Closed Bug 718991 Opened 13 years ago Closed 9 years ago

Crash in nsCSSSelector::Reset

Categories

(Core :: CSS Parsing and Computation, defect)

Product:
Core
Component:
CSS Parsing and Computation
Version:
12 Branch
Platform:
x86
Windows 7
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: scoobidiver, Unassigned)

Details

(Keywords: crash, regression)

Crash Data

It happens in 11.0a2 and 12.0a1. Signature nsRefPtr<nsDocLoader>::~nsRefPtr<nsDocLoader>() | nsCSSSelectorList::`scalar deleting destructor''(unsigned int) More Reports Search UUID ff9d6fd8-52da-4ddc-8319-1ea4f2120118 Date Processed 2012-01-18 00:33:57 Uptime 30630 Last Crash 1.3 days before submission Install Age 8.5 hours since version was first installed. Install Time 2012-01-17 16:03:06 Product Firefox Version 12.0a1 Build ID 20120117031056 Release Channel nightly OS Windows NT OS Version 6.1.7601 Service Pack 1 Build Architecture x86 Build Architecture Info GenuineIntel family 6 model 15 stepping 13 Crash Reason EXCEPTION_ACCESS_VIOLATION_READ Crash Address 0x11c93678 App Notes AdapterVendorID: 0x1002, AdapterDeviceID: 0x9591, AdapterSubsysID: 01461025, AdapterDriverVersion: 8.632.1.2000 D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- EMCheckCompatibility True Frame Module Signature [Expand] Source 0 xul.dll nsRefPtr<nsDocLoader>::~nsRefPtr<nsDocLoader> obj-firefox/dist/include/nsAutoPtr.h:907 1 xul.dll nsCSSSelectorList::`scalar deleting destructor' 2 xul.dll ReleaseObjects obj-firefox/xpcom/build/nsCOMArray.cpp:167 3 xul.dll nsVoidArray::EnumerateForwards obj-firefox/xpcom/build/nsVoidArray.cpp:724 4 xul.dll nsCSSStyleSheetInner::~nsCSSStyleSheetInner layout/style/nsCSSStyleSheet.cpp:904 5 xul.dll nsCSSStyleSheetInner::RemoveSheet layout/style/nsCSSStyleSheet.cpp:923 6 xul.dll nsCSSStyleSheet::~nsCSSStyleSheet layout/style/nsCSSStyleSheet.cpp:1057 7 xul.dll nsCSSStyleSheet::`vector deleting destructor' 8 xul.dll nsCSSStyleSheet::Release layout/style/nsCSSStyleSheet.cpp:1085 9 xul.dll nsTHashtable<nsBaseHashtableET<mozilla::URIAndPrincipalHashKey,nsRefPtr<nsCSSStyleSheet> > >::s_ClearEntry obj-firefox/dist/include/nsTHashtable.h:464 10 xul.dll PL_DHashTableFinish obj-firefox/xpcom/build/pldhash.cpp:410 11 xul.dll mozilla::css::Loader::~Loader layout/style/Loader.cpp:571 12 xul.dll mozilla::css::Loader::Release layout/style/Loader.cpp:574 13 xul.dll nsDocument::~nsDocument content/base/src/nsDocument.cpp:1646 14 xul.dll nsHTMLDocument::~nsHTMLDocument 15 xul.dll nsHTMLDocument::`scalar deleting destructor' 16 xul.dll nsNodeUtils::LastRelease content/base/src/nsNodeUtils.cpp:320 17 xul.dll nsHTMLDocument::Release content/xul/document/src/nsXULDocument.cpp:401 18 xul.dll DoDeferredRelease<nsISupports*> js/xpconnect/src/XPCJSRuntime.cpp:617 19 xul.dll XPCJSRuntime::GCCallback js/xpconnect/src/XPCJSRuntime.cpp:913 20 mozjs.dll js_GC js/src/jsgc.cpp:3183 ... More reports at: https://crash-stats.mozilla.com/report/list?signature=nsRefPtr%3CnsDocLoader%3E%3A%3A~nsRefPtr%3CnsDocLoader%3E%28%29%20|%20nsCSSSelectorList%3A%3A%60scalar%20deleting%20destructor%27%27%28unsigned%20int%29
Crash Signature: [@ nsRefPtr<nsDocLoader>::~nsRefPtr<nsDocLoader>() | nsCSSSelectorList::`scalar deleting destructor''(unsigned int)] → [@ nsRefPtr<nsDocLoader>::~nsRefPtr<nsDocLoader>() | nsCSSSelectorList::`scalar deleting destructor''(unsigned int)] [@ @0x0 | nsRefPtr<nsDocLoader>::~nsRefPtr<nsDocLoader>() | nsCSSSelectorList::`scalar deleting destructor''(unsigned int)]
There's a spike from 12.0a1/20120117 with about 35 crashes per buildID. The regression range for the spike is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=047c8ba7d2e4&tochange=34572943a3e4
Crash Signature: [@ nsRefPtr<nsDocLoader>::~nsRefPtr<nsDocLoader>() | nsCSSSelectorList::`scalar deleting destructor''(unsigned int)] [@ @0x0 | nsRefPtr<nsDocLoader>::~nsRefPtr<nsDocLoader>() | nsCSSSelectorList::`scalar deleting destructor''(unsigned int)] → [@ nsCSSSelectorList::`scalar deleting destructor''(unsigned int)] [@ nsRefPtr<nsDocLoader>::~nsRefPtr<nsDocLoader>() | nsCSSSelectorList::`scalar deleting destructor''(unsigned int)] [@ @0x0 | nsRefPtr<nsDocLoader>::~nsRefPtr<nsDocLoader>() | nsCSSSele…
Summary: Crash @ nsRefPtr<nsDocLoader>::~nsRefPtr<nsDocLoader>() | nsCSSSelectorList::`scalar deleting destructor''(unsigned int) → Crash in nsCSSSelector::Reset
Version: 11 Branch → 12 Branch
Might be connected to bug 718993
It seems to be partially fixed in 12.0a1/20120119. I see one crash in that build: bp-8d5e26b2-7629-4ccb-b808-c863d2120120.
current crashes are along the lines of bp-4ee57f6b-af5b-4648-89d8-44a442121105 TB16 0 xul.dll nsCSSSelector::Reset layout/style/StyleRule.cpp:362 1 xul.dll nsCSSSelector::~nsCSSSelector layout/style/StyleRule.cpp:354 2 xul.dll nsCSSSelectorList::~nsCSSSelectorList layout/style/StyleRule.cpp:861 3 xul.dll nsCSSSelectorList::~nsCSSSelectorList layout/style/StyleRule.cpp:862 4 xul.dll mozilla::css::StyleRule::~StyleRule layout/style/StyleRule.cpp:1308 5 xul.dll mozilla::css::StyleRule::`scalar deleting destructor' 6 xul.dll nsComboButtonListener::Release content/xul/templates/src/nsXULSortService.cpp:41 current firefox crashes are rare, and different stack bp-6eeec1e8-9130-4c1d-bf01-806472121102 FF16
Crash Signature: nsCSSSelector::Reset()] [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsCSSSelector::Reset()] [@ nsCOMPtr_base::~nsCOMPtr_base | nsCSSSelector::Reset] → nsCSSSelector::Reset()] [@ nsCOMPtr_base::assign_assuming_AddRef(nsISupports*) | nsCSSSelector::Reset()] [@ nsCOMPtr_base::~nsCOMPtr_base | nsCSSSelector::Reset] [@ nsCSSSelectorList::`scalar deleting destructor''] [@ nsRefPtr<T>::~nsRefPtr<T> | nsCS…
This spike went away long ago.
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.