795626 - crash in mozilla::FrameLayerBuilder::RemoveDisplayItemDataForFrame

Status: RESOLVED DUPLICATE of bug 795591

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

It first appeared in 18.0a1/20120929 and is currently #1 top crasher on Mac. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=895f66c4eada&tochange=c09a0c022b2e
It's likely a regression from bug 539356.

Signature 	mozilla::FrameLayerBuilder::RemoveDisplayItemDataForFrame More Reports Search
UUID	cbe3401d-a091-43b5-89dc-d16b02120929
Date Processed	2012-09-29 16:34:09
Uptime	774
Last Crash	12.9 minutes before submission
Install Age	3.1 hours since version was first installed.
Install Time	2012-09-29 13:25:25
Product	Firefox
Version	18.0a1
Build ID	20120929030624
Release Channel	nightly
OS	Mac OS X
OS Version	10.7.5 11G56
Build Architecture	amd64
Build Architecture Info	family 6 model 15 stepping 6
Crash Reason	EXC_BAD_ACCESS / 0x0000000d
Crash Address	0x0
AdapterVendorID: 0x1002, AdapterDeviceID: 0x71c5
Adapter Vendor ID	0x1002
Adapter Device ID	0x71c5

Frame 	Module 	Signature 	Source
0 	XUL 	mozilla::FrameLayerBuilder::RemoveDisplayItemDataForFrame 	nsStyleContext.h:208
1 	XUL 	PL_DHashTableEnumerate 	pldhash.cpp:716
2 	XUL 	mozilla::LayerManagerData::~LayerManagerData 	
3 	XUL 	mozilla::layers::LayerManager::~LayerManager 	ata.h:100
4 	XUL 	mozilla::layers::BasicLayerManager::~BasicLayerManager 	BasicLayerManager.cpp:239
5 	XUL 	mozilla::FrameLayerBuilder::DisplayItemData::~DisplayItemData 	
6 	XUL 	nsTArray<nsRefPtr<mozilla::FrameLayerBuilder::DisplayItemData>, nsTArrayDefaultA 	FrameLayerBuilder.cpp:62
7 	XUL 	nsTHashtable<mozilla::FrameLayerBuilder::DisplayItemDataEntry>::s_ClearEntry 	
8 	XUL 	PL_DHashTableOperate 	pldhash.cpp:685
9 	XUL 	mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager 	
10 	XUL 	mozilla::FramePropertyTable::DeleteAllForEntry 	FramePropertyTable.h:148
11 	XUL 	mozilla::FramePropertyTable::DeleteAllFor 	FramePropertyTable.cpp:210
12 	XUL 	PresShell::NotifyDestroyingFrame 	nsPresContext.h:907
13 	XUL 	nsFrame::DestroyFrom 	nsFrame.cpp:642
14 	XUL 	nsBlockFrame::DestroyFrom 	nsBlockFrame.cpp:305
15 	XUL 	nsFrameManager::RemoveFrame 	nsFrameManager.cpp:494
16 	XUL 	nsPlaceholderFrame::DestroyFrom 	nsPlaceholderFrame.cpp:148
17 	XUL 	nsBlockFrame::DoRemoveFrame 	nsIFrame.h:602
18 	XUL 	nsBlockFrame::RemoveFrame 	nsBlockFrame.cpp:4952
19 	XUL 	nsFrameManager::RemoveFrame 	nsFrameManager.cpp:497
20 	XUL 	nsCSSFrameConstructor::ContentRemoved 	nsCSSFrameConstructor.cpp:7592
21 	XUL 	nsCSSFrameConstructor::RecreateFramesForContent 	nsCSSFrameConstructor.cpp:9331
22 	XUL 	nsCSSFrameConstructor::ProcessRestyledFrames 	nsCSSFrameConstructor.cpp:8086
23 	XUL 	nsCSSFrameConstructor::RestyleElement 	nsCSSFrameConstructor.cpp:8240
24 	XUL 	mozilla::css::RestyleTracker::DoProcessRestyles 	RestyleTracker.cpp:122
25 	XUL 	nsCSSFrameConstructor::ProcessPendingRestyles 	RestyleTracker.h:68
26 	XUL 	PresShell::FlushPendingNotifications 	nsPresShell.cpp:3833
27 	XUL 	nsDocument::FlushPendingNotifications 	nsDocument.cpp:6501
28 	XUL 	nsGenericElement::GetScrollFrame 	nsGenericElement.cpp:1811
29 	XUL 	nsGenericElement::GetScrollLeft 	nsGenericElement.cpp:634
30 	XUL 	nsIDOMElement_GetScrollLeft 	dom_quickstubs.cpp:4472
31 	XUL 	js::Shape::get 	jscntxtinlines.h:443 
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3AFrameLayerBuilder%3A%3ARemoveDisplayItemDataForFrame

Comment 1

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

This might have been fixed by bug 795591, but the symptom here is a little different, null pointer deref instead of poison address.

Comment 2

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Unable to repro after bug 795591, so closing.  If it does, please reopen.

Comment 3

[bhavana bajaj [:bajaj]]

Clearing the tracking flag as this a DUP of bug 795591,being tracked