811291 - Crashes [@ nsIFrame::IsBoxFrame() ]

Status: RESOLVED INCOMPLETE

(Core :: Layout, defect)

Description

[Aleš Smodiš]

I'm experiencing frequent crashes when testing our experimental portal which uses a whole lot of JavaScript, generated content (HTML and inline SVG), and XHR. It started occurring out of a sudden at a point in time of our web portal development, or plainly stated: after a certain commit of our code I can crash Firefox with it in a matter of seconds, but I can't determine a reproducible pattern, or a test case that would cause a crash. Curiously, the version 14 of Firefox doesn't crash, but 15 and 16 do.

The crashes have been encountered on Ubuntu 12.04 x86_64 and x86, and on Window 7. It appears that a nsIFrame instance is being referenced that no longer exists. A crash is always caused by clicking on an inline SVG image in our portal, which triggers JavaScript code that starts an XHR and generates some HTML, but there is no way to tell how many times and/or on which image to click in order to cause a crash. I was unsuccessful at trying to write a test case that would trigger the same bug.

Here's a "conversation" with gdb when debugging Firefox 16.0.2 on Ubuntu 12.04 x86_64; the stack trace appears to be identical at every crash:

GNU gdb (Ubuntu/Linaro 7.4-2012.04-0ubuntu2) 7.4-2012.04
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://bugs.launchpad.net/gdb-linaro/>...
Reading symbols from /usr/lib/firefox/firefox...Reading symbols from /usr/lib/debug/usr/lib/firefox/firefox...done.
done.
(gdb) run
Starting program: /usr/lib/firefox/firefox 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffe65e2700 (LWP 2832)]
[New Thread 0x7fffe576d700 (LWP 2833)]
[New Thread 0x7fffe4bff700 (LWP 2834)]
[New Thread 0x7fffe3a92700 (LWP 2835)]
[New Thread 0x7fffe2c5d700 (LWP 2836)]
[New Thread 0x7fffe245c700 (LWP 2837)]
[New Thread 0x7fffe0fbd700 (LWP 2838)]
[New Thread 0x7fffe01ff700 (LWP 2839)]
[New Thread 0x7fffde0ff700 (LWP 2840)]
[New Thread 0x7fffd14ff700 (LWP 2841)]
[New Thread 0x7fffd05ff700 (LWP 2842)]
[New Thread 0x7fffcf9ff700 (LWP 2843)]
[New Thread 0x7fffcf1fe700 (LWP 2844)]
[Thread 0x7fffcf1fe700 (LWP 2844) exited]
[Thread 0x7fffd14ff700 (LWP 2841) exited]
[New Thread 0x7fffcf1fe700 (LWP 2845)]
[New Thread 0x7fffd14ff700 (LWP 2846)]
[New Thread 0x7fffcc2ff700 (LWP 2847)]
[Thread 0x7fffcf9ff700 (LWP 2843) exited]
[New Thread 0x7fffcf9ff700 (LWP 2848)]
[New Thread 0x7fffcaa9e700 (LWP 2849)]
[New Thread 0x7fffca29d700 (LWP 2851)]
[New Thread 0x7fffc93ff700 (LWP 2852)]
[New Thread 0x7fffc8bfe700 (LWP 2853)]
[New Thread 0x7fffc83fd700 (LWP 2854)]
[New Thread 0x7fffc75ff700 (LWP 2856)]
[New Thread 0x7fffc5cff700 (LWP 2859)]
[New Thread 0x7fffc2eb0700 (LWP 2861)]
[New Thread 0x7fffc26af700 (LWP 2862)]
[New Thread 0x7fffc1e2c700 (LWP 2863)]
[New Thread 0x7fffbe5ff700 (LWP 2864)]
[Thread 0x7fffc1e2c700 (LWP 2863) exited]
[Thread 0x7fffe2c5d700 (LWP 2836) exited]

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff3c30641 in IsBoxFrame (this=0x7fffbe867658) at /build/buildd/firefox-16.0.2+build1/./layout/base/../generic/nsIFrame.h:2617
2617	/build/buildd/firefox-16.0.2+build1/./layout/base/../generic/nsIFrame.h: No such file or directory.
(gdb) where
#0  0x00007ffff3c30641 in IsBoxFrame (this=0x7fffbe867658) at /build/buildd/firefox-16.0.2+build1/./layout/base/../generic/nsIFrame.h:2617
#1  GetMouseThrough (aFrame=0x7fffbe867658) at /build/buildd/firefox-16.0.2+build1/layout/base/nsDisplayList.cpp:688
#2  nsDisplayList::HitTest (this=<optimized out>, aBuilder=0x7fffffffa2a0, aRect=..., aState=0x7fffffffa830, aOutFrames=0x7fffffff9cd8)
    at /build/buildd/firefox-16.0.2+build1/layout/base/nsDisplayList.cpp:784
#3  0x00007ffff3c304ff in nsDisplayList::HitTest (this=<optimized out>, aBuilder=0x7fffffffa2a0, aRect=..., aState=0x7fffffffa830, aOutFrames=0x7fffffff9f28)
    at /build/buildd/firefox-16.0.2+build1/layout/base/nsDisplayList.cpp:758
#4  0x00007ffff3c304ff in nsDisplayList::HitTest (this=<optimized out>, aBuilder=0x7fffffffa2a0, aRect=..., aState=0x7fffffffa830, aOutFrames=0x7fffffffa178)
    at /build/buildd/firefox-16.0.2+build1/layout/base/nsDisplayList.cpp:758
#5  0x00007ffff3c304ff in nsDisplayList::HitTest (this=<optimized out>, aBuilder=0x7fffffffa2a0, aRect=..., aState=0x7fffffffa830, aOutFrames=0x7fffffffabb8)
    at /build/buildd/firefox-16.0.2+build1/layout/base/nsDisplayList.cpp:758
#6  0x00007ffff3c428a5 in nsLayoutUtils::GetFramesForArea (aFrame=0x7fffd0664bf8, aRect=..., aOutFrames=..., aShouldIgnoreSuppression=false, aIgnoreRootScrollFrame=<optimized out>)
    at /build/buildd/firefox-16.0.2+build1/layout/base/nsLayoutUtils.cpp:1437
#7  0x00007ffff3c42999 in nsLayoutUtils::GetFrameForPoint (aFrame=<optimized out>, aPt=..., aShouldIgnoreSuppression=false, aIgnoreRootScrollFrame=false)
    at /build/buildd/firefox-16.0.2+build1/layout/base/nsLayoutUtils.cpp:1392
#8  0x00007ffff3c576cc in PresShell::HandleEvent (this=0x7ffff6cd89c0, aFrame=<optimized out>, aEvent=0x7fffffffaef8, aDontRetargetEvents=<optimized out>, aEventStatus=0x7fffffffae9c)
    at /build/buildd/firefox-16.0.2+build1/layout/base/nsPresShell.cpp:5866
#9  0x00007ffff3f3c240 in nsViewManager::DispatchEvent (this=<optimized out>, aEvent=0x7fffffffaef8, aView=<optimized out>, aStatus=0x7fffffffae9c)
    at /build/buildd/firefox-16.0.2+build1/view/src/nsViewManager.cpp:863
#10 0x00007ffff3f3a365 in HandleEvent (aEvent=0x7fffffffaef8) at /build/buildd/firefox-16.0.2+build1/view/src/nsView.cpp:127
#11 0x00007ffff43cef26 in nsWindow::DispatchEvent (this=<optimized out>, aEvent=<optimized out>, aStatus=@0x7fffffffaf94: nsEventStatus_eIgnore)
    at /build/buildd/firefox-16.0.2+build1/widget/gtk2/nsWindow.cpp:474
#12 0x00007ffff43d3523 in nsWindow::OnMotionNotifyEvent (this=0x7fffd09f7260, aWidget=<optimized out>, aEvent=<optimized out>) at /build/buildd/firefox-16.0.2+build1/widget/gtk2/nsWindow.cpp:2569
#13 0x00007ffff43d35ae in motion_notify_event_cb (widget=0x7fffd0939c00, event=0x7fffde123660) at /build/buildd/firefox-16.0.2+build1/widget/gtk2/nsWindow.cpp:5248
#14 0x00007ffff0b48dd8 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#15 0x00007ffff21d2ca2 in g_closure_invoke () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#16 0x00007ffff21e3d71 in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#17 0x00007ffff21ebd7e in g_signal_emit_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#18 0x00007ffff21ec242 in g_signal_emit () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#19 0x00007ffff0c63191 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#20 0x00007ffff0b46f63 in gtk_propagate_event () from /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#21 0x00007ffff0b472c3 in gtk_main_do_event () from /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#22 0x00007ffff024acac in ?? () from /usr/lib/x86_64-linux-gnu/libgdk-x11-2.0.so.0
#23 0x00007ffff1f15d53 in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#24 0x00007ffff1f160a0 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#25 0x00007ffff1f16164 in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#26 0x00007ffff43d73f8 in nsAppShell::ProcessNextNativeEvent (this=<optimized out>, mayWait=<optimized out>) at /build/buildd/firefox-16.0.2+build1/widget/gtk2/nsAppShell.cpp:131
#27 0x00007ffff43ed991 in nsBaseAppShell::DoProcessNextNativeEvent (this=0x7fffe4d52160, mayWait=<optimized out>, recursionDepth=<optimized out>)
    at /build/buildd/firefox-16.0.2+build1/widget/xpwidgets/nsBaseAppShell.cpp:139
#28 0x00007ffff43eda62 in nsBaseAppShell::OnProcessNextEvent (this=0x7fffe4d52160, thr=0x7ffff6c22de0, mayWait=false, recursionDepth=0)
    at /build/buildd/firefox-16.0.2+build1/widget/xpwidgets/nsBaseAppShell.cpp:280
#29 0x00007ffff4558209 in nsThread::ProcessNextEvent (this=0x7ffff6c22de0, mayWait=false, result=0x7fffffffb94f) at /build/buildd/firefox-16.0.2+build1/xpcom/threads/nsThread.cpp:586
#30 0x00007ffff452cccb in NS_ProcessNextEvent_P (thread=<optimized out>, mayWait=false) at /build/buildd/firefox-16.0.2+build1/obj-x86_64-linux-gnu/xpcom/build/nsThreadUtils.cpp:217
#31 0x00007ffff448f03a in mozilla::ipc::MessagePump::Run (this=0x7fffe9e51f80, aDelegate=0x7ffff6cd5310) at /build/buildd/firefox-16.0.2+build1/ipc/glue/MessagePump.cpp:82
#32 0x00007ffff4577199 in RunHandler (this=0x7ffff6cd5310) at /build/buildd/firefox-16.0.2+build1/ipc/chromium/src/base/message_loop.cc:201
#33 MessageLoop::Run (this=0x7ffff6cd5310) at /build/buildd/firefox-16.0.2+build1/ipc/chromium/src/base/message_loop.cc:175
#34 0x00007ffff43ed3b8 in nsBaseAppShell::Run (this=0x7fffe4d52160) at /build/buildd/firefox-16.0.2+build1/widget/xpwidgets/nsBaseAppShell.cpp:163
#35 0x00007ffff42c26de in nsAppStartup::Run (this=0x7fffe4d205b0) at /build/buildd/firefox-16.0.2+build1/toolkit/components/startup/nsAppStartup.cpp:257
#36 0x00007ffff3adbad2 in XREMain::XRE_mainRun (this=0x7fffffffbc60) at /build/buildd/firefox-16.0.2+build1/toolkit/xre/nsAppRunner.cpp:3794
#37 0x00007ffff3adbcf2 in XREMain::XRE_main (this=0x7fffffffbc60, argc=<optimized out>, argv=0x7fffffffe048, aAppData=0x555555765a40)
    at /build/buildd/firefox-16.0.2+build1/toolkit/xre/nsAppRunner.cpp:3871
#38 0x00007ffff3adbf1f in XRE_main (argc=1, argv=0x7fffffffe048, aAppData=0x555555765a40, aFlags=<optimized out>) at /build/buildd/firefox-16.0.2+build1/toolkit/xre/nsAppRunner.cpp:3947
#39 0x000055555555682d in do_main (argv=0x7fffffffe048, argc=1) at /build/buildd/firefox-16.0.2+build1/browser/app/nsBrowserApp.cpp:160
#40 main (argc=<optimized out>, argv=<optimized out>) at /build/buildd/firefox-16.0.2+build1/browser/app/nsBrowserApp.cpp:265
(gdb) frame 2
#2  nsDisplayList::HitTest (this=<optimized out>, aBuilder=0x7fffffffa2a0, aRect=..., aState=0x7fffffffa830, aOutFrames=0x7fffffff9cd8)
    at /build/buildd/firefox-16.0.2+build1/layout/base/nsDisplayList.cpp:784
784	/build/buildd/firefox-16.0.2+build1/layout/base/nsDisplayList.cpp: No such file or directory.
(gdb) p j
$1 = 0
(gdb) p f
$2 = (nsIFrame *) 0x7fffbe867658
(gdb) p *f
$3 = {<nsQueryFrame> = {_vptr.nsQueryFrame = 0x7ffffffff0dea7ff}, static kFrameIID = nsQueryFrame::nsIFrame_id, static kPrincipalList = mozilla::layout::kPrincipalList, 
  static kAbsoluteList = mozilla::layout::kAbsoluteList, static kBulletList = mozilla::layout::kBulletList, static kCaptionList = mozilla::layout::kCaptionList, 
  static kColGroupList = mozilla::layout::kColGroupList, static kExcessOverflowContainersList = mozilla::layout::kExcessOverflowContainersList, static kFixedList = mozilla::layout::kFixedList, 
  static kFloatList = mozilla::layout::kFloatList, static kOverflowContainersList = mozilla::layout::kOverflowContainersList, static kOverflowList = mozilla::layout::kOverflowList, 
  static kOverflowOutOfFlowList = mozilla::layout::kOverflowOutOfFlowList, static kPopupList = mozilla::layout::kPopupList, static kPushedFloatsList = mozilla::layout::kPushedFloatsList, 
  static kSelectPopupList = mozilla::layout::kSelectPopupList, static kNoReflowPrincipalList = mozilla::layout::kNoReflowPrincipalList, 
  mRect = {<mozilla::gfx::BaseRect<int, nsRect, nsPoint, nsSize, nsMargin>> = {x = -253843457, y = 2147483647, width = -253843457, height = 2147483647}, <No data fields>}, mContent = 
    0x7ffffffff0dea7ff, mStyleContext = 0x7ffffffff0dea7ff, mParent = 0x7ffffffff0dea7ff, mNextSibling = 0x7ffffffff0dea7ff, mPrevSibling = 0x7ffffffff0dea7ff, mState = 9223372036600932351, 
  mOverflow = {mType = 4041123839, mVisualDeltas = {mLeft = 255 '\377', mTop = 167 '\247', mRight = 222 '\336', mBottom = 240 '\360'}}}
(gdb) p f->IsFrameOfType(0)
Cannot access memory at address 0x7ffffffff0deaa77
(gdb) p ((long *)f[0])@20
$4 = {0x7ffffffff0dea7ff <repeats 19 times>, 0x7ffff54faed0}
(gdb)

Comment 1

[Scoobidiver (away)]

Does it happen with a new profile?
Do you have an URL to provide so that eventually the QA team can reproduce?

Comment 2

[Mats Palmgren (inactive)]

Does this still occur in a recent version of Firefox?

Comment 3

[Phoenix]

Resolved per whiteboard

Comment 4

[Aleš Smodiš]

I'm sorry, but the project where this bug occured has been cancelled a little over a year ago. I was unable to set up a working environment to test the app with a recent version of Firefox.