630517 - Crash [@ nsGenericElement::GetScrollFrame(nsIFrame**) ]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Scoobidiver (away)]

It is a residual crash signature that exists in the trunk but there is a spike in crashes from 4.0b11pre/20110130.
It is #25 top crasher in 4.0b11pre over the last 3 days.

Signature	nsGenericElement::GetScrollFrame(nsIFrame**)
UUID	81ca935f-2789-4005-8d86-4150f2110201
Time 	2011-02-01 03:38:04.26792
Uptime	739
Last Crash	61544 seconds (17.1 hours) before submission
Install Age	51907 seconds (14.4 hours) since version was first installed.
Product	Firefox
Version	4.0b11pre
Build ID	20110131064745
Branch	2.0
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
CPU	x86
CPU Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	AdapterVendorID: 8086, AdapterDeviceID: 2a42, AdapterDriverVersion: 8.15.10.1892

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsGenericElement::GetScrollFrame 	content/base/src/nsGenericElement.cpp:1512
1 	xul.dll 	nsGenericElement::GetClientAreaRect 	content/base/src/nsGenericElement.cpp:1681
2 	xul.dll 	nsGenericElement::GetClientWidth 	content/base/src/nsGenericElement.h:716
3 	xul.dll 	nsNSElementTearoff::GetClientWidth 	content/base/src/nsGenericElement.cpp:1723
4 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
5 	xul.dll 	XPC_WN_GetterSetter 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1643
6 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:700
7 	mozjs.dll 	js::ExternalInvoke 	js/src/jsinterp.cpp:858
8 	mozjs.dll 	js::ExternalGetOrSet 	js/src/jsinterp.cpp:898
9 	mozjs.dll 	js::JSProxyHandler::get 	js/src/jsproxy.cpp:131
10 	xul.dll 	xpc::XrayWrapper<JSCrossCompartmentWrapper>::get 	js/src/xpconnect/wrappers/XrayWrapper.cpp:756
11 	mozjs.dll 	js::JSProxy::get 	js/src/jsproxy.cpp:787
12 	mozjs.dll 	js::proxy_GetProperty 	js/src/jsproxy.cpp:904
13 	mozjs.dll 	InlineGetProp 	js/src/methodjit/StubCalls.cpp:1910
14 	mozjs.dll 	js::mjit::stubs::GetProp 	js/src/methodjit/PolyIC.cpp:1870
15 	mozjs.dll 	js::mjit::EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:748
16 	mozjs.dll 	CheckStackAndEnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:774
17 	mozjs.dll 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:791
18 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:654
19 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:737
20 	mozjs.dll 	js::ExternalInvoke 	js/src/jsinterp.cpp:858
21 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5076
22 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1701
23 	xul.dll 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:588
24 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114
25 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141
26 	xul.dll 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:1114

The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=94a51a3b64d4&tochange=336d5906cb0f

More reports at:
https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=nsGenericElement%3A%3AGetScrollFrame%28nsIFrame**%29

Comment 1

[Sheila Mooney]

Only 3 crashes on Beta10 in the past week. Volume is higher on the trunk - ~28 in the past week. There was spike on the trunk, perhaps due to some checkin. Might be worth a bit of investigation.

Comment 2

[Mike Beltzner [:beltzner, not reading bugmail]]

Please renominate if the volume increases.

Comment 3

[Scoobidiver (away)]

It is #5 top crasher in 4.0b11.

Comment 4

[Sheila Mooney]

This is increasing. Comments mention Farmville, Mafia Wars and other Facebook apps. I think it warrants some investigation. We only had 10 of these over several weeks for Beta10. For Beta11, we have over 1300 in the past week and we haven't even ramped up to full usage.

Comment 5

[Marcia Knous [:marcia]]

I will investigate this bug with my Farmville account.

Comment 6

[Marcia Knous [:marcia]]

Pretty high correlation to Adblock Plus, so that may be a significant factor in trying to reproduce this bug.

95% (584/614) vs.  13% (5045/38786) {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} (Adblock Plus, https://addons.mozilla.org/addon/1865)
13% (80/614) vs.   4% (1542/38786) {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} (Download Statusbar, https://addons.mozilla.org/addon/26)
14% (85/614) vs.   5% (2058/38786) {b9db16a4-6edc-47ec-a1f4-b86292ed211d} (Video DownloadHelper, https://addons.mozilla.org/addon/3006)
22% (134/614) vs.  13% (5196/38786) {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
8% (50/614) vs.   0% (193/38786) {20cc25e2-48c9-45e1-9a1f-1ccc1882b81b}
10% (60/614) vs.   3% (1043/38786) {e4a8a97b-f2ed-450b-b12d-ee082ba24781} (Greasemonkey, https://addons.mozilla.org/addon/748)
98% (602/614) vs.  91% (35453/38786) {972ce4c6-7e08-4474-a285-3208198ce6fd} (Default, https://addons.mozilla.org/addon/8150)
7% (46/614) vs.   2% (632/38786) {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} (WOT, https://addons.mozilla.org/addon/3456)

Comment 7

[Marcia Knous [:marcia]]

Haven't yet been able to reproduce with the crash with an advanced Farmville account.

Currently ranked #3 in B11 stats with almost 3K in crashes.

Comment 8

[Mike Shaver (:shaver emeritus)]

This needs an assignee.  roc: can you help find one?

Comment 9

[Mike Shaver (:shaver emeritus)]

Welp, #3 is a hardblocker, esp as a regression from b10.

Comment 10

[Olli Pettay [:smaug][[e-mail]]]

This should be fixed by bug 614347.

Comment 11

[Mike Shaver (:shaver emeritus)]

Bug 614347 landed tonight, shall we close it or leave for crash stats to tell the tale in 48 hours?