Closed Bug 791437 Opened 12 years ago Closed 8 years ago

crash in mozilla::dom::FragmentOrElement::CanSkip

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Version:
17 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox18 - ---
firefox36 - ---
firefox38 - ---

People

(Reporter: scoobidiver, Unassigned)

Details

(Keywords: crash, regression)

Crash Data

It first appeared in 17.0a1/20120804. The regression range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=89dcadd42ec4&tochange=20fc34efd733 There are two kinds of stack traces: Frame Module Signature Source 0 xul.dll mozilla::dom::FragmentOrElement::CanSkip content/base/src/FragmentOrElement.cpp:1573 1 xul.dll nsDocument::cycleCollection::CanSkipImpl content/base/src/nsDocument.cpp:1716 2 xul.dll nsPurpleBuffer::RemoveSkippable xpcom/base/nsCycleCollector.cpp:2007 3 xul.dll nsCycleCollector::ForgetSkippable xpcom/base/nsCycleCollector.cpp:2031 4 xul.dll FireForgetSkippable dom/base/nsJSEnvironment.cpp:3044 5 xul.dll nsJSContext::CycleCollectNow dom/base/nsJSEnvironment.cpp:3087 6 xul.dll CCTimerFired dom/base/nsJSEnvironment.cpp:3291 ... Frame Module Signature Source 0 xul.dll mozilla::dom::FragmentOrElement::CanSkip content/base/src/FragmentOrElement.cpp:1613 1 xul.dll nsCOMPtr_base::assign_from_qi obj-firefox/xpcom/build/nsCOMPtr.cpp:58 2 mozjs.dll JS_DHashTableEnumerate js/src/jsdhash.cpp:710 3 xul.dll XPCJSRuntime::UnmarkSkippableJSHolders js/xpconnect/src/XPCJSRuntime.cpp:540 4 xul.dll xpc_UnmarkSkippableJSHolders js/xpconnect/src/XPCJSRuntime.cpp:549 5 xul.dll nsCCUncollectableMarker::Observe content/base/src/nsCCUncollectableMarker.cpp:358 6 xul.dll nsObserverService::NotifyObservers xpcom/ds/nsObserverService.cpp:149 7 xul.dll nsCycleCollector::ForgetSkippable xpcom/base/nsCycleCollector.cpp:2081 8 xul.dll FireForgetSkippable dom/base/nsJSEnvironment.cpp:3036 9 xul.dll nsJSContext::CycleCollectNow dom/base/nsJSEnvironment.cpp:3079 10 xul.dll CCTimerFired dom/base/nsJSEnvironment.cpp:3283 ... More reports at: https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Adom%3A%3AFragmentOrElement%3A%3ACanSkip%28nsINode*%2C+bool%29
Bug 743112 - Incremental deferred release is in that range. Plus a bunch of Ms2ger patches.
The much rarer crashes on 17 looks pretty reasonable, like in comment 0, and are reads to slightly weird addresses. The more common 18 crashes are almost all reads at 0xffffffffffffffff and 82% are on AMD processors. The 18 stacks almost all look bogus. We have nsGfxScrollFrameInner::GetBorderRadii calling into js::ion::AssemblerX86Shared::~AssemblerX86Shared calling into CanSkip. I'm inclined to say this might be another instance of that AMD PGO problem...
(In reply to Andrew McCreight [:mccr8] from comment #2) > The 18 stacks almost all look bogus. Because they are with 64-bit builds on Windows.
It looks like this is a recent huge flareup of an old fairly rare bug. Is there some way to see which day that might have first happened on? I guess this could be an IonMonkey regression.
(In reply to Andrew McCreight [:mccr8] from comment #4) > It looks like this is a recent huge flareup of an old fairly rare bug. Is > there some way to see which day that might have first happened on? I guess > this could be an IonMonkey regression. The spike coincides with the release of IonMonkey: https://crash-stats.mozilla.com/report/list?version=Firefox%3A18.0a1&query_search=signature&query_type=contains&reason_type=contains&range_value=4&range_unit=weeks&hang_type=any&process_type=any&signature=mozilla%3A%3Adom%3A%3AFragmentOrElement%3A%3ACanSkip%28nsINode*%2C%20bool%29
Crash Signature: [@ mozilla::dom::FragmentOrElement::CanSkip(nsINode*, bool)] → [@ mozilla::dom::FragmentOrElement::CanSkip(nsINode*, bool)] [@ mozilla::dom::FragmentOrElement::CanSkip]
OS: Windows 7 → All
Crash Signature: [@ mozilla::dom::FragmentOrElement::CanSkip(nsINode*, bool)] [@ mozilla::dom::FragmentOrElement::CanSkip] → [@ mozilla::dom::FragmentOrElement::CanSkip(nsINode*, bool)] [@ mozilla::dom::FragmentOrElement::CanSkip] [@ js::GCThingIsMarkedGray]
It's #8 top browser crasher in 18.0a1.
tracking-firefox18: --- → ?
Keywords: topcrash
I don't see any crashes from builds on the 21st or 22nd, maybe there was some IonMonkey patch that landed around then that fixed memory corruption? Here's a breakdown of a few stacks chosen on an ad hoc basis. This crash stack looks like an IonMonkey problem: https://crash-stats.mozilla.com/report/index/8f115b54-4b12-48c1-ae99-dc78c2120924 This looks like a legit looking crash in CanSkip. I'm not sure what could cause this, except maybe something weird in IsPurple() https://crash-stats.mozilla.com/report/index/fbba28cf-0916-493d-b528-065fa2120924 JSObject::lookupProperty is calling into CanSkip, then busted stack: https://crash-stats.mozilla.com/report/index/9a25035f-3b74-4c92-8cea-b2a182120924 This stack looks nonsensical: https://crash-stats.mozilla.com/report/index/65de9c1e-305c-4512-9f17-a30752120924
(In reply to Andrew McCreight [:mccr8] from comment #7) > I don't see any crashes from builds on the 21st or 22nd, maybe there was > some IonMonkey patch that landed around then that fixed memory corruption? There are crashes but at a lower volume because of localized builds not updated and bug 793636.
These crashes are mostly 0xffffffffffffff or whatever, and seem to be very commonly on AMD. The stacks are also pretty bogus looking, so I still think it is some kind of memory corruption that is landing in the middle of this function somehow.
Only one crash since the 26th build, so I guess it is possible this was fixed by bug 793257. But it is too early to tell.
(In reply to Andrew McCreight [:mccr8] from comment #10) > Only one crash since the 26th build, so I guess it is possible this was > fixed by bug 793257. Probably.
tracking-firefox18: + → ?
Keywords: topcrash
Removing this bug from tracking for 18 as it is no more a top crasher
tracking-firefox18: ? → -
The number of incidents for CanSkip are pretty high in versions 24 to 27. There are also some crashes in CanSkipReal: bp-6cd631b4-fcaa-4139-b4b6-cbbba2131026 and CanSkipImpl: bp-0e1dd739-503e-4a47-80b5-280a22131028 Maybe the same underlying problem?
[Tracking Requested - why for this release]:Bug come back Mozilla.
tracking-firefox36: --- → ?
(In reply to mkdante381 from comment #15) > My crash report > https://crash-stats.mozilla.com/report/index/a32aab58-8e92-4b25-b64a- > 69b0f2150301 > Mozilla fix this bug! This will be difficult to fix without steps to reproduce. Did this crash happen to you once, or has it happened more than once?
(In reply to Andrew McCreight [:mccr8] from comment #17) > (In reply to mkdante381 from comment #15) > > My crash report > > https://crash-stats.mozilla.com/report/index/a32aab58-8e92-4b25-b64a- > > 69b0f2150301 > > Mozilla fix this bug! > > This will be difficult to fix without steps to reproduce. Did this crash > happen to you once, or has it happened more than once? This is random crash. I had the one crash many times. My hardware is ok, he was tested. All programs and games work good. Only FF random crash for me. I have Direct2D 1.1 enabled in FF. My changed settings: accessibility.typeaheadfind true accessibility.typeaheadfind.flashBar 0 browser.cache.disk_cache_ssl false browser.cache.disk.capacity 358400 browser.cache.disk.smart_size.first_run false browser.cache.disk.smart_size.use_old_max false browser.cache.frecency_experiment 2 browser.cache.memory.capacity -1 browser.places.smartBookmarksVersion 7 browser.search.useDBForOrder true browser.sessionstore.upgradeBackup.latestBuildID 20150222232811 browser.startup.homepage https://www.google.pl/ browser.startup.homepage_override.buildID 20150222232811 browser.startup.homepage_override.mstone 36.0 browser.tabs.closeWindowWithLastTab false browser.tabs.defaultDrawInTitlebar false browser.tabs.drawInTitlebar false browser.tabs.loadBookmarksInBackground true browser.tabs.tabClipWidth 1 browser.urlbar.maxRichResults 24 browser.urlbar.trimURLs false dom.image.picture.enabled true dom.image.srcset.enabled true dom.ipc.plugins.enabled.npietab2.dll true dom.ipc.plugins.flash.disable-protected-mode true dom.ipc.plugins.sandbox.flash true dom.max_chrome_script_run_time 60 dom.mozApps.used true dom.mozBrowserFramesEnabled true dom.mozTCPSocket.enabled true dom.serviceWorkers.enabled true dom.workers.websocket.enabled true extensions.lastAppVersion 36.0 font.language.group x-unicode general.useragent.extra.microsoftdotnet (.NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) gfx.3d_video.enabled true gfx.canvas.azure.backends direct2d1.1,direct2d,skia,cairo gfx.canvas.azure.enabled true gfx.content.azure.backends direct2d1.1,direct2d,cairo gfx.content.azure.enabled true gfx.direct2d.use1_1 true gfx.direct3d.last_used_feature_level_idx 0 gfx.downloadable_fonts.woff2.enabled true gfx.font_rendering.cleartype_params.pixel_structure 1 gfx.font_rendering.cleartype_params.rendering_mode 3 gfx.font_rendering.directwrite.enabled true html5.enable true keyword.URL https://www.google.pl/search?q= layers.async-pan-zoom.enabled true layers.composer2d.enabled true layers.d3d11.disable-warp false layers.d3d11.force-warp false layers.offmainthreadcomposition.animate-opacity true layers.offmainthreadcomposition.animate-transform true layers.offmainthreadcomposition.async-animations true media.audio_data.enabled true media.decoder.heuristic.dormant.enabled true media.eme.apiVisible true media.eme.enabled true media.fragmented-mp4.gmp.enabled false media.gmp-eme-adobe.hidden true media.gmp-gmpopenh264.autoupdate false media.gmp-gmpopenh264.enabled true media.gmp-gmpopenh264.lastUpdate 1425255103 media.gmp-gmpopenh264.version 1.3.1 media.gmp-manager.lastCheck 1425238589 media.mediasource.enabled true media.mediasource.ignore_codecs false media.mediasource.webm.enabled true media.mediasource.youtubeonly false media.navigator.video.max_fr 60 media.navigator.video.max_fs 12288 media.peerconnection.identity.enabled true media.peerconnection.video.h264_enabled true media.track.enabled true media.webspeech.recognition.enable true media.webspeech.synth.enabled true media.windows-media-foundation.play-stand-alone true network.cookie.prefsMigrated true network.http.pipelining.maxrequests 6 network.http.pipelining.ssl true places.database.lastMaintenance 1425398832 places.history.expiration.transient_current_max_pages 104858 plugin.disable_full_page_plugin_for_types application/pdf plugin.importedState true plugin.state.java 2 plugin.state.np-mswmp 2 plugin.state.np32dsw 2 plugin.state.npgoogleupdate 2 plugin.state.nplastpass 2 plugin.state.npolgdet 2 plugin.state.nppl 1 plugin.state.npqtplugin 2 plugin.state.nprndlhtml5videoshim 0 plugin.state.nprpplugin 0 plugin.state.npsoplugin 2 plugin.state.npunity3d 1 plugin.state.npvlc 2 plugin.state.npwlpg 2 plugins.load_appdir_plugins true privacy.donottrackheader.enabled true privacy.sanitize.migrateFx3Prefs true svg.marker-improvements.enabled true svg.new-getBBox.enabled true svg.smil.enabled true svg.svg-iframe.enabled true
We have this bug for a while and, afaik, it is not crising in 36. Not tracking.
tracking-firefox36: ? → -
Crash on youtube and gmail. Why mozilla not fix this bug? I have 4 core processor Core Quad Q9450. All programs and games working with 0 crash. FF for 10 minutes Crash, Crash and Crash. xul.dll is bugged: Firefox 36.0 Crash Report [@ mozilla::dom::WrapNativeParentHelper<nsINode, int>::Wrap(JSContext*, nsINode*, nsWrapperCache*) ] https://crash-stats.mozilla.com/report/index/27f92acc-144d-4b01-963d-d3ee92150304 Firefox 36.0 Crash Report [@ xul.dll@0x19ca8f4 | nsDOMCSSDeclaration::WrapObject(JSContext*) ] https://crash-stats.mozilla.com/report/index/cc11d84a-5bd0-4d3a-a845-4d4482150304
Crashes mentioned in comment 20 have nothing to do with this bug. mkdante381 could you please file new bugs and hopefully steps to reproduce.
mkdante381, you also seem to have lots of addons installed. Perhaps worth to try to run FF in safe mode, or otherwise disabled addons.
(In reply to Olli Pettay [:smaug] from comment #22) > mkdante381, you also seem to have lots of addons installed. Perhaps worth to > try to run FF in safe mode, or otherwise disabled addons. This help only little. On my old core 2 duo e8400 Firefox don't crash with my addons. When I changed to Intel Core Quad Q9450, Firefox crash randomly. Maybe This is problem on 4 core processors and more? I tested in memtest86+ and my RAM is good. Problem is with I have latest GPU catalyst omega drivers 14.12, and latest all Windows Updates. How enable full Direct2D 1.1 in Firefox? Is enough these settings?: gfx.canvas.azure.backends;direct2d1.1,direct2d,skia,cairo gfx.content.azure.backends;direct2d1.1,direct2d,cairo gfx.direct2d.disabled;false gfx.direct2d.force-enabled;false gfx.direct2d.use1_1;true layers.d3d11.disable-warp;false layers.d3d11.force-warp;false PLS Click Show/hide other threads in my new crash report https://crash-stats.mozilla.com/report/index/2132525a-685f-49d1-8c94-3840c2150310. Maybe Problem is with: Lastpass(signature> lpxpcom.dll@0x12f28) Firefox acceleration atidxx32.dll (many signatures) IE Tab Firefox addon? ieframe.dll or problem with Windows Updates http://answers.microsoft.com/en-us/ie/forum/ie11-windows_7/ieframedll-application-crashes-caused-by-kb2977629/de92c06f-8962-46e7-b38e-3d49dc21e6ea I changed the settings in addon IE Tab> "IE Compatibility Mode" to "IE9 Forced Standards Mode" Process Mode:>to "Run this plugin in the firefox.exe process" I reinstall LastPass and IE Tab, maybe this helps. I'll wait for the next Crash...
Try to also use FF without those addons.
I repeat once more: On my old core 2 duo e8400 Firefox don't crash with my addons. When I changed to Intel Core Quad Q9450, Firefox crash randomly. Maybe This is problem on 4 core processors and more? I tested in memtest86+ and my RAM is good. This is problem with Firefox. These addons work perfectly with 2 core processor. Now I use https://addons.mozilla.org/pl/firefox/addon/fire-ie/ Maybe problem was with IE Tab. Now I have 0 crash Firefox
Crash on html5 movie: https://crash-stats.mozilla.com/report/index/a477ecf9-86b1-4362-9f40-0c9442150325#allthreads Problem with msmpeg2vdec.dll ??
Flags: needinfo?(bugs)
On the machine where you can see the crash, does it still crash without the addons? I see there is _lots_ of addons installed.
Flags: needinfo?(bugs)
(In reply to Olli Pettay [:smaug] from comment #28) Olli Pettay IMHO is problem with acceleration gpu on my card AMD R9 270X. With D2D FF crash on high resolution images and with D2D1.1 is random crash. I disabled direct2d and this not helped, but is also random crash. With and without addons is the same problem Crash Reason is EXCEPTION_ACCESS_VIOLATION_READ and EXCEPTION_ACCESS_VIOLATION_EXEC. Maybe additionally problem is with plugins. I have 4 random crash report. mozilla::dom::FragmentOrElement::CanSkip(nsINode*, bool) https://crash-stats.mozilla.com/report/index/37a712e6-0333-4668-9743-28b3e2150325 nsTArray_Impl<nsCOMPtr<nsIContent>, nsTArrayInfallibleAllocator>::Clear() https://crash-stats.mozilla.com/report/index/90559246-27ca-4dd8-b61d-216d12150325 @0x0 | CCGraphBuilder::NoteXPCOMChild(nsISupports*) https://crash-stats.mozilla.com/report/index/6f2be17d-fce2-49cb-b04c-eab9a2150325 ChildFinder::NoteXPCOMChild(nsISupports*) https://crash-stats.mozilla.com/report/index/d2ec2dd2-901d-4945-9e82-b3acc2150325
nsDOMCSSAttributeDeclaration::GetCSSDeclaration(bool) https://crash-stats.mozilla.com/report/index/fb7d6f9b-b3c7-4b46-9834-5ffcc2150325
[Tracking Requested - why for this release]:I have also on FF 38 latest beta https://crash-stats.mozilla.com/report/index/ff7dcbb7-4133-4840-a5ba-820312150423 I don't know why crash. Fix this bug mozilla.
tracking-firefox38: --- → ?
Not tracking (the situation has not changed since comment #19). mkdante381@gmail.com, as Smaug said, you have a lot of addons... This is likely to be the cause of your problem.
tracking-firefox38: ? → -
(In reply to Sylvestre Ledru [:sylvestre] from comment #32) > Not tracking (the situation has not changed since comment #19). > mkdante381@gmail.com, as Smaug said, you have a lot of addons... This is > likely to be the cause of your problem. Nope. FF 32bit on other computer with Nvidia graphic card no crash. I have AMD R9 270X
NEW Crash report Signature:[@ mozilla::dom::FragmentOrElement::CanSkipInCC(nsINode*) ] https://crash-stats.mozilla.com/report/index/30a8caf8-386b-4c3f-b511-27b3e2150523 FF crash and crash, and Mozilla not fix this bug, with my graphic card and acceleration on Firefox. All my games, applications not crash. My memory is good(10x tested my memory with memtest86+ and 0 problems) THX for not support.
All my upload bugs are related with my cpu oc. Now I change to 3.37GHz(from 3.44GHz) and I don't have crash any more. FF is always stable
Sebastian (Comment 13) wrote me he hasn't seen this crash in a long time. Wihtout STR this bug doesn't seem to be actionable.
(In reply to Wayne Mery (:wsmwk, NI for questions) from comment #36) > Sebastian (Comment 13) wrote me he hasn't seen this crash in a long time. Note that I already did so back in 2015 and I don't have steps to reproduce the issue, unfortunately. I also didn't see this crash lately. If it happens to me again and I have more info or steps to reproduce, I'll let you know. Sebastian
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → WORKSFORME
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.