632828 - Spike in crashes [@ nsBidiPresUtils::RemoveBidiContinuation(nsIFrame*, int, int, int&) ]

Status: RESOLVED DUPLICATE of bug 635329

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

It is a residual crash signature that exists in 3.6 and the trunk, but there is a spike in crashes from 4.0b11pre/20110131.
It is #27 top crasher in 4.0b11.

Signature	nsBidiPresUtils::RemoveBidiContinuation(nsIFrame*, int, int, int&)
UUID	a6231c45-3874-4d8d-8318-042472110208
Time 	2011-02-08 23:54:44.919861
Uptime	10077
Install Age	77144 seconds (21.4 hours) since version was first installed.
Product	Firefox
Version	4.0b12pre
Build ID	20110207030345
Branch	2.0
OS	Windows NT
OS Version	6.1.7600
CPU	x86
CPU Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0xfffffffff0de812f
User Comments	
App Notes 	AdapterVendorID: 1002, AdapterDeviceID: 9553, AdapterDriverVersion: 8.56.1.15

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsBidiPresUtils::RemoveBidiContinuation 	layout/base/nsBidiPresUtils.cpp:1217
1 	xul.dll 	nsBidiPresUtils::Resolve 	layout/base/nsBidiPresUtils.cpp:531
2 	xul.dll 	nsBlockFrame::Reflow 	
3 	xul.dll 	nsBlockReflowContext::ReflowBlock 	layout/generic/nsBlockReflowContext.cpp:297
4 	xul.dll 	nsBlockFrame::ReflowBlockFrame 	layout/generic/nsBlockFrame.cpp:3184
5 	xul.dll 	nsBlockFrame::ReflowLine 	layout/generic/nsBlockFrame.cpp:2506
6 	xul.dll 	nsBlockFrame::ReflowDirtyLines 	layout/generic/nsBlockFrame.cpp:1999
7 	xul.dll 	nsBlockFrame::Reflow 	layout/generic/nsBlockFrame.cpp:1080
8 	xul.dll 	nsBlockReflowContext::ReflowBlock 	layout/generic/nsBlockReflowContext.cpp:297
9 	xul.dll 	nsBlockFrame::ReflowBlockFrame 	layout/generic/nsBlockFrame.cpp:3184
10 	xul.dll 	nsBlockFrame::ReflowLine 	layout/generic/nsBlockFrame.cpp:2506
11 	xul.dll 	nsBlockFrame::ReflowDirtyLines 	layout/generic/nsBlockFrame.cpp:1999
12 	xul.dll 	nsBlockFrame::Reflow 	layout/generic/nsBlockFrame.cpp:1080
13 	xul.dll 	nsContainerFrame::ReflowChild 	layout/generic/nsContainerFrame.cpp:740
14 	xul.dll 	nsCanvasFrame::Reflow 	layout/generic/nsCanvasFrame.cpp:494
15 	xul.dll 	nsContainerFrame::ReflowChild 	layout/generic/nsContainerFrame.cpp:740
16 	xul.dll 	nsHTMLScrollFrame::ReflowScrolledFrame 	layout/generic/nsGfxScrollFrame.cpp:533
17 	xul.dll 	nsHTMLScrollFrame::ReflowContents 	layout/generic/nsGfxScrollFrame.cpp:625
18 	xul.dll 	nsHTMLScrollFrame::Reflow 	layout/generic/nsGfxScrollFrame.cpp:866
19 	xul.dll 	nsContainerFrame::ReflowChild 	layout/generic/nsContainerFrame.cpp:740
20 	xul.dll 	ViewportFrame::Reflow 	layout/generic/nsViewportFrame.cpp:293
21 	xul.dll 	PresShell::DoReflow 	layout/base/nsPresShell.cpp:7849
22 	xul.dll 	PresShell::ProcessReflowCommands 	layout/base/nsPresShell.cpp:7988
23 	xul.dll 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:4897
24 	xul.dll 	nsDocument::FlushPendingNotifications 	content/base/src/nsDocument.cpp:6448
25 	xul.dll 	nsGenericElement::GetPrimaryFrame 	content/base/src/nsGenericElement.cpp:3761
26 	xul.dll 	nsGenericElement::GetStyledFrame 	content/base/src/nsGenericElement.cpp:1479
27 	xul.dll 	nsGenericHTMLElement::GetOffsetRect 	content/html/content/src/nsGenericHTMLElement.cpp:512
28 	xul.dll 	nsGenericHTMLElement::GetOffsetHeight 	content/html/content/src/nsGenericHTMLElement.cpp:655
29 	xul.dll 	nsIDOMNSHTMLElement_GetOffsetHeight 	obj-firefox/js/src/xpconnect/src/dom_quickstubs.cpp:20774
30 	mozjs.dll 	js::Shape::get 	js/src/jsscopeinlines.h:264
31 	mozjs.dll 	js_GetProperty 	js/src/jsobj.cpp:5454
32 	mozjs.dll 	js::mjit::ic::GetProp 	js/src/methodjit/PolyIC.cpp:1692
33 	mozjs.dll 	js::CopyInitializerObject 	js/src/jsobjinlines.h:1169
34 	mozjs.dll 	js::mjit::stubs::NewInitObject 	js/src/methodjit/StubCalls.cpp:1314
35 	xul.dll 	xpcObjectHelper::~xpcObjectHelper 	
36 	mozjs.dll 	js::mjit::EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:748
37 	mozjs.dll 	CheckStackAndEnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:774
38 	mozjs.dll 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:791
39 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:637
40 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:720
41 	mozjs.dll 	js::ExternalInvoke 	js/src/jsinterp.cpp:841
42 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5048
43 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1701
44 	xul.dll 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:588
45 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114
46 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141
47 	xul.dll 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:1127

A possible regression range for the spike could be:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=336d5906cb0f&tochange=732a38102733

More reports at:
https://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=nsBidiPresUtils%3A%3ARemoveBidiContinuation%28nsIFrame*%2C%20int%2C%20int%2C%20int%26%29

Comment 1

[Jesse Ruderman]

Bug 635329 has a testcase that causes a crash with the same signature.

Comment 2

[Simon Montagu :smontagu]

No crashes on crash-stats with build ID later than 2011-02-21 - fixed by bug 635329