666039 - crash nsCOMPtr_base::assign_with_AddRef

Status: RESOLVED DUPLICATE of bug 662628

(Firefox :: Tabbed Browser, defect)

Description

[Justin Dow [:jabba]]

This bug was filed from the Socorro interface and is 
report bp-7c43b93e-f5cb-4aa0-bca9-1fc632110621 .
============================================================= 
I'm running OSX Lion developer preview and twice today, while closing tabs using the middle mouse button, Firefox crashed. This seems to have started after upgrading to Firefox 5 this morning. I updated by using the Firefox -> About Firefox mechanism.

Comment 1

[Marcia Knous [:marcia]]

Justin: Which 10.7 seed are you running, and can you reproduce this crash? 

Frame 	Module 	Signature [Expand] 	Source
0 	XUL 	nsCOMPtr_base::assign_with_AddRef 	xpcom/glue/nsCOMPtr.h:479
1 	XUL 	nsCSSSelector::Reset 	
2 	XUL 	nsCSSSelector::~nsCSSSelector 	layout/style/StyleRule.cpp:350
3 	XUL 	nsCSSSelector::~nsCSSSelector 	layout/style/StyleRule.cpp:354
4 	XUL 	mozilla::css::StyleRule::~StyleRule 	layout/style/StyleRule.cpp:354
5 	XUL 	mozilla::css::Rule::Release 	layout/style/nsCSSRules.cpp:87
6 	XUL 	ReleaseObjects 	nsCOMArray.cpp:148
7 	XUL 	nsVoidArray::EnumerateForwards 	nsVoidArray.cpp:724
8 	XUL 	nsCOMArray_base::~nsCOMArray_base 	nsCOMArray.cpp:158
9 	XUL 	nsCSSStyleSheetInner::~nsCSSStyleSheetInner 	
10 	XUL 	nsCSSStyleSheetInner::RemoveSheet 	layout/style/nsCSSStyleSheet.cpp:908
11 	XUL 	nsCSSStyleSheet::~nsCSSStyleSheet 	layout/style/nsCSSStyleSheet.cpp:1061
12 	XUL 	nsCSSStyleSheet::Release 	layout/style/nsCSSStyleSheet.cpp:1089
13 	XUL 	nsTHashtable<nsBaseHashtableET<mozilla::URIAndPrincipalHashKey, nsRefPtr<nsCSSStyleSheet> > >::s_ClearEntry 	
14 	XUL 	PL_DHashTableFinish 	pldhash.c:399
15 	XUL 	mozilla::css::Loader::Release 	layout/style/Loader.cpp:477
16 	XUL 	nsContentSink::~nsContentSink 	nsAutoPtr.h:969
17 	XUL 	nsHtml5TreeOpExecutor::~nsHtml5TreeOpExecutor 	parser/html/nsHtml5TreeOpExecutor.cpp:104
18 	XUL 	nsContentSink::Release 	content/base/src/nsContentSink.cpp:161
19 	XUL 	nsXPCOMCycleCollectionParticipant::Unroot 	nsCycleCollectionParticipant.cpp:74
20 	XUL 	nsCycleCollector::CollectWhite 	xpcom/base/nsCycleCollector.cpp:1930
21 	XUL 	nsCycleCollector::FinishCollection 	xpcom/base/nsCycleCollector.cpp:2714
22 	XUL 	nsCycleCollector_collect 	xpcom/base/nsCycleCollector.cpp:3358
23 	XUL 	nsJSContext::CycleCollectNow 	dom/base/nsJSEnvironment.cpp:3269
24 	XUL 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:424
25 	XUL 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:520
26 	XUL 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:618
27 	XUL 	NS_ProcessPendingEvents_P 	nsThreadUtils.cpp:200
28 	XUL 	nsBaseAppShell::NativeEventCallback 	widget/src/xpwidgets/nsBaseAppShell.cpp:130
29 	XUL 	nsAppShell::ProcessGeckoEvents 	widget/src/cocoa/nsAppShell.mm:399
30 	CoreFoundation 	CoreFoundation@0x12590 	
31 	CoreFoundation 	CoreFoundation@0x11dfc 	
32 	CoreFoundation 	CoreFoundation@0x38aa8 	
33 	CarbonCore 	CarbonCore@0x17bcb 	
34 	XUL 	SelectorMatches 	layout/style/nsCSSRuleProcessor.cpp:1152
35 	XUL 	nsEventTargetChainItem::HandleEventTargetChain 	nsCOMPtr.h:492
36 	libsystem_c.dylib 	libsystem_c.dylib@0x6b061 	
37 	libsystem_c.dylib 	libsystem_c.dylib@0x6b02e 	
38 	libsystem_c.dylib 	libsystem_c.dylib@0x4d46f 	
39 	XUL 	nsRuleNode::WalkRuleTree 	layout/style/nsRuleNode.cpp:1818
40 	libsystem_c.dylib 	libsystem_c.dylib@0x4d46f

Comment 2

[Marcia Knous [:marcia]]

I see you are running 11A494a. https://crash-stats.mozilla.com/report/list?signature=nsCOMPtr_base::assign_with_AddRef%20|%20nsCSSSelector::Reset indicates the lion's share of crashes are people running 10.7.

Comment 3

[Justin Dow [:jabba]]

Yes, it is the latest developer preview. I can't seem to reproduce right now, but both times it happened today was when I had around 30 tabs open and closed about 10 of them rapidly.

Comment 4

[Justin Dow [:jabba]]

Firefox just crashed again. Nothing has changed since comment 3. Again, I was rabidly closing many tabs, this time using the little x on the tab itself, after closing about half of my open tabs, Firefox crashed. Here is the crash report:

https://crash-stats.mozilla.com/report/index/d1aad045-7169-4cde-bc0d-bfebb2110701

Comment 5

[Marcia Knous [:marcia]]

This looks suspiciously close to Bug 662628 as far as the stacks, and your last crash is the same stack as that bug. I am going to dupe it to that bug and I will mention that you have seen it happen while closing tabs using the "x."