Closed Bug 789033 Opened 13 years ago Closed 13 years ago

Crash with Flashblock @ nsViewManager::InvalidateWidgetArea

Categories

(Core :: Web Painting, defect)

Product:
Core
Component:
Web Painting
Version:
18 Branch
Type:
defect
Priority:
Not set
Severity:
blocker

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla18
Tracking Flags:
Tracking Status
firefox18 + verified

People

(Reporter: bugzilla.mozilla.org, Assigned: johns)

References

Details

(Keywords: crash, regression, topcrash)

Crash Data

Attachments

(1 file)

Bug 789033 - Fix anti-reentry lock broken by bug 786650
1.89 KB, patch
Details | Diff | Splinter Review
User Agent: Opera/9.80 (X11; Linux i686; U; en) Presto/2.10.289 Version/12.02 Steps to reproduce: Hi folks. You know I love this browser and that I wouldn't complain unless there was something wrong. Today I have downloaded the updates (automagically) using Help > About Nightly (3.3 Mb) and restarted the browser. Actual results: First sign of trouble was the Speed Dial add-on being broken. http://s6.postimage.org/70t8tzekv/Snapshot_085.png I am reporting this problem to the developer of the add-on too however I believe it may not be the add-on that causes problems here. After noticing that add-on is no longer working I then tried to open my http://sparewotw.wordpress.com site by typing the address by hand into address bar and Nightly crashed on me. I have then opened the terminal and tried running firefox from there to see if there are any problem indications. No errors whatsover. Firefox crashed again when trying to open http://sparewotw.wordpress.com. I have then disabled the Speed Dial add-on and started firefox from terminal. Crash while loading site. No errors in terminal. I then checked the Error Console and found those entries: Timestamp: 09/06/2012 01:47:34 PM Error: this.docShell is null Source File: chrome://global/content/bindings/browser.xml Line: 323 Timestamp: 09/06/2012 01:47:37 PM Error: no element found Source File: chrome://browser/content/hiddenWindow.xul Line: 3 Timestamp: 09/06/2012 01:47:38 PM Error: The character encoding of the HTML document was not declared. The document will render with garbled text in some browser configurations if the document contains characters from outside the US-ASCII range. The character encoding of the page must be declared in the document or in the transfer protocol. Source File: data:text/html,<html><body><img%20src='resource://jid1-f9uj2thwoam5gq-at-jetpack/collusion/data/favicon.ico'></body></html> Line: 0 Timestamp: 09/06/2012 01:47:39 PM Error: Exposing chrome JS objects to content without __exposedProps__ is insecure and deprecated. See https://developer.mozilla.org/en/XPConnect_wrappers for more information. Source File: resource://jid1-f9uj2thwoam5gq-at-jetpack/api-utils/lib/cuddlefish.js -> resource://jid1-f9uj2thwoam5gq-at-jetpack/api-utils/lib/sandbox.js -> resource://jid1-f9uj2thwoam5gq-at-jetpack/api-utils/data/worker.js Line: 126 Timestamp: 09/06/2012 01:47:39 PM Error: Exposing chrome JS objects to content without __exposedProps__ is insecure and deprecated. See https://developer.mozilla.org/en/XPConnect_wrappers for more information. Source File: resource://jid1-f9uj2thwoam5gq-at-jetpack/api-utils/lib/cuddlefish.js -> resource://jid1-f9uj2thwoam5gq-at-jetpack/api-utils/lib/sandbox.js -> resource://jid1-f9uj2thwoam5gq-at-jetpack/api-utils/data/worker.js Line: 126 Timestamp: 09/06/2012 01:47:39 PM Error: The character encoding of the HTML document was not declared. The document will render with garbled text in some browser configurations if the document contains characters from outside the US-ASCII range. The character encoding of the page must be declared in the document or in the transfer protocol. Source File: resource://jid1-f9uj2thwoam5gq-at-jetpack/collusion/data/ui/panel.html Line: 0 And those warnings: Timestamp: 09/06/2012 01:47:34 PM Warning: Use of Mutation Events is deprecated. Use MutationObserver instead. Source File: chrome://global/content/bindings/toolbar.xml Line: 276 Timestamp: 09/06/2012 01:47:34 PM Warning: nsIJSON.decode is deprecated. Please use JSON.parse instead. Source File: chrome://ghostery/content/ghostery-db.js Line: 627 and those messages: aus3.mozilla.org : server does not support RFC 5746, see CVE-2009-3555 aus3.mozilla.org : server does not support RFC 5746, see CVE-2009-3555 Note that this site http://sparewotw.wordpress.com crashes Nightly 100% of time here while for example http://hootiegibbon.wordpress.com or https://google.com does not. http://sparewotw.wordpress.com is being added here so you can check for the crash. I didn't tested other sites. Last night the same site was working just fine. Then I have opened firefox from terminal in a safe mode. No crashes. No errors in the Error Console. Can someone advise? Expected results: Stable uninterupted by crashes browser session. Regards. Thanks in advance to whoever deals with it. Andrzej
is there anything in about:crashes?
I can confirm crash-happy, on win32 builds as well: Good cset: 3974efe8d584 Bad Cset: 501f4e46a88c There are 117 patches in the bad cset. m-i regression is needed Browser will start ok with no tabs. Loading CNN and NBCNEWS, one or the other or both will crash the browser.
Severity: normal → blocker
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: regression, regressionwindow-wanted
OS: Linux → All
Hardware: x86 → All
@ crazyskeggy 4 links: 6fb8690d-064e-2ea1-36eb84d3-1ebfdb5208/20/201211:20 PM 10f22c54-2f16-483b-16e7926d-0216f1a108/20/201211:20 PM 16d75f49-0de6-36f5-1df3a421-030b050f06/21/201203:49 PM 732472db-598a-adb2-556dc7c7-6884454106/21/201203:47 PM All sending me here: https://crash-stats.mozilla.com/about/throttling @ Jim Jeffery Thanks for confirming. Regards. Andrzej
Two more IDs from crashes soon after startup: 2c289a7a-5632-4037-b89d-4fe0f2120906 d5e12939-5f71-42f8-b93b-401812120906
(In reply to AndrzejL from comment #3) > @ crazyskeggy > > 4 links: > > 6fb8690d-064e-2ea1-36eb84d3-1ebfdb5208/20/201211:20 PM > 10f22c54-2f16-483b-16e7926d-0216f1a108/20/201211:20 PM > 16d75f49-0de6-36f5-1df3a421-030b050f06/21/201203:49 PM > 732472db-598a-adb2-556dc7c7-6884454106/21/201203:47 PM You need to left click each in turn in about:crashes to make sure they are submitted. Middle-clicking doesn't do this. Once you have them submitted, please reply with them in the bp-<foo> form, since bugzilla then turns them into links automatically. Please can you also try with all addons disabled & in safe mode etc (In reply to B.J. Herbison from comment #4) > Two more IDs from crashes soon after startup: > 2c289a7a-5632-4037-b89d-4fe0f2120906 > d5e12939-5f71-42f8-b93b-401812120906 Linkified: bp-2c289a7a-5632-4037-b89d-4fe0f2120906 bp-d5e12939-5f71-42f8-b93b-401812120906 These two are both [@ nsIView::GetViewFor ]
Keywords: crash
@ Ed Morley I did left clicked on them. I do not understand the bp-<foo> thing. I did tried with all add-ons disabled and in safe-mode as I have mentioned in my first post. Regards. Andrzej
(In reply to AndrzejL from comment #6) > I do not understand the bp-<foo> thing. I meant instead of: 6fb8690d-064e-2ea1-36eb84d3-1ebfdb5208/20/201211:20 PM or 6fb8690d-064e-2ea1-36eb84d3-1ebfdb52 Please post them as: bp-6fb8690d-064e-2ea1-36eb84d3-1ebfdb52 ...which should be how they appear in about:crashes if they were submitted successfully. I don't know enough about breakpad/about:crashes to know why yours aren't.
Crash Signature: [@ nsViewManager::InvalidateWidgetArea(nsView*, nsRegion const&) ] [@ nsIView::GetViewFor ]
This one is fresh: bp-010966cc-28fa-4306-ad40-0463a2120906 Regards. Andrzej
Bug 787060 seems like a possible candidate, even though it's for Android.
Thank you :-) (In reply to AndrzejL from comment #8) > bp-79c2f52d-ee5a-4f73-aade-1d69d2120906 > bp-63178b27-d8ae-4b6b-89f5-e7b3c2120906 These were with beta and were [@ libflashplayer.so@0x36c37d ] so nothing to do with Nightly. > bp-fae700fc-ccf8-4ce0-bab7-7decf2120906 > bp-40a33a24-9af6-4ce1-9d6a-222fd2120906 These were on aurora 17.0.1, so again not Nightly + seem to be caused by a plugin? [@ hang | mplayerplug-in.so@0x15b34 ] (In reply to AndrzejL from comment #9) > This one is fresh: > > bp-010966cc-28fa-4306-ad40-0463a2120906 > > Regards. > > Andrzej Ok, so this one is [@ nsIView::GetViewFor ] :-)
Component: Untriaged → Layout: View Rendering
OS: All → Linux
Product: Firefox → Core
Summary: Firefox Nightly 18.0 crash happy after 6th Sept. 2012 update. → Firefox Nightly 18.0 crash happy after 6th Sept. 2012 update [@ nsIView::GetViewFor ]
https://crash-stats.mozilla.com/report/index/bp-373dffbf-467d-4f61-9324-75f9f2120906 Crashing Thread Frame Module Signature Source 0 @0x5d01bfdd 1 xul.dll nsViewManager::InvalidateWidgetArea view/src/nsViewManager.cpp:534 2 xul.dll nsViewManager::FlushDirtyRegionToWidget view/src/nsViewManager.cpp:463 3 xul.dll nsViewManager::ProcessPendingUpdatesForView view/src/nsViewManager.cpp:412 4 xul.dll nsViewManager::ProcessPendingUpdates view/src/nsViewManager.cpp:1217 5 xul.dll nsRefreshDriver::Notify layout/base/nsRefreshDriver.cpp:421 6 xul.dll nsTimerImpl::Fire xpcom/threads/nsTimerImpl.cpp:476 7 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:624 8 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:82 9 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:201 10 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:175 11 xul.dll nsBaseAppShell::Run widget/xpwidgets/nsBaseAppShell.cpp:163 12 xul.dll nsAppShell::Run widget/windows/nsAppShell.cpp:232 13 xul.dll nsAppStartup::Run toolkit/components/startup/nsAppStartup.cpp:273 14 xul.dll XREMain::XRE_mainRun toolkit/xre/nsAppRunner.cpp:3835 15 xul.dll XREMain::XRE_main toolkit/xre/nsAppRunner.cpp:3912 16 xul.dll XRE_main toolkit/xre/nsAppRunner.cpp:3988 17 firefox.exe wmain toolkit/xre/nsWindowsWMain.cpp:100 18 firefox.exe __tmainCRTStartup crtexe.c:552 19 kernel32.dll BaseProcessStart
OS: Linux → All
Summary: Firefox Nightly 18.0 crash happy after 6th Sept. 2012 update [@ nsIView::GetViewFor ] → Firefox Nightly 18.0 crash happy after 6th Sept. 2012 update [@ nsIView::GetViewFor ][@ nsViewManager::InvalidateWidgetArea(nsView*, nsRegion const&) ]
This crash is addon related it appears. Flashblock is causing crash for me ForecastFox is non-functional - but is not causing crash. Whatever landed broke several addons it seems.
Steps to reproduce: 1. Install Flash Block https://addons.mozilla.org/ja/firefox/addon/flashblock/ and Restart. 2. Open http://edition.cnn.com/ . Actual results: Crash bp-e0c565bb-4bc2-456d-9e2e-d1d022120906 Regression window(m-c) Good: http://hg.mozilla.org/mozilla-central/rev/3974efe8d584 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20120905165101 Crash: http://hg.mozilla.org/mozilla-central/rev/501f4e46a88c Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20120905192801 Pushlog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3974efe8d584&tochange=501f4e46a88c Regression window(m-i) Good: http://hg.mozilla.org/integration/mozilla-inbound/rev/a20c53ec062a Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20120905133701 Crash: http://hg.mozilla.org/integration/mozilla-inbound/rev/827807082790 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 ID:20120905140500 Pushlog: http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=a20c53ec062a&tochange=827807082790
It happens to me with Ad Block Plus disabled / enabled. Makes no difference. I will investigate further. Regards. Andrzej
cc jschoenick@mozilla.com He landed the two patches found in the regression window provided by Alice. \ Thanks again Alice, great work! https://bugzilla.mozilla.org/show_bug.cgi?id=548133 https://bugzilla.mozilla.org/show_bug.cgi?id=786650
Sites tested: http://sparewotw.wordpress.com/ http://edition.cnn.com/ FireTray 0.4.2 - OK Adblock Plus 2.1.2 - OK SpeedDial 0.9.6.9 - OK NoScript 2.5.4 - OK BetterPrivacy 1.68 - OK Ghostery 2.8.0.2 - OK Collusion 0.16.3 - OK Certificate Patrol 2.0.14 - OK LastPass 2.0.0 - OK ReloadEvery 13.0.0 - OK Smart Referer 0.0.7.1 - OK User Agent Switcher 0.7.3 - OK DownloadHelper 4.9.9 - OK Flashblock 1.5.15.1 - That's the bugger... Regards. Andrzej
Assignee: nobody → jschoenick
Summary: Firefox Nightly 18.0 crash happy after 6th Sept. 2012 update [@ nsIView::GetViewFor ][@ nsViewManager::InvalidateWidgetArea(nsView*, nsRegion const&) ] → Crash with Flashblock [@ nsIView::GetViewFor ][@ nsViewManager::InvalidateWidgetArea(nsView*, nsRegion const&) ]
Flashblock author here. > Steps to reproduce: > 1. Install Flash Block https://addons.mozilla.org/ja/firefox/addon/flashblock/ and Restart. > 2. Open http://edition.cnn.com/ . Also happens with https://mail.google.com/
Oh I am sorry I misread the Alice0775 White post. I must be tired. The Flashblock was pointed out as a cause - I however misread it as AdBlock... Yes Alice0775 White is right - it's Flashblock that causes the crashes on various sites. Regards. Andrzej
Status: NEW → ASSIGNED
tracking-firefox18: --- → ?
Keywords: regressionwindow-wanted
Oops. I blame josh.
Attachment #658996 - Flags: review?(joshmoz)
Crash Signature: [@ nsViewManager::InvalidateWidgetArea(nsView*, nsRegion const&) ] [@ nsIView::GetViewFor ] → [@ nsViewManager::InvalidateWidgetArea(nsView*, nsRegion const&)] [@ @0x0 | nsViewManager::InvalidateWidgetArea(nsView*, nsRegion const&)] [@ xul.dll@0xc816cc | nsViewManager::InvalidateWidgetArea(nsView* nsRegion const&)] [@ nsIView::GetViewFor] [@ @…
Keywords: topcrash
Summary: Crash with Flashblock [@ nsIView::GetViewFor ][@ nsViewManager::InvalidateWidgetArea(nsView*, nsRegion const&) ] → Crash with Flashblock @ nsViewManager::InvalidateWidgetArea
Crash Signature: nsRegion const&)] [@ nsIView::GetViewFor] [@ @0x0 | nsIView::GetViewFor] [@ nsIView::GetViewFor(nsIWidget*)] [@ nsHTMLSharedElement::AddRef()] → nsRegion const&)] [@ nsIView::GetViewFor] [@ @0x0 | nsIView::GetViewFor] [@ nsIView::GetViewFor(nsIWidget*)] [@ nsHTMLSharedElement::AddRef()] [@ nsRegion::Copy] [@ nsINode::GetOncanplay(JSContext* JS::Value*) ] [@ @0x0 | nsINode::GetOncanplay(JSCo…
Attachment #658996 - Flags: review?(joshmoz)
This caused crashes on try, so I'm backing out bug 786650 and will reland that when it doesn't explode things
Blocks: 786650
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
Status: RESOLVED → VERIFIED
After the upgrade I have restarted Nightly. I have enabled flashblock and visited: http://sparewotw.wordpress.com/ http://edition.cnn.com/ No crash. Thanks guys. Well done as always. Regards. Andrzej
Verified steps to reproduce from comment 14 on 2012-09-06 Nightly Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 Build ID: 20120906030518 2012-09-06 Nightly crashed every time I reproduced the steps, but my crash signatures are different than any other signatures that were written in the comments of this bug or in the "Crash signature" section. (xul.dll@0x6bfa98 | xul.dll@0x357f65 | xul.dll@0xbd160 | xul.dll@0x1a98e7 | xul.dll@0x77141 | xul.dll@0x18b3c8 | xul.dll@0x105836 | xul.dll@0x146ada | xul.dll@0xfe5c7 | xul.dll@0x2ba601 | xul.dll@0x2ba5d2 | xul.dll@0x2b9f04 | xul.dll@0x2ba67e | xul.dll@... ) http://crash-stats.mozilla.com/report/index/bp-d05083a4-d461-40b6-af2d-8adfd2121128 http://crash-stats.mozilla.com/report/index/bp-86125065-6826-45a3-98fc-b1b572121128 http://crash-stats.mozilla.com/report/index/bp-694289c7-2c67-4125-b547-f57fb2121128 http://crash-stats.mozilla.com/report/index/bp-f0b6b37d-b8f1-454d-8340-9ae3a2121128 Verified on Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 Beta 1 Build ID: 20121121075611 and Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20.0 Firefox/20.0 latest Nightly Build ID: 20121127030907 No crashes found for these versions. Can this be moved to "verified" considering that my crash signature is different from the ones mentioned in this bug before?
Component: Layout: View Rendering → Layout: Web Painting
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: