702999 - crash nsSplittableFrame::RemoveFromFlow

Status: NEW

(Core :: Layout, defect)

Description

[Robert Kaiser]

This bug was filed from the Socorro interface and is 
report bp-3e2d3ab0-4e85-4d03-a6f9-901b12111116 .
============================================================= 

Stack trace:
0 	xul.dll 	nsSplittableFrame::RemoveFromFlow 	layout/generic/nsSplittableFrame.cpp:229
1 	xul.dll 	nsContainerFrame::DestroyFrom 	
2 	xul.dll 	nsCanvasFrame::DestroyFrom 	layout/generic/nsCanvasFrame.cpp:89
3 	xul.dll 	nsContainerFrame::DestroyFrom 	layout/generic/nsContainerFrame.cpp:270
4 	xul.dll 	nsHTMLScrollFrame::DestroyFrom 	layout/generic/nsGfxScrollFrame.cpp:125
5 	xul.dll 	nsContainerFrame::DestroyFrom 	layout/generic/nsContainerFrame.cpp:270
6 	xul.dll 	ViewportFrame::DestroyFrom 	layout/generic/nsViewportFrame.cpp:74
7 	xul.dll 	nsFrameManager::Destroy 	layout/base/nsFrameManager.cpp:258
8 	xul.dll 	PresShell::Destroy 	layout/base/nsPresShell.cpp:1273
9 	xul.dll 	DocumentViewerImpl::DestroyPresShell 	layout/base/nsDocumentViewer.cpp:4332
10 	xul.dll 	nsCOMPtr_base::assign_with_AddRef 	obj-firefox/xpcom/build/nsCOMPtr.cpp:89
11 	xul.dll 	DocumentViewerImpl::Destroy 	layout/base/nsDocumentViewer.cpp:1665
12 	xul.dll 	DocumentViewerImpl::Close 	layout/base/nsDocumentViewer.cpp:1463
13 	xul.dll 	nsDocShell::Destroy 	docshell/base/nsDocShell.cpp:4596
14 	xul.dll 	nsFrameLoader::Finalize 	content/base/src/nsFrameLoader.cpp:570
15 	xul.dll 	nsDocument::MaybeInitializeFinalizeFrameLoaders 	content/base/src/nsDocument.cpp:5485
16 	xul.dll 	nsRunnableMethodImpl<void 	obj-firefox/dist/include/nsThreadUtils.h:345
17 	xul.dll 	nsContentUtils::AddScriptRunner 	content/base/src/nsContentUtils.cpp:4452
18 	xul.dll 	nsDocument::FinalizeFrameLoader 	content/base/src/nsDocument.cpp:5441

Crashes with this signature have been happening at least since 3.5.x according to https://crash-stats.mozilla.com/report/list?signature=nsSplittableFrame%3A%3ARemoveFromFlow%28nsIFrame*%29 but they have a bit of a spike in yesterday's data of 11.0a1 trunk.

Comment 1

[Scoobidiver (away)]

It's #4 top crasher in 11.0a1 over the last 2 days.
The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b51eb4007926&tochange=9ae1d4f44b8b

Comment 2

[Jet Villegas (inactive)]

It looks like a crash on window destruction. Looking for likely suspects from that revision range doesn't show an obvious culprit. Can we get a few URL's to try and repro?

Comment 3

[Marcia Knous [:marcia]]

Here are some URLs:

9 http://www.you-cubez.com/
      8 http://www.neobux.com/m/v/
      7 http://www.facebook.com/logout.php
      6 http://www.clixsense.com/en/ClixGrid
      6 about:blank
      5 http://brightstarhits.com/
      4 https://www.facebook.com/
      3 http://www.facebook.com/?ref=tn_tnmn
      3 http://www.facebook.com/
      2 http://zakeyclix.com/ads.php
      2 http://www.clixsense.com/en/View_Ads
      2 http://www.click-getpaid.com/click.php
      1 wyciwyg://0/http://www.odnoklassniki.ru/yelena.molodkina
      1 wyciwyg://0/http://www.odnoklassniki.ru/
      1 jar:file:///C:/Program%20Files/Mozilla%20Firefox/omni.jar!/chrome/browser/content/browser/aboutHome.xhtml
      1 jar:file:///C:/Arquivos%20de%20programas/Mozilla%20Firefox/omni.jar!/chrome/browser/content/browser/aboutHome.xhtml
      1 http://zone.ni.com/devzone/cda/tut/p/id/3470#toc0
      1 http://zamunda.net/details.php?id=290484
      1 http://zamunda.net/
      1 http://youtube-2-mp3.softonic.it/mac
      1 http://yandex.ru/yandsearch?text=avast+%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE+%D1%80%D1%83%D1%81%D1%81%D0%BA%D0%B0%D1%8F+%D0%B2%D0%B5%D1%80%D1%81%D0%B8%D1%8F&lr=11164
      1 http://www.zaycev.net/pages/5157/515720.shtml
      1 http://www.yupptv.com/tv5_live.html
      1 http://www.youtube.com/watch?v=ymJL3YLBfUg&feature=g-logo
      1 http://www.youtube.com/watch?v=Xs9T_p5tSog&feature=BFa&list=FLQ2XMO3xteltk6MHjfOncOA&lf=plpp_video
      1 http://www.youtube.com/watch?v=V46DRC4dEo4&feature=autoplay&list=PLFA7714E316F2CB06&lf=plpp_video&playnext=11
      1 http://www.youtube.com/watch?v=tNa-Y2AkII8&feature=related
      1 http://www.youtube.com/watch?v=suC3VGPk9zE
      1 http://www.youtube.com/watch?v=PtqqMchhUkw
      1 http://www.youtube.com/watch?feature=endscreen&NR=1&v=NXPNyZqJ0Ho
      1 http://www.youtube.com/?gl=RU&hl=ru
      1 http://www.you-cubez.com/login.php
      1 http://www.you-cubez.com/adclick.php?id=47688&xdi=c32d9bf2
      1 http://www.you-cubez.com/adclick.php?id=47602&xdi=31839b03&msg=1
      1 http://www.yallakora.com/
      1 http://www.xscores.com/soccer/Results.jsp?sport=1&result=5&countryName=GERMANY&leagueCup=L&leagueName=2.%20BUNDESLIGA&seasonName=2011%2F2012&lcol=true
      1 http://www.wyspagier.pl/gry/gry-przygodowe/ben10_ben10_samurai.html
      1 http://www.wstarmls.com/public/search/advanced/shell-psearch1.asp
      1 http://www.wer-kennt-wen.de/logout/
      1 http://www.vounessa.com.br/musica/alfabetoTema.asp?opcao=1&idTema=1
      1 http://www.videzoo.com/video/198/boquete-animal
      1 http://www.tumblr.com/reblog/13853502252/JXX6Fzi9?redirect_to=%2Fdashboard%2F3%2F13853508021%3Flite
      1 http://www.tube8.com/search.html?q=huge
      1 http://www.trias-uhren.de/js/fontis/fckeditor/editor/fckeditor.html?InstanceName=short_description&Toolbar=Custom
      1 http://www.taggedsimilar.com/music/1024064.html
      1 http://www.swiatseriali.pl/seriale/pierwsza-milosc-390/odcinki,nPack,57
      1 http://www.spiegel.de/fotostrecke/fotostrecke-75855-2.html
      1 http://www.specsavers.nl/brillen/fashion/?page=11&product_type=frame&category=fashion
      1 http://www.soszow.pl/
      1 http://www.shopping.com/bose-speakers/products
      1 http://www.shisha-shop.de/Tower
      1 http://www.searchqu.com/406
      1 http://www.revistasvip.com/m/post/sandrinha_barbie_sex_appeal
      1 http://www.realjailbaitgirls.com/cgi-bin/atc/out.cgi?id=25&u=http://www.streetcandidyouth.com
      1 http://www.race-dezert.com/home/7-months-to-win-25110.html
      1 http://www.przepis-kulinarny.pl/ciasto-zebra-id1074.html
      1 http://www.pix4pix.net/
      1 http://www.pipam.org/FORUM/THREADS.php
      1 http://www.paynize.com/?r
      1 http://www.orkut.com/FriendsList?uid=1050307989577504406&pno=10
      1 http://www.orkut.com.br/
      1 http://www.orkut.com.br/Home
      1 http://www.orkut.com.br/ads/gen/afci005.html#google_ad_width=300&google_ad_height=250&google_image_size=300x250&google_ad_format=300x250_as_new&google_color_border=ffffff&google_color_bg=ffffff&google_color_text=000000&google_color_link=3767be&google_ad_c
      1 http://www.on-libertine.com/enligne.php
      1 http://www.odnoklassniki.ru/cdk/st.cmd/main/tkn/4304
      1 http://www.nycodem.net/nycotv/video.php?id=1527
      1 http://www.netshoes.com.br/busca/index.jsp?q=adidas&_i=1006&qfh_ft=1016%3Acat60002%3A1006%3A41&qfh_rct=3681501294&trail=1016%3Acat60002%3A1006%3A41&brnd=1002:&catName=all_categories&pageNo=1&pageIndex=1&tUrl=/busca/index.jsp&ignt=false&minPrice=8&maxPrice
      1 http://www.neopets.com/objects.phtml?type=inventory
      1 http://www.neobux.com/
      1 http://www.museumsurplus.com/RomanRepublicCoinsPAGE1.htm
      1 http://www.motorsport-total.com/f1/news/2011/12/Die_Formel-1-Teams_im_Winter-Finanzcheck_2011_11121011.html
      1 http://www.milliyet.com.tr/2011/12/03/index.html
      1 http://www.mandrakegames.com.br/jogosde.php?cod=30&cat=31
      1 http://www.livescore.com/
      1 http://www.linkomanija.net/download.php?id=194215&name=Welcome.to.the.Rileys.2010.BDRp.XviD.AC3.LT.EN%7EKinoFanas.torrent
      1 http://www.lembaga.us/2011/12/7-keajaiban-dunia-dalam-pandangan-islam.html
      1 http://www.kurir-info.rs/search/
      1 http://www.khanapakana.com/pakistani-urdu-recipes/urdu-recipes.aspx
      1 http://www.kaufmich.com/favorites/manage
      1 http://www.kaliteavcisi.com/?p=4575
      1 http://www.jogoscelular.net/jogos-para-celular-nokia-c3-como-baixar-e-instalar/
      1 http://www.isac.gov.in/CentralOCB/Page2
      1 http://www.intv.ru/view/?film_id=88652
      1 http://www.instapaper.com/e2?url=http%3A%2F%2Fwww.the-ebook.org%2F%3Fp%3D9909&title=Nook%20Tablet%3A%20%D0%BE%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D1%80%D1%8B%D0%BD%D0%BE%D1%87%D0%BD%D0%BE%D0%B9%20%D1%81%D1%82%D1%80%D0%B0%D1%82%D0%B5%D
      1 http://www.indiaglitz.com/channels/hindi/events/31034.html
      1 http://www.india-forums.com/celebrity/2738/anushka-sharma/
      1 http://www.imagebam.com/image/ab0688164235270
      1 http://www.icralik.com/ihaleArama.asp
      1 http://www.heroeswm.ru/roulette.php
      1 http://www.gutefrage.net/media/fragen-antworten/bilder/4961347/0_big.jpg
      1 http://www.google.fr/
      1 http://www.goear.com/search/Ler-Nante/
      1 http://www.gamegol.com.br/_equipe/treinamentoJogadores.asp?TipoTreino=2
      1 http://www.free18tube.com/categories
      1 http://www.flash-mob-video.com/video/rE74Xg6gOqI/FMDB-Flash-Mob-Dance-Bruxelles-Noel-17-dcembre-Chorgraphie-Complte.html

Comment 4

[Ada [:adalucinet]]

Mozilla/5.0 (Windows NT 5.1; rv:24.0) Gecko/20130805 Firefox/24.0
Mozilla/5.0 (Windows NT 5.1; rv:25.0) Gecko/20100101 Firefox/25.0

Couldn't reproduce on latest Nightly (Build ID: 20130805030205) and Aurora (Build ID: 20130805004006) with URLs from comment 3.

Although, in Socorro there are some crashes with this signature for latest builds:
https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&reason_type=contains&date=2013-08-05&range_value=14&range_unit=days&hang_type=any&process_type=any&signature=nsSplittableFrame%3A%3ARemoveFromFlow%28nsIFrame%2A%29#reports

Any thoughts?

Comment 5

[Ada [:adalucinet]]

Mozilla/5.0 (Windows NT 5.1; rv:25.0) Gecko/20100101 Firefox/25.0
Mozilla/5.0 (Windows NT 5.1; rv:26.0) Gecko/20100101 Firefox/26.0
Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0

Could not reproduce with FF 25 beta 2 (Build ID:20130923194050), latest Aurora (Build ID:20130924004001) and Nightly (Build ID:20130924030202) with URLs from comment 3 nor comments from crash reports.

Crashes with this signature are still present in Socorro for the latest builds: http://goo.gl/H1q4rR
Any thoughts?

Comment 6

[Ioana (away)]

Please re-add the qawanted keyword if you can offer more details for QA to work with.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'nsSplittableFrame::RemoveFromFlow':
 - nightly (version 50): 0 crash from 2016-06-06.
 - aurora  (version 49): 2 crashes from 2016-06-07.
 - beta    (version 48): 54 crashes from 2016-06-06.
 - release (version 47): 141 crashes from 2016-05-31.
 - esr     (version 45): 6 crashes from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          0          0          0          0          0          0
 - aurora           0          0          0          0          1          0          0
 - beta             8         10          5          7         12          7          2
 - release         15         23         21         13         27         23          6
 - esr              3          1          0          1          0          0          0

Affected platforms: Windows, Mac OS X, Linux

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'nsSplittableFrame::RemoveFromFlow':
 - nightly (version 51): 1 crash from 2016-08-01.
 - aurora  (version 50): 0 crashes from 2016-08-01.
 - beta    (version 49): 20 crashes from 2016-08-02.
 - release (version 48): 21 crashes from 2016-07-25.
 - esr     (version 45): 9 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       1       0       0
 - aurora        0       0       0
 - beta          2       8       4
 - release       3       8       4
 - esr           0       0       1

Affected platforms: Windows, Mac OS X

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora
 - beta    #2778     #877
 - release #2302
 - esr     #2545

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 15 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.