Closed Bug 758095 Opened 13 years ago Closed 13 years ago

Intermittent tpn crash [@ UnhookTextRunFromFrames]

Categories

(Core :: Layout: Text and Fonts, defect)

Product:
Core
Component:
Layout: Text and Fonts
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: philor, Unassigned)

References

Details

(Keywords: crash, intermittent-failure)

https://tbpl.mozilla.org/php/getParsedLog.php?id=12006937&tree=Firefox Rev4 MacOSX Snow Leopard 10.6 mozilla-central talos tprow on 2012-05-23 17:59:48 PDT for push d499dc65cdab slave: talos-r4-snow-013 NOISE: __FAILbrowser non-zero return code (256)__FAIL NOISE: Found crashdump: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpv5NDbg/profile/minidumps/582967D0-20E5-4802-8FB1-D838E53F4DC7.dmp Operating system: Mac OS X 10.6.8 10K549 CPU: amd64 family 6 model 23 stepping 10 2 CPUs Crash reason: EXC_BAD_ACCESS / 0x0000000d Crash address: 0x0 Thread 0 (crashed) 0 XUL!UnhookTextRunFromFrames [nsIFrame.h : 1354 + 0x0] rbx = 0x04390435 r12 = 0x08a29400 r13 = 0x0620db00 r14 = 0x00000000 r15 = 0x5fbfc4d0 rip = 0x012d81ce rsp = 0x5fbfb940 rbp = 0x00000000 1 XUL!nsTextFrame::ClearTextRun [nsTextFrameThebes.cpp : 4220 + 0xa] rbx = 0x0620db00 r12 = 0x08a29400 r13 = 0x45b14e48 r14 = 0x5fbfc4c0 r15 = 0x5fbfc4d0 rip = 0x012df406 rsp = 0x5fbfb9a0 rbp = 0x00000000 2 XUL!nsTextFrame::DestroyFrom [nsTextFrame.h : 387 + 0xb] rbx = 0x45b14e68 r12 = 0x08a29400 r13 = 0x45b14e48 r14 = 0x5fbfc4c0 r15 = 0x5fbfc4d0 rip = 0x012e90af rsp = 0x5fbfb9c0 rbp = 0x248745e8 3 XUL!nsLineBox::DeleteLineList [nsLineBox.cpp : 369 + 0x8] rbx = 0x248745e8 r12 = 0x08a29400 r13 = 0x45b14e48 r14 = 0x5fbfc4c0 r15 = 0x5fbfc4d0 rip = 0x012b7bbb rsp = 0x5fbfb9e0 rbp = 0x41ae0558 4 XUL!nsBlockFrame::DestroyFrom [nsBlockFrame.cpp : 281 + 0xe] rbx = 0x248745e8 r12 = 0x248745e8 r13 = 0x08a29400 r14 = 0x5fbfc4c0 r15 = 0x5fbfc4d0 rip = 0x01263ebe rsp = 0x5fbfba20 rbp = 0x45b14dd0 5 XUL!nsLineBox::DeleteLineList [nsLineBox.cpp : 369 + 0x8] rbx = 0x248745e8 r12 = 0x08a29400 r13 = 0x45b14db0 r14 = 0x5fbfc4c0 r15 = 0x5fbfc4d0 rip = 0x012b7bd1 rsp = 0x5fbfba70 rbp = 0x00000000 6 XUL!nsBlockFrame::DestroyFrom [nsBlockFrame.cpp : 281 + 0xe] rbx = 0x45b14c48 r12 = 0x248745e8 r13 = 0x08a29400 r14 = 0x5fbfc4c0 r15 = 0x5fbfc4d0 rip = 0x01263ebe rsp = 0x5fbfbab0 rbp = 0x45b14d38 7 XUL!nsFrameList::DestroyFramesFrom [nsFrameList.cpp : 61 + 0x8] rbx = 0x45b14c48 r12 = 0x08a29400 r13 = 0x45a92c20 r14 = 0x5fbfc4c0 r15 = 0x5fbfc4d0 rip = 0x01294779 rsp = 0x5fbfbb00 rbp = 0x248745e8 8 XUL!nsContainerFrame::DestroyFrom [nsContainerFrame.cpp : 216 + 0xb] rbx = 0x45b14be8 r12 = 0x08a29400 r13 = 0x45a92c20 r14 = 0x5fbfc4c0 r15 = 0x5fbfc4d0 rip = 0x01277220 rsp = 0x5fbfbb20 rbp = 0x248745e8 9 XUL!nsLineBox::DeleteLineList [nsLineBox.cpp : 369 + 0x8] rbx = 0x248745e8 r12 = 0x08a29400 r13 = 0x45a92c20 r14 = 0x5fbfc4c0 r15 = 0x5fbfc4d0 rip = 0x012b7bbb rsp = 0x5fbfbb40 rbp = 0x45b1f020 10 XUL!nsBlockFrame::DestroyFrom [nsBlockFrame.cpp : 281 + 0xe] rbx = 0x45a92958 r12 = 0x248745e8 r13 = 0x08a29400 r14 = 0x5fbfc4c0 r15 = 0x5fbfc4d0 rip = 0x01263ebe rsp = 0x5fbfbb80 rbp = 0x45a92ba8 11 XUL!nsFrameList::DestroyFramesFrom [nsFrameList.cpp : 61 + 0x8] rbx = 0x45a92958 r12 = 0x08a29400 r13 = 0x45a91520 r14 = 0x5fbfc4c0 r15 = 0x5fbfc4d0 rip = 0x01294779 rsp = 0x5fbfbbd0 rbp = 0x248745e8 12 XUL!nsContainerFrame::DestroyFrom [nsContainerFrame.cpp : 216 + 0xb] rbx = 0x45a928f8 r12 = 0x08a29400 r13 = 0x45a91520 r14 = 0x5fbfc4c0 r15 = 0x5fbfc4d0 rip = 0x01277220 rsp = 0x5fbfbbf0 rbp = 0x248745e8
frame 0 is at RemoveStateBits: http://hg.mozilla.org/mozilla-central/annotate/d499dc65cdab/layout/generic/nsIFrame.h#l1354 so I'm not sure where we are in UnhookTextRunFromFrames: http://hg.mozilla.org/mozilla-central/annotate/d499dc65cdab/layout/generic/nsTextFrameThebes.cpp#l428 possibly one of the ClearAllTextRunReferences calls is at line 399: http://hg.mozilla.org/mozilla-central/annotate/d499dc65cdab/layout/generic/nsTextFrameThebes.cpp#l387 (with aFrame == NULL, given the crash reason) Note that rev d499dc65cdab is before bug 756241 was fixed. (hasn't been merged to m-c yet)
Keywords: crash
What is "tprow" and how can I run it locally?
The log should give you pointers on how to run: https://tbpl.mozilla.org/php/getParsedLog.php?id=12006937&full=1&branch=mozilla-central python PerfConfigurator.py -v -e ../FirefoxNightly.app/Contents/MacOS/firefox-bin -t talos-r4-snow-013 --branchName Firefox --resultsServer graphs.mozilla.org --resultsLink /server/collect.cgi --activeTests tp5row --mozAfterPaint --responsiveness --filter ignore_first:5 --filter median --sampleConfig sample.2.config --symbolsPath ../symbols python run_tests.py --noisy 20120523_1800_config.yml For more about running talos in general, see https://wiki.mozilla.org/Buildbot/Talos Please change the command lines above as appropriate to your setup. You will also need the tp5 pageset which is not publicly distributable, though jmaher or myself on irc://irc.mozilla.org/#ateam can help get you setup and also with any other questions
WFM, running the tests locally on Linux64. Tested Opt and ASAN builds.
Keywords: testcase-wanted
https://tbpl.mozilla.org/php/getParsedLog.php?id=14301874&tree=Mozilla-Inbound
Summary: Intermittent tprow crash [@ UnhookTextRunFromFrames] → Intermittent tpn crash [@ UnhookTextRunFromFrames]
Fwiw, the crash incident in comment 5 is for changeset 102115, which is after changeset 102069, so it wasn't fixed by this: https://hg.mozilla.org/integration/mozilla-inbound/rev/357de24b8abc
This bug was observed only on one or more of the six machines listed in bug 787281 comment 11, which seem likely to have bad memory, disk, or other hardware problem, based on the rate of failures on those machines and the types of failures observed. Therefore I'm marking this bug invalid, though it should be reopened if it occurs on other (more reliable) hardware.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → INVALID
Whiteboard: [orange]
You need to log in before you can comment on or make changes to this bug.