
bp-ee1f086a-fb4f-4620-9a43-bd67e2101028	28/10/2010	14:50
7d7ef7df-233c-4064-b0f2-bae571646a4e	28/10/2010	11:54
88f4097c-740e-472e-9fdd-f5b864134fef	28/10/2010	11:54
bp-0dd7d88f-8f1f-472e-989a-d4c3a2101028	28/10/2010	11:27
bp-a83c6211-2ed3-47e4-b272-926a32101021	21/10/2010	11:00
bp-05434e4f-b36c-4924-87a3-69da92101021	21/10/2010	10:50
bp-7e443c89-c200-4b7c-88e1-8464a2101019	19/10/2010	10:10
bp-114424e5-00c1-42a1-b362-eceb12101014	15/10/2010	01:22
06162deb-42cb-40e0-9b6a-60e211f1f75a	12/10/2010	21:56
bf24e7e9-8571-434d-a341-951e2eb6b771	26/09/2010	11:46
bp-0df4f403-a6b3-4dc9-868b-ff0e02100918	18/09/2010	10:55
bp-b315ff19-b49c-4381-881c-30d152100917	17/09/2010	19:48
0daf2e3b-85d5-4ca5-b040-230e8bdb8403	16/09/2010	11:01
bp-17ee625d-9e3d-4537-96d7-0b25e2100912	13/09/2010	00:25
bp-b6543e0d-7438-4528-9b78-076b62100907	07/09/2010	19:20
bp-a19f78a6-fd56-4e7b-935c-fa84c2100901	01/09/2010	17:41
bp-f00f5a8c-fb8f-4e6f-86b4-e431a2100831	31/08/2010	16:28
bp-ebe4e37b-f970-4284-b0eb-c38a52100831	31/08/2010	16:20
bp-9892cfa8-0855-4ea1-b3c1-587c02100830	31/08/2010	09:40
7c119d23-2dd2-4cfd-b945-2883868692c5	26/08/2010	09:36
d6e8d068-4690-4403-95ef-8eb18c416c50	26/08/2010	09:36
e2bbbe0c-89e6-423d-bb66-45d4d1469962	26/08/2010	09:36
f5f72f2d-061e-4b65-b36b-d215badc254a	26/08/2010	09:36
f68e6bae-4940-4e3b-977a-bda212364076	26/08/2010	09:36
e275b6cf-b7a9-4e18-b4d4-2476120d6063	26/08/2010	09:36
071c3aa4-711d-4115-bc73-0e00eabc978f	11/08/2010	12:35
4ea5bb0a-551e-4579-86a6-4f02de1c8e4d	02/08/2010	16:20
fd1e33d0-e2b6-4e7f-9496-cefa4ad7a285	17/07/2010	17:09
97e95066-8ca3-4ae2-bf68-cdef407e33ec	05/07/2010	21:31
bc552050-c653-44c1-ab02-d21bf7256623	05/07/2010	21:31
d903c474-da1b-4a98-8439-7aea54bb5946	05/07/2010	21:31
3d74da54-30bb-4e5e-b2e1-04e22421f3be	05/07/2010	21:31
f27afbce-7803-4911-8174-4e301a74c5c1	05/07/2010	21:31
0acba408-9f46-42f1-b5d5-86553788d5e3	05/07/2010	21:31
ca16fb5e-9fa7-4b98-9230-77db0f7486cc	05/07/2010	21:31
f8d0ecdb-88c2-42f0-b7ce-204f1bf864b5	05/07/2010	21:31
5ad7a128-d7a9-4505-b076-65a4eece1e8a	26/06/2010	21:03
90855ba8-286a-4b69-9656-86b0c8e79b82	26/06/2010	21:03
fb4d7610-e5f0-4fc1-bb90-9098956280dc	20/06/2010	21:50
36e31c4b-3885-47cb-98e3-84bc547044ba	13/06/2010	23:52
d20aa71a-0016-4fc8-9450-d3a8ae38b1e0	13/06/2010	23:52
ca6de347-fd6f-4a15-8b6a-f5ed186e10c3	12/06/2010	10:28
6a7f611e-a445-40e0-bc68-c01556f5ea78	12/06/2010	10:28
835e1848-e900-48f6-b50f-fb2a7d4a1e6a	12/06/2010	10:27
352279d8-ea01-4301-9c01-c863aa780bfe	12/06/2010	10:27
cd13f843-f8ac-43e5-bf78-338e6e7681dc	09/06/2010	07:56
3740e974-5fc6-4d06-a1f9-acae173b458d	09/06/2010	07:56
8e0a1c38-5851-4d7d-994b-8f397dcd9c58	21/05/2010	08:36
b631ff44-bd7f-4d37-b066-9e7ce269e810	21/05/2010	08:36
d5aea90b-47dc-45c2-a18d-b9d3275df830	18/05/2010	23:58
8a53872d-2c39-494c-a297-8f54e6ea9416	29/04/2010	18:51
bp-a7d90d48-6391-401c-bfce-de70b2100427	27/04/2010	15:32
bp-0abd1e5a-7a55-4a19-ad09-637ae2100425	25/04/2010	19:14
e889f36a-56d8-4c71-b083-4923ed50e349	25/04/2010	10:55
2dc94af9-c925-43a1-81ea-26b85c3ece8a	25/04/2010	10:55
f62a178f-82bb-4a6e-9ae1-dbc0c85f5629	25/04/2010	10:55
52dfe590-6e82-469f-909a-5bb9e7f9dd9e	25/04/2010	10:55
9217f42f-2efa-4da1-981c-57e959f90482	25/04/2010	10:55
fe8b221d-bae5-4180-83dd-6a1fa98dda73	22/04/2010	11:18
f5d57f76-d0da-4826-9bfa-da3ba032f45b	22/04/2010	11:18
3347391f-915e-4212-b087-3fe870dd08f9	22/04/2010	00:29
294f8239-ab7d-4a63-a570-c30e20c14cff	22/04/2010	00:29
bp-b7bff335-703b-496d-bf4d-900ff2100421	21/04/2010	14:47
bp-77bd37eb-c948-4ba9-b0c6-1e6172100420	21/04/2010	09:08
899ca57b-de7e-4e02-9583-3182377fb536	20/04/2010	00:57
a056eb64-a667-4b20-8a41-bf38aacb1ccf	20/04/2010	00:57
bp-4d70a99f-de37-4972-8d0f-69f242100416	16/04/2010	14:13
4bd16ad1-3c75-49fb-8e11-4a107502f934	16/04/2010	10:30
3171c44a-f9b1-416a-b934-04069da8e6dc	12/04/2010	17:41
5ec96f5f-e3ad-46e3-b8b5-3af8f2628ca7	12/04/2010	14:43
753214de-ea34-406a-95b8-aa6739a981c1	12/04/2010	14:43
be725ba9-5f77-4902-837f-bc08eb2fd604	11/04/2010	14:57
aacfbdb9-36a1-4fda-80d3-2c2e4f594d2d	11/04/2010	14:57
bp-643f8d80-a00e-4209-9efc-dcf872100411	11/04/2010	13:49
bp-ec485d51-e28b-434f-8264-918ea2100410	10/04/2010	17:27
bp-2b6a5aca-ad48-4550-83c2-8327f2100410	10/04/2010	17:25
bp-eb9a3685-7251-4d72-85ed-38f2f2100410	10/04/2010	12:45
bp-22d8b0ac-bc91-4c7a-9a73-c14f52100410	10/04/2010	12:37
bp-33d32a5d-4c7d-48c5-952f-4c00c2100410	10/04/2010	12:33
1aba6a09-7070-4447-a144-b5ed06f73903	09/04/2010	19:11
00e14ad6-71e7-4692-b7e2-317fc136f363	09/04/2010	19:11
bp-fe2bad82-301a-474c-8165-d701f2100408	08/04/2010	20:47
85282ae1-3c09-4f4d-9e3b-eff1f39ac770	06/04/2010	19:20
a5b4bca2-d3bb-48ba-9a2a-166a0dafd6ef	03/04/2010	18:02
7ae6e33a-0628-4df6-8687-a36a608037af	03/04/2010	18:02
40f00819-cae6-4235-ac72-870e8faf1183	03/04/2010	17:04
87f7f5ee-6e51-412c-9dd6-9563b2d1a57e	03/04/2010	17:04
136a504b-6413-4095-b511-33cf3805e13d	03/04/2010	16:13
e5b89f59-3931-426d-bd0b-11182438fb9d	02/04/2010	09:33
237a15b2-eb8f-41b3-8eb4-dbbaf4b191e4	29/03/2010	15:52
991dff3d-6a69-4050-b4bc-15b6564ba922	29/03/2010	15:19
bp-10ed3537-da76-4fe8-8ddc-7e23f2100329	29/03/2010	11:14
338f6ba6-f197-4530-ade8-7d8122009504	29/03/2010	09:53
2f966be1-b9e2-438a-9abe-a3b3236ae8bf	29/03/2010	09:53
a4e0cfc0-fa7b-4527-be7b-9421e53ad11b	29/03/2010	09:48
cc31817c-e62d-4e78-baad-e8b1a20d19a6	29/03/2010	09:48
5fb48e9a-2141-4024-8c00-e059cdd61217	29/03/2010	09:46
8ea10c15-ab22-4b12-8bc4-86d04d046343	29/03/2010	09:46
5ac98166-21b0-4322-9de8-93c02874e9bf	29/03/2010	09:44
81cae8d6-7a75-48db-a110-539cf6586262	29/03/2010	09:44
bp-cefb11f1-be05-4a5d-9bb5-91abf2100329	29/03/2010	09:43
bp-d448cf5e-95c1-453c-869c-394ad2100329	29/03/2010	09:43
71aff008-6a23-47df-a80a-2747576399c5	29/03/2010	09:43
41fa691e-9f93-4c3b-9050-0dae89e38749	29/03/2010	09:43
e40dbe75-d8d3-40f5-832a-8ef8387a039f	29/03/2010	09:42
e2680986-dd5f-4221-b05c-d623218f2b43	29/03/2010	09:42
bp-877845b6-ee8e-4942-9e2b-420d32100328	28/03/2010	22:28
e2b764ff-e3aa-4f9a-8c0f-13b522a56e18	27/03/2010	23:18
bp-38932451-23c1-47b3-bc58-e0ee02100322	22/03/2010	23:58
bp-66724f44-a60e-4c00-845b-11a7e2100321	21/03/2010	17:11
7515d314-3b53-402e-8b87-4e17dae37727	21/03/2010	10:33
d3cbd4f2-f48d-42ce-a2fc-088344643103	20/03/2010	23:05
bp-255db0f1-70df-4631-a476-496542100316	16/03/2010	19:31

Comment 3

[timeless]

Signature	nsGenericElement::GetBaseURI()
UUID	37567f44-b90a-4d02-8952-273472110130
Time 	2011-01-30 00:36:29.925575
Uptime	392
Last Crash	486 seconds (8.1 minutes) before submission
Install Age	35607 seconds (9.9 hours) since version was first installed.
Product	Firefox
Version	4.0b11pre
Crash Reason	EXCEPTION_STACK_OVERFLOW

        * Bug 561874 RESOLVED FIXED [HTML5] 4MB text file crashes Minefield when HTML5 is enabled [@ nsGenericElement::GetBaseURI() ]

Crashing Thread
Frame 	Module 	Signature 	Source
0 	xul.dll 	nsGenericElement::GetBaseURI 	content/base/src/nsGenericElement.cpp:3416
1024 	xul.dll 	nsGenericElement::GetBaseURI 	content/base/src/nsGenericElement.cpp:3416

Extension 	Extension Id 	Version 	Current?
Add-on Compatibility Reporter 	[e-mail] 	0.7 	current
	[e-mail] 	0.4.1 	
	[e-mail] 	1.3.4 	
LastPass Password Manager 	[e-mail] 	1.70.0 	current
TabLang 	[e-mail] 	0.3.2 	current
Test Pilot 	[e-mail] 	1.0.3 	current
ChatZilla 	{59c81df5-4b7a-477b-912d-4e0fdf64e5f2} 	0.9.86 	current
	{5e2f6fce-9590-49c3-946d-6356e68e961f} 	0.0.13 	
	SkipScreen@SkipScreen 	0.5.15bs 	
Siphon - Add-on Synchronizer [beta] 	[e-mail] 	0.9.0 	current
ViewMarks 	{7443739c-bff6-4af0-aea5-7ed29006966c} 	0.9.5 	current
	[e-mail] 	1.0 	
	[e-mail] 	0.7.3 	
Adblock Plus 	{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} 	1.3.3 	current
Greasemonkey 	{e4a8a97b-f2ed-450b-b12d-ee082ba24781} 	0.9.1 	current
	{46551EC9-40F0-4e47-8E18-8E5CF550CFB8} 	1.1 	
Google Redesigned 	{cc85cd4e-5a5b-4eda-a25c-bdaffa93b406} 	0.6 	current
	{972ce4c6-7e08-4474-a285-3208198ce6fd} 	4.0b11pre 	
	[e-mail] 	4 	
	[e-mail] 	2 	
	[e-mail] 	4 	
	[e-mail] 	3 	

please try:
http://support.mozilla.com/en-US/kb/safe%20mode

if that avoids the problem, then please try to figure out which extension is causing the problem (enable only half of your extensions / if that set is ok, pick the other half, if it isn't, pick half of the set)

Comment 4

[Ron]

Thanks for the reply and suggestion.
I had a hunch regarding which extension may be the culprit, and I was right. It's Greasemonkey. I assume it's not the extension that's messing up but rather one or more of the scripts installed with it, but I still need to check exactly which (have a hunch on this one as well).
One thing I can say is that Firefox runs *a lot* faster with Greasemonkey disabled.
I'm not sure whether you'd want me to keep you posted on this one as it is relatively unrelated to FF specifically. Please let me know if you do.

Comment 5

[Boris Zbarsky [:bzbarsky]]

This doesn't look like a parser bug.  

The stacks show very deep recursion, I wonder why that started happening recently.

Ron, if you can reproduce this reliably enough, can you figure out a nightly regression range?

We should consider changing this code to not be recursive too, but I think figuring out why the crashes have suddenly appeared is what this bug should focus on.

Comment 6

[Ron]

Boris, could you please explain what you mean by 'a nightly regression range'? I don't think it should be that difficult to reproduce the problem.

Another thing you should consider is that this is unrelated to a nightly build change, but rather it could be one of the greasemonkey scripts that may have auto-updated itself. I don't know if I can check on that either.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Ron, a "nightly regression range" is just the pair of nightly builds before and after the problem appeared.  That narrows down it down to a one-day set of checkins, after which it's often possible to tell what caused the problem.

That said, I took a closer look at the links in comment 2, and it looks like you've been getting this crash for a good long while (e.g. the August 31, 2010 crashes are the same issue).  So looking for a nightly regression range is not really worth it; there might not be one.

Jonas, what do you think of making this non-recursive?

Comment 8

[Ron]

Boris,
Generally speaking recursion should be avoided if in situations like this, though I'm not sure that it won't lead to an endless loop and eventually reach the same result. If it's a funky userscript that does it, then there isn't much hope there.
As for the crash reports links, while you are correct that I've encountered similar problems in the past, I can definitely say that it's been a very long time since I had as frequent crashes as I do in this instance.
If you want me to try and do the regression range, or specifically find the specific script that causes this issue, please let me know.

Comment 9

[Boris Zbarsky [:bzbarsky]]

If you can find the relevant script, that would be great!

Comment 10

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

I'll take a look at this. If this is just creating a really deep tree then it might be hard to fix properly. If it's creating a cyclic DOM then something's really really wrong.

Comment 11

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

So I looked at the minidump and it appears that what's happening here is simply a very deem DOM tree. There was no sign of the "this" pointed appearing multiple times on the stack.

We probably should add some sort of protection against overly deep DOM trees, though. 

nsGenericElement::GetBaseURI is currently the top #214 crasher. It's quite possible that this signature is particularly common for overly deep DOM trees. Each frame uses 196 bytes on the stack which is respectable, and during the recursion phase we never call out to another function, and thus risk running out of stack space there, which would spread crashes over multiple signatures.

Don't know if it's worth putting deep-DOM-protection into FF4, especially since it risks breaking things if we choose a too shallow limit. But at the very least we can convert the function to be non-recursive.

Comment 12

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Ron: Please do look for the responsible script. It's very likely that even if we fix GetBaseURI to not be recursive, that you'll just run into some other recursive algorithm that will crash you. We have lots of them in gecko.

Comment 13

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Attachment: Debugging notes.

Just some notes I collected while debugging. For posterity.

Comment 14

[Boris Zbarsky [:bzbarsky]]

> Don't know if it's worth putting deep-DOM-protection into FF4

Either you meant FF5, or it's not worth it.

Comment 15

[Ron]

Okay guys, please let me know if there's anything else I can do to help.
I still need to find the menacing script if I want to use greasemonkey's other userscripts.

Comment 16

[Ron]

Unfortunately, so far I haven't been  able to reproduce the problem.

Comment 17

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Attachment: Patch to make us not recurse

This patch will make us not recurse when calculating baseuris. It will hopefully help with crashes, but there's definitely a risk that we'll just move the crashes to some other signature in some other recursive tree-walking algorithm.

Comment 18

[Johnny Stenback (:jst)]

Comment on attachment 511276 [details] [diff] [review]
Patch to make us not recurse

- In content/base/test/file_base_xbl.xml:

\ No newline at end of file

Add a newline.

r=jst

Comment 19

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Checked in

http://hg.mozilla.org/mozilla-central/rev/231109adff31

Ron: This may or may not help with the crashing. If you're still crashing, please attach a few new crash-ids