738653 - crash in nsPurpleBuffer::RemoveSkippable

Status: NEW

(Core :: XPCOM, defect)

Description

[Scoobidiver (away)]

It's #63 top browser crasher in 12.0b1.

It first appeared in 12.0a1/20120131. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e33539a90ae2&tochange=3f26b7bee352
It's likely a regression from bug 721548.
It appeared for the last time in 13.0a1/20120305. The working range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=433cfbd2a0da&tochange=7d0d1108a14e

Signature 	nsPurpleBuffer::RemoveSkippable() More Reports Search
UUID	360ce4b8-aaa1-41ba-bdf3-d71d22120322
Date Processed	2012-03-22 23:32:53
Uptime	446
Last Crash	2.0 days before submission
Install Age	4.9 days since version was first installed.
Install Time	2012-03-18 01:25:06
Product	Firefox
Version	12.0
Build ID	20120314195616
Release Channel	beta
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 6 model 8 stepping 1
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0xffffffffe910244c
App Notes 	
AdapterVendorID: 0x1039, AdapterDeviceID: 0x6330, AdapterSubsysID: 1b131019, AdapterDriverVersion: 6.14.10.3780
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- 
EMCheckCompatibility	True
Total Virtual Memory	2147352576
Available Virtual Memory	1931657216
System Memory Use Percentage	39
Available Page File	1138757632
Available Physical Memory	797769728

Frame 	Module 	Signature [Expand] 	Source
0 		@0xe910244c 	
1 	xul.dll 	nsPurpleBuffer::RemoveSkippable 	xpcom/base/nsCycleCollector.cpp:1953
2 	xul.dll 	nsCycleCollector::ForgetSkippable 	xpcom/base/nsCycleCollector.cpp:2007
3 	xul.dll 	CCTimerFired 	dom/base/nsJSEnvironment.cpp:3364
4 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:428
5 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:524
6 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:657
7 	nspr4.dll 	PR_Unlock 	nsprpub/pr/src/threads/combined/prulock.c:347
8 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:201
9 	xul.dll 	_SEH_epilog4 	
10 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:175
11 	xul.dll 	mozilla::storage::AsyncStatement::getAsynchronousStatementData 	storage/src/mozStorageAsyncStatement.cpp:368
12 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:189
13 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:258
14 		@0x64cfffff 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsPurpleBuffer%3A%3ARemoveSkippable%28%29

Comment 1

[Andrew McCreight [:mccr8]]

When I looked at these before, they all looked like existing cycle collector crashes.  For instance, that crash linked here is in canonicalize.  I think this function is just causing crashes to happen a few seconds earlier, with a different stack.  If they are not present in 13 or 14, that is probably because I added a bunch of MOZ_NEVER_INLINE statements so they will show up in canonicalize or somewhere else.

Comment 2

[Phil Ringnalda (:philor)]

https://tbpl.mozilla.org/php/getParsedLog.php?id=13301582&tree=Mozilla-Inbound

Comment 3

[Wayne Mery (:wsmwk)]

(In reply to Andrew McCreight [:mccr8] from comment #1)
> If they are not present in 13 or 14, that is probably
> because I added a bunch of MOZ_NEVER_INLINE statements so they will show up
> in canonicalize or somewhere else.

Indeed there are none after firefox 12.

Comment 4

[Scoobidiver (away)]

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsPurpleBuffer%3A%3ARemoveSkippable%28bool%29

Comment 5

[Tyler Downer [He/Him]]

Have a user crashing with this in 19. https://support.mozilla.org/en-US/questions/950128#answer-412107. https://crash-stats.mozilla.com/report/index/bp-15428c7a-c03e-486c-b0b8-28c322130227

Comment 6

[Scoobidiver (away)]

(In reply to Tyler Downer [:Tyler] from comment #5)
> https://crash-stats.mozilla.com/report/index/bp-15428c7a-c03e-486c-b0b8-
> 28c322130227
I think it's caused by ZoneAlarm Browser Security (see the two DLLs in Modules tab)

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'nsPurpleBuffer::RemoveSkippable':
 - nightly (version 51): 3 crashes from 2016-08-01.
 - aurora  (version 50): 1 crash from 2016-08-01.
 - beta    (version 49): 51 crashes from 2016-08-02.
 - release (version 48): 0 crashes from 2016-07-25.
 - esr     (version 45): 1 crash from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       1       1       1
 - aurora        0       0       0
 - beta          3      35      10
 - release       0       0       0
 - esr           0       0       0

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora            #1043
 - beta    #3343
 - release
 - esr

Comment 8

[Tim Taubert [:ttaubert] (inactive)]

Just crashed scrolling LinkedIn's "My Network" list [1] when logged in.

[1] https://www.linkedin.com/mynetwork/

Comment 9

[Cameron McCormack (:heycam)]

I just crashed scrolling down https://www.youtube.com/user/charlie615119/videos.

Comment 10

[[:philipp]]

according to a search in crash stats it started regressing in volume with 54.0a1 build 20170129030205

pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=045d8fe30f546ab08466c9586ce298e6459c2069&tochange=e7b795db8b5b20c472d8070030e9b08c99a01db6

Comment 11

[Olli Pettay [:smaug][[e-mail]]]

Please try the very latest Nightly. (well, 64bit Windows hasn't been updated yet). It has hopefully the fix.

Comment 12

[Cameron McCormack (:heycam)]

Thanks, I just updated to today's nightly and can't seem to reproduce it now.

Comment 13

[Olli Pettay [:smaug][[e-mail]]]

Then sounds like bug 1337814.

Comment 14

[Andrew McCreight [:mccr8]]

I don't see any crashes on the 2-9 build.

Comment 15

[Sylvestre Ledru [:Sylvestre]]

Just crashed with 54:
bp-76f07486-3741-4cd3-9629-e871b2170227

Comment 16

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 15 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.