Closed Bug 791437 Opened 12 years ago Closed 7 years ago

crash in mozilla::dom::FragmentOrElement::CanSkip

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Version:
17 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox18 - ---
firefox36 - ---
firefox38 - ---

People

(Reporter: scoobidiver, Unassigned)

Details

(Keywords: crash, regression)

Crash Data

It first appeared in 17.0a1/20120804. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=89dcadd42ec4&tochange=20fc34efd733

There are two kinds of stack traces:
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::dom::FragmentOrElement::CanSkip 	content/base/src/FragmentOrElement.cpp:1573
1 	xul.dll 	nsDocument::cycleCollection::CanSkipImpl 	content/base/src/nsDocument.cpp:1716
2 	xul.dll 	nsPurpleBuffer::RemoveSkippable 	xpcom/base/nsCycleCollector.cpp:2007
3 	xul.dll 	nsCycleCollector::ForgetSkippable 	xpcom/base/nsCycleCollector.cpp:2031
4 	xul.dll 	FireForgetSkippable 	dom/base/nsJSEnvironment.cpp:3044
5 	xul.dll 	nsJSContext::CycleCollectNow 	dom/base/nsJSEnvironment.cpp:3087
6 	xul.dll 	CCTimerFired 	dom/base/nsJSEnvironment.cpp:3291
...

Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::dom::FragmentOrElement::CanSkip 	content/base/src/FragmentOrElement.cpp:1613
1 	xul.dll 	nsCOMPtr_base::assign_from_qi 	obj-firefox/xpcom/build/nsCOMPtr.cpp:58
2 	mozjs.dll 	JS_DHashTableEnumerate 	js/src/jsdhash.cpp:710
3 	xul.dll 	XPCJSRuntime::UnmarkSkippableJSHolders 	js/xpconnect/src/XPCJSRuntime.cpp:540
4 	xul.dll 	xpc_UnmarkSkippableJSHolders 	js/xpconnect/src/XPCJSRuntime.cpp:549
5 	xul.dll 	nsCCUncollectableMarker::Observe 	content/base/src/nsCCUncollectableMarker.cpp:358
6 	xul.dll 	nsObserverService::NotifyObservers 	xpcom/ds/nsObserverService.cpp:149
7 	xul.dll 	nsCycleCollector::ForgetSkippable 	xpcom/base/nsCycleCollector.cpp:2081
8 	xul.dll 	FireForgetSkippable 	dom/base/nsJSEnvironment.cpp:3036
9 	xul.dll 	nsJSContext::CycleCollectNow 	dom/base/nsJSEnvironment.cpp:3079
10 	xul.dll 	CCTimerFired 	dom/base/nsJSEnvironment.cpp:3283
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Adom%3A%3AFragmentOrElement%3A%3ACanSkip%28nsINode*%2C+bool%29
Bug 743112 - Incremental deferred release is in that range. Plus a bunch of Ms2ger patches.
The much rarer crashes on 17 looks pretty reasonable, like in comment 0, and are reads to slightly weird addresses.

The more common 18 crashes are almost all reads at 0xffffffffffffffff and 82% are on AMD processors.  The 18 stacks almost all look bogus. We have nsGfxScrollFrameInner::GetBorderRadii calling into js::ion::AssemblerX86Shared::~AssemblerX86Shared calling into CanSkip.  I'm inclined to say this might be another instance of that AMD PGO problem...
(In reply to Andrew McCreight [:mccr8] from comment #2)
> The 18 stacks almost all look bogus.
Because they are with 64-bit builds on Windows.
It looks like this is a recent huge flareup of an old fairly rare bug. Is there some way to see which day that might have first happened on?  I guess this could be an IonMonkey regression.
(In reply to Andrew McCreight [:mccr8] from comment #4)
> It looks like this is a recent huge flareup of an old fairly rare bug. Is
> there some way to see which day that might have first happened on?  I guess
> this could be an IonMonkey regression.
The spike coincides with the release of IonMonkey: https://crash-stats.mozilla.com/report/list?version=Firefox%3A18.0a1&query_search=signature&query_type=contains&reason_type=contains&range_value=4&range_unit=weeks&hang_type=any&process_type=any&signature=mozilla%3A%3Adom%3A%3AFragmentOrElement%3A%3ACanSkip%28nsINode*%2C%20bool%29
Crash Signature: [@ mozilla::dom::FragmentOrElement::CanSkip(nsINode*, bool)] → [@ mozilla::dom::FragmentOrElement::CanSkip(nsINode*, bool)] [@ mozilla::dom::FragmentOrElement::CanSkip]
OS: Windows 7 → All
Crash Signature: [@ mozilla::dom::FragmentOrElement::CanSkip(nsINode*, bool)] [@ mozilla::dom::FragmentOrElement::CanSkip] → [@ mozilla::dom::FragmentOrElement::CanSkip(nsINode*, bool)] [@ mozilla::dom::FragmentOrElement::CanSkip] [@ js::GCThingIsMarkedGray]
It's #8 top browser crasher in 18.0a1.
tracking-firefox18: --- → ?
Keywords: topcrash
I don't see any crashes from builds on the 21st or 22nd, maybe there was some IonMonkey patch that landed around then that fixed memory corruption?

Here's a breakdown of a few stacks chosen on an ad hoc basis.

This crash stack looks like an IonMonkey problem:
https://crash-stats.mozilla.com/report/index/8f115b54-4b12-48c1-ae99-dc78c2120924

This looks like a legit looking crash in CanSkip. I'm not sure what could cause this, except maybe something weird in IsPurple()
https://crash-stats.mozilla.com/report/index/fbba28cf-0916-493d-b528-065fa2120924

JSObject::lookupProperty is calling into CanSkip, then busted stack:
https://crash-stats.mozilla.com/report/index/9a25035f-3b74-4c92-8cea-b2a182120924

This stack looks nonsensical:
https://crash-stats.mozilla.com/report/index/65de9c1e-305c-4512-9f17-a30752120924
(In reply to Andrew McCreight [:mccr8] from comment #7)
> I don't see any crashes from builds on the 21st or 22nd, maybe there was
> some IonMonkey patch that landed around then that fixed memory corruption?
There are crashes but at a lower volume because of localized builds not updated and bug 793636.
These crashes are mostly 0xffffffffffffff or whatever, and seem to be very commonly on AMD. The stacks are also pretty bogus looking, so I still think it is some kind of memory corruption that is landing in the middle of this function somehow.
Only one crash since the 26th build, so I guess it is possible this was fixed by bug 793257. But it is too early to tell.
(In reply to Andrew McCreight [:mccr8] from comment #10)
> Only one crash since the 26th build, so I guess it is possible this was
> fixed by bug 793257.
Probably.
tracking-firefox18: + → ?
Keywords: topcrash
Removing this bug from tracking for 18 as it is no more a top crasher
tracking-firefox18: ? → -
The number of incidents for CanSkip are pretty high in versions 24 to 27.
There are also some crashes in CanSkipReal: bp-6cd631b4-fcaa-4139-b4b6-cbbba2131026
and CanSkipImpl: bp-0e1dd739-503e-4a47-80b5-280a22131028
Maybe the same underlying problem?
[Tracking Requested - why for this release]:Bug come back Mozilla.
tracking-firefox36: --- → ?
(In reply to mkdante381 from comment #15)
> My crash report
> https://crash-stats.mozilla.com/report/index/a32aab58-8e92-4b25-b64a-
> 69b0f2150301
> Mozilla fix this bug!

This will be difficult to fix without steps to reproduce.  Did this crash happen to you once, or has it happened more than once?
(In reply to Andrew McCreight [:mccr8] from comment #17)
> (In reply to mkdante381 from comment #15)
> > My crash report
> > https://crash-stats.mozilla.com/report/index/a32aab58-8e92-4b25-b64a-
> > 69b0f2150301
> > Mozilla fix this bug!
> 
> This will be difficult to fix without steps to reproduce.  Did this crash
> happen to you once, or has it happened more than once?


This is random crash. I had the one crash many times. My hardware is ok, he was tested. All programs and games work good. Only FF random crash for me. I have Direct2D 1.1 enabled in FF.
My changed settings:
accessibility.typeaheadfind	true
accessibility.typeaheadfind.flashBar	0
browser.cache.disk_cache_ssl	false
browser.cache.disk.capacity	358400
browser.cache.disk.smart_size.first_run	false
browser.cache.disk.smart_size.use_old_max	false
browser.cache.frecency_experiment	2
browser.cache.memory.capacity	-1
browser.places.smartBookmarksVersion	7
browser.search.useDBForOrder	true
browser.sessionstore.upgradeBackup.latestBuildID	20150222232811
browser.startup.homepage	https://www.google.pl/
browser.startup.homepage_override.buildID	20150222232811
browser.startup.homepage_override.mstone	36.0
browser.tabs.closeWindowWithLastTab	false
browser.tabs.defaultDrawInTitlebar	false
browser.tabs.drawInTitlebar	false
browser.tabs.loadBookmarksInBackground	true
browser.tabs.tabClipWidth	1
browser.urlbar.maxRichResults	24
browser.urlbar.trimURLs	false
dom.image.picture.enabled	true
dom.image.srcset.enabled	true
dom.ipc.plugins.enabled.npietab2.dll	true
dom.ipc.plugins.flash.disable-protected-mode	true
dom.ipc.plugins.sandbox.flash	true
dom.max_chrome_script_run_time	60
dom.mozApps.used	true
dom.mozBrowserFramesEnabled	true
dom.mozTCPSocket.enabled	true
dom.serviceWorkers.enabled	true
dom.workers.websocket.enabled	true
extensions.lastAppVersion	36.0
font.language.group	x-unicode
general.useragent.extra.microsoftdotnet	(.NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
gfx.3d_video.enabled	true
gfx.canvas.azure.backends	direct2d1.1,direct2d,skia,cairo
gfx.canvas.azure.enabled	true
gfx.content.azure.backends	direct2d1.1,direct2d,cairo
gfx.content.azure.enabled	true
gfx.direct2d.use1_1	true
gfx.direct3d.last_used_feature_level_idx	0
gfx.downloadable_fonts.woff2.enabled	true
gfx.font_rendering.cleartype_params.pixel_structure	1
gfx.font_rendering.cleartype_params.rendering_mode	3
gfx.font_rendering.directwrite.enabled	true
html5.enable	true
keyword.URL	https://www.google.pl/search?q=
layers.async-pan-zoom.enabled	true
layers.composer2d.enabled	true
layers.d3d11.disable-warp	false
layers.d3d11.force-warp	false
layers.offmainthreadcomposition.animate-opacity	true
layers.offmainthreadcomposition.animate-transform	true
layers.offmainthreadcomposition.async-animations	true
media.audio_data.enabled	true
media.decoder.heuristic.dormant.enabled	true
media.eme.apiVisible	true
media.eme.enabled	true
media.fragmented-mp4.gmp.enabled	false
media.gmp-eme-adobe.hidden	true
media.gmp-gmpopenh264.autoupdate	false
media.gmp-gmpopenh264.enabled	true
media.gmp-gmpopenh264.lastUpdate	1425255103
media.gmp-gmpopenh264.version	1.3.1
media.gmp-manager.lastCheck	1425238589
media.mediasource.enabled	true
media.mediasource.ignore_codecs	false
media.mediasource.webm.enabled	true
media.mediasource.youtubeonly	false
media.navigator.video.max_fr	60
media.navigator.video.max_fs	12288
media.peerconnection.identity.enabled	true
media.peerconnection.video.h264_enabled	true
media.track.enabled	true
media.webspeech.recognition.enable	true
media.webspeech.synth.enabled	true
media.windows-media-foundation.play-stand-alone	true
network.cookie.prefsMigrated	true
network.http.pipelining.maxrequests	6
network.http.pipelining.ssl	true
places.database.lastMaintenance	1425398832
places.history.expiration.transient_current_max_pages	104858
plugin.disable_full_page_plugin_for_types	application/pdf
plugin.importedState	true
plugin.state.java	2
plugin.state.np-mswmp	2
plugin.state.np32dsw	2
plugin.state.npgoogleupdate	2
plugin.state.nplastpass	2
plugin.state.npolgdet	2
plugin.state.nppl	1
plugin.state.npqtplugin	2
plugin.state.nprndlhtml5videoshim	0
plugin.state.nprpplugin	0
plugin.state.npsoplugin	2
plugin.state.npunity3d	1
plugin.state.npvlc	2
plugin.state.npwlpg	2
plugins.load_appdir_plugins	true
privacy.donottrackheader.enabled	true
privacy.sanitize.migrateFx3Prefs	true
svg.marker-improvements.enabled	true
svg.new-getBBox.enabled	true
svg.smil.enabled	true
svg.svg-iframe.enabled  true
We have this bug for a while and, afaik, it is not crising in 36. Not tracking.
tracking-firefox36: ? → -
Crash on youtube and gmail. Why mozilla not fix this bug? I have 4 core processor Core Quad Q9450. All programs and games working with 0 crash. FF for 10 minutes Crash, Crash and Crash.
xul.dll is bugged:

Firefox 36.0 Crash Report [@ mozilla::dom::WrapNativeParentHelper<nsINode, int>::Wrap(JSContext*, nsINode*, nsWrapperCache*) ]
https://crash-stats.mozilla.com/report/index/27f92acc-144d-4b01-963d-d3ee92150304

Firefox 36.0 Crash Report [@ xul.dll@0x19ca8f4 | nsDOMCSSDeclaration::WrapObject(JSContext*) ]
https://crash-stats.mozilla.com/report/index/cc11d84a-5bd0-4d3a-a845-4d4482150304
Crashes mentioned in comment 20 have nothing to do with this bug.

mkdante381 could you please file new bugs and hopefully steps to reproduce.
mkdante381, you also seem to have lots of addons installed. Perhaps worth to try to run FF in safe mode, or otherwise disabled addons.
(In reply to Olli Pettay [:smaug] from comment #22)
> mkdante381, you also seem to have lots of addons installed. Perhaps worth to
> try to run FF in safe mode, or otherwise disabled addons.

This help only little. On my old core 2 duo e8400 Firefox don't crash with my addons. When I changed to Intel Core Quad Q9450, Firefox crash randomly. Maybe This is problem on 4 core processors and more?
I tested in memtest86+ and my RAM is good. Problem is with 
I have latest GPU catalyst omega drivers 14.12, and latest all Windows Updates. 
How enable full Direct2D 1.1 in Firefox? Is enough these settings?:
gfx.canvas.azure.backends;direct2d1.1,direct2d,skia,cairo
gfx.content.azure.backends;direct2d1.1,direct2d,cairo
gfx.direct2d.disabled;false
gfx.direct2d.force-enabled;false
gfx.direct2d.use1_1;true
layers.d3d11.disable-warp;false
layers.d3d11.force-warp;false

PLS Click Show/hide other threads in my new crash report https://crash-stats.mozilla.com/report/index/2132525a-685f-49d1-8c94-3840c2150310. 
Maybe Problem is with: 
Lastpass(signature> lpxpcom.dll@0x12f28)
Firefox acceleration atidxx32.dll (many signatures)
IE Tab Firefox addon? ieframe.dll or problem with Windows Updates http://answers.microsoft.com/en-us/ie/forum/ie11-windows_7/ieframedll-application-crashes-caused-by-kb2977629/de92c06f-8962-46e7-b38e-3d49dc21e6ea

I changed the settings in addon IE Tab>
"IE Compatibility Mode" to "IE9 Forced Standards Mode"
Process Mode:>to "Run this plugin in the firefox.exe process"



I reinstall LastPass and IE Tab, maybe this helps. I'll wait for the next Crash...
Try to also use FF without those addons.
I repeat once more: On my old core 2 duo e8400 Firefox don't crash with my addons. When I changed to Intel Core Quad Q9450, Firefox crash randomly. Maybe This is problem on 4 core processors and more?
I tested in memtest86+ and my RAM is good. This is problem with Firefox. These addons work perfectly with 2 core processor. Now I use https://addons.mozilla.org/pl/firefox/addon/fire-ie/ Maybe problem was with IE Tab. Now I have 0 crash Firefox
Crash on html5 movie:
https://crash-stats.mozilla.com/report/index/a477ecf9-86b1-4362-9f40-0c9442150325#allthreads
Problem with msmpeg2vdec.dll ??
Flags: needinfo?(bugs)
On the machine where you can see the crash, does it still crash without the addons?
I see there is _lots_ of addons installed.
Flags: needinfo?(bugs)
(In reply to Olli Pettay [:smaug] from comment #28)
Olli Pettay IMHO is problem with acceleration gpu on my card AMD R9 270X. With D2D FF crash on high resolution images and with D2D1.1 is random crash. I disabled direct2d and this not helped, but is also random crash. With and without addons is the same problem Crash Reason is EXCEPTION_ACCESS_VIOLATION_READ and EXCEPTION_ACCESS_VIOLATION_EXEC. Maybe additionally
problem is with plugins.

I have 4 random crash report. 
mozilla::dom::FragmentOrElement::CanSkip(nsINode*, bool) 
https://crash-stats.mozilla.com/report/index/37a712e6-0333-4668-9743-28b3e2150325

nsTArray_Impl<nsCOMPtr<nsIContent>, nsTArrayInfallibleAllocator>::Clear()
https://crash-stats.mozilla.com/report/index/90559246-27ca-4dd8-b61d-216d12150325

@0x0 | CCGraphBuilder::NoteXPCOMChild(nsISupports*) 
https://crash-stats.mozilla.com/report/index/6f2be17d-fce2-49cb-b04c-eab9a2150325

ChildFinder::NoteXPCOMChild(nsISupports*) 
https://crash-stats.mozilla.com/report/index/d2ec2dd2-901d-4945-9e82-b3acc2150325
nsDOMCSSAttributeDeclaration::GetCSSDeclaration(bool)
https://crash-stats.mozilla.com/report/index/fb7d6f9b-b3c7-4b46-9834-5ffcc2150325
[Tracking Requested - why for this release]:I have also on FF 38 latest beta
https://crash-stats.mozilla.com/report/index/ff7dcbb7-4133-4840-a5ba-820312150423
I don't know why crash. Fix this bug mozilla.
tracking-firefox38: --- → ?
Not tracking (the situation has not changed since comment #19).
mkdante381@gmail.com, as Smaug said, you have a lot of addons... This is likely to be the cause of your problem.
tracking-firefox38: ? → -
(In reply to Sylvestre Ledru [:sylvestre] from comment #32)
> Not tracking (the situation has not changed since comment #19).
> mkdante381@gmail.com, as Smaug said, you have a lot of addons... This is
> likely to be the cause of your problem.

Nope. FF 32bit on other computer with Nvidia graphic card no crash. I have AMD R9 270X
NEW Crash report 
Signature:[@ mozilla::dom::FragmentOrElement::CanSkipInCC(nsINode*) ]
https://crash-stats.mozilla.com/report/index/30a8caf8-386b-4c3f-b511-27b3e2150523
FF crash and crash, and Mozilla not fix this bug, with my graphic card and acceleration on Firefox. 
All my games, applications not crash. My memory is good(10x tested my memory with memtest86+ and 0 problems) THX for not support.
All my upload bugs are related with my cpu oc. Now I change to 3.37GHz(from 3.44GHz) and I don't have crash any more. FF is always stable
Sebastian (Comment 13) wrote me he hasn't seen this crash in a long time.

Wihtout STR this bug doesn't seem to be actionable.
(In reply to Wayne Mery (:wsmwk, NI for questions) from comment #36)
> Sebastian (Comment 13) wrote me he hasn't seen this crash in a long time.

Note that I already did so back in 2015 and I don't have steps to reproduce the issue, unfortunately.
I also didn't see this crash lately. If it happens to me again and I have more info or steps to reproduce, I'll let you know.

Sebastian
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → WORKSFORME
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.