832184 - intermittent null-deref crash [@ nsContentUtils::ContentIsDescendantOf] in test_richtext2.html

Status: RESOLVED WORKSFORME

(Core :: DOM: Editor, defect)

Description

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

https://tbpl.mozilla.org/php/getParsedLog.php?id=18916703&tree=Mozilla-Inbound
Android 4.0 Panda mozilla-inbound opt test mochitest-8 on 2013-01-17 22:49:29 PST for push de2ab911692d
slave: panda-0857

hit the following intermittent failure:


393 INFO TEST-START | /tests/editor/libeditor/html/tests/browserscope/test_richtext2.html
394 INFO TEST-PASS | /tests/editor/libeditor/html/tests/browserscope/test_richtext2.html | Clipboard has the correct value

INFO | automation.py | Application ran for: 0:00:48.126602
INFO | automation.py | Reading PID log: /tmp/tmpjad3C4pidlog
getting files in '/mnt/sdcard/tests/profile/minidumps/'
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/mobile/tinderbox-builds/mozilla-inbound-android/1358486787/fennec-21.0a1.en-US.android-arm.crashreporter-symbols.zip
PROCESS-CRASH | /tests/editor/libeditor/html/tests/browserscope/test_richtext2.html | application crashed [@ nsContentUtils::ContentIsDescendantOf(nsINode const*, nsINode const*)]
Crash dump filename: /tmp/tmpzjbSID/3eb58397-515d-d69c-02519c54-6904b51b.dmp
Operating system: Android
                  0.0.0 Linux 3.2.0+ #2 SMP PREEMPT Thu Nov 29 08:06:57 EST 2012 armv7l pandaboard/pandaboard/pandaboard:4.0.4/IMM76I/5:eng/test-keys
CPU: arm
     0 CPUs

Crash reason:  SIGSEGV
Crash address: 0x10

Thread 11 (crashed)
 0  libxul.so!nsContentUtils::ContentIsDescendantOf(nsINode const*, nsINode const*) [nsINode.h : 763 + 0x0]
     r4 = 0x67901490    r5 = 0x66ebb380    r6 = 0x66eb5dc0    r7 = 0x00000000
     r8 = 0x5d7fdf5c    r9 = 0x00000000   r10 = 0x00000000    fp = 0x66eb5dc0
     sp = 0x5d7fdf20    lr = 0x5f5951f9    pc = 0x5f55310c
    Found by: given as instruction pointer in context
 1  libxul.so!nsRange::ContentRemoved(nsIDocument*, nsIContent*, nsIContent*, int, nsIContent*) [nsRange.cpp : 629 + 0x5]
     r4 = 0x67901490    r5 = 0x66ebb380    r6 = 0x66eb5dc0    r7 = 0x00000000
     r8 = 0x5d7fdf5c    r9 = 0x00000000   r10 = 0x00000000    fp = 0x66eb5dc0
     sp = 0x5d7fdf20    pc = 0x5f5951f9
    Found by: call frame info
 2  libxul.so!nsNodeUtils::ContentRemoved(nsINode*, nsIContent*, int, nsIContent*) [nsNodeUtils.cpp : 175 + 0x17]
     r4 = 0x5f5951c7    r5 = 0x65d6bc00    r6 = 0x65d6bc00    r7 = 0x66ebb380
     r8 = 0x5d7fdf5c    r9 = 0x00000000   r10 = 0x00000000    fp = 0x66eb5dc0
     sp = 0x5d7fdf48    pc = 0x5f58c8af
    Found by: call frame info
 3  libxul.so!nsINode::doRemoveChildAt(unsigned int, bool, nsIContent*, nsAttrAndChildArray&) [nsINode.cpp : 1384 + 0xb]
     r4 = 0x66eb5dc0    r5 = 0x66ebb380    r6 = 0x00000000    r7 = 0x00000001
     r8 = 0x00000000    r9 = 0x00000001   r10 = 0x66ebb3c0    fp = 0x66ebb0f0
     sp = 0x5d7fdf90    pc = 0x5f583ee1
    Found by: call frame info
 4  libxul.so!mozilla::dom::FragmentOrElement::RemoveChildAt(unsigned int, bool) [FragmentOrElement.cpp : 894 + 0xb]
     r4 = 0x00000000    r5 = 0x66ebb380    r6 = 0x66ebb3b4    r7 = 0x00000001
     r8 = 0x63425850    r9 = 0x00000001   r10 = 0x66ebb3c0    fp = 0x66ebb0f0
     sp = 0x5d7fdfb0    pc = 0x5f5a870d
    Found by: call frame info
 5  libxul.so!nsINode::RemoveChild(nsINode&, mozilla::ErrorResult&) [nsINode.cpp : 460 + 0x9]
     r4 = 0x66ebb380    r5 = 0x66eb5dc0    r6 = 0x5d7fdfe8    r7 = 0x66ebcee0
     r8 = 0x63425850    r9 = 0x00000001   r10 = 0x66ebb3c0    fp = 0x66ebb0f0
     sp = 0x5d7fdfd8    pc = 0x5f58340d
    Found by: call frame info
 6  libxul.so!DeleteNodeTxn::DoTransaction() [DeleteNodeTxn.cpp : 77 + 0x7]
     r4 = 0x66ebcee0    r5 = 0x63591e6c    r6 = 0x5d7fe008    r7 = 0x66ebcee0
     r8 = 0x63425850    r9 = 0x00000001   r10 = 0x66ebb3c0    fp = 0x66ebb0f0
     sp = 0x5d7fdfe8    pc = 0x5f72b2e7
    Found by: call frame info
 7  libxul.so!nsTransactionItem::DoTransaction() [nsTransactionItem.cpp : 164 + 0x5]
     r4 = 0x69197610    r5 = 0x8007000e    r6 = 0x5d7fe008    r7 = 0x66ebcee0
     r8 = 0x63425850    r9 = 0x00000001   r10 = 0x66ebb3c0    fp = 0x66ebb0f0
     sp = 0x5d7fe000    pc = 0x5f7caa31
...

Comment 1

[(no longer active)]

Hrm this is bad.  Does it also affect our users?

Comment 2

[Robert Kaiser]

(In reply to :Ehsan Akhgari from comment #1)
> Hrm this is bad.  Does it also affect our users?

I was about to say "I can't tell because the Crash Signature field here is empty" when I realized that the summary and comment #0 give it away. ;-)

Apparently we're seeing this signature in the wild, but with very low volume: https://crash-stats.mozilla.com/report/list?signature=nsContentUtils%3A%3AContentIsDescendantOf%28nsINode%20const*%2C%20nsINode%20const*%29

Comment 3

[(no longer active)]

Needs an owner.

Comment 4

[Ed Morley [:emorley]]

Resolving WFM keyword:intermittent-failure bugs last modified >3 months ago, whose whiteboard contains none of:
{random,disabled,marked,fuzzy,todo,fails,failing,annotated,time-bomb,leave open}

There will inevitably be some false positives; for that (and the bugspam) I apologise. Filter on orangewfm.