Closed Bug 782981 Opened 11 years ago Closed 11 years ago

crash in nsObjectFrame::BeginSwapDocShells

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Version:
17 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla17
Tracking Flags:
Tracking Status
firefox17 + fixed

People

(Reporter: gcp, Unassigned)

References

Details

(Keywords: crash, regression, Whiteboard: [native-crash])

Crash Data

This bug was filed from the Socorro interface and is 
report bp-60d55399-4783-464b-848e-032772120815 .
============================================================= 

Visit http://stara.fi. Close tab. (Repeat a few times if needed). Nightly crashes.
Most likely a dupe of bug 782979 with different STR.
Severity: major → critical
This is also happening when closing the Gmail tab in the latest nightly build, as you can see in the duplicate bug. Definitely a critical issue.
I can reproduce the crash on windows7,
bp-0eeabe52-0217-4e48-9d25-5a38a2120815

Regression window(m-c)
Good:
http://hg.mozilla.org/mozilla-central/rev/22288130fea2
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120813211942
Crash:
http://hg.mozilla.org/mozilla-central/rev/d9183f015df8
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120814055342
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=22288130fea2&tochange=d9183f015df8



Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/303b75594832
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120813210542
Crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/4ddd9c731adc
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120813210943
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=303b75594832&tochange=4ddd9c731adc


Suspected: Bug 775965
Blocks: 775965
OS: Windows 7 → All
Yep, looks like the patch for Bug 775965 is causing this crash. I subscribed Chris, who authored the patch and pushed it to m-i.
http://hg.mozilla.org/integration/mozilla-inbound/rev/bcac58cbf328 is the cause of this issue.
Reverting the commit "solves" the problem.
Keywords: regression
Noming, as nightly has become fairly unusable. I have a window full of tabs I can't close without crashing the browser :)
status-firefox17: --- → affected
tracking-firefox17: --- → ?
Backing out now & will respin.
Should be fixed by the backout:
https://hg.mozilla.org/mozilla-central/rev/7d4268f8884c

Nightly has been respun
> Nightly has been respun

ETA 3-5 hours, depending on platform.
Crash Signature: [@ PL_DHashTableOperate | nsTHashtable<nsBaseHashtableET<nsCStringHashKey, unsigned int> >::RemoveEntry(nsACString_internal const&)] → [@ PL_DHashTableOperate | nsTHashtable<nsBaseHashtableET<nsCStringHashKey, unsigned int> >::RemoveEntry(nsACString_internal const&)] [@ PL_DHashTableOperate | nsObjectFrame::BeginSwapDocShells(nsIContent* void*)] [@ PL_DHashTableOperate | EnumerateFreez…
Summary: crash in PL_DHashTableOperate → crash in nsObjectFrame::BeginSwapDocShells
Whiteboard: [native-crash]
Version: Trunk → 17 Branch
Hardware: x86 → All
Nightly (Mac) found an update at 11:30am and closing Gmail stopped crashing.

before: Built from http://hg.mozilla.org/mozilla-central/rev/86ee4deea55b
after: Built from http://hg.mozilla.org/mozilla-central/rev/7d4268f8884c
Status: NEW → RESOLVED
Closed: 11 years ago
status-firefox17: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla17
Got this few minutes ago https://crash-stats.mozilla.com/report/index/bp-ad54b876-536f-4344-b957-56a022120815 while closing Gmail tab. Nightly l10n. Did there was respin for l10n as well?
(In reply to semtex2 from comment #15)
> Got this few minutes ago
> https://crash-stats.mozilla.com/report/index/bp-ad54b876-536f-4344-b957-
> 56a022120815 while closing Gmail tab. Nightly l10n. Did there was respin for
> l10n as well?

(In reply to Ed Morley [:edmorley] from comment #11)
> > Nightly has been respun
> 
> ETA 3-5 hours, depending on platform.
So, no respin for Win32 l10n Nightly, also no new build, something went not OK IMO.
You need to log in before you can comment on or make changes to this bug.