Closed Bug 837288 Opened 7 years ago Closed 7 years ago

crash in nsBlockFrame::DestroyFrom @ nsIFrame::SetNextSibling

Categories

(Core :: Layout, defect, critical)

20 Branch
All
Windows 7
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla21
Tracking Status
firefox19 --- unaffected
firefox20 + verified
firefox21 --- verified

People

(Reporter: scoobidiver, Assigned: roc)

References

Details

(4 keywords)

Crash Data

With that stack trace, it first showed up in 21.0a1/20130128. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=f18b12139151&tochange=80fed51ae074
I suspect bug 830192.

Signature 	nsIFrame::SetNextSibling(nsIFrame*) More Reports Search
UUID	fab014f0-da52-4ccb-9efb-722e62130201
Date Processed	2013-02-01 22:01:22
Uptime	58
Last Crash	1.4 hours before submission
Install Age	2.0 hours since version was first installed.
Install Time	2013-02-01 19:49:44
Product	Firefox
Version	21.0a1
Build ID	20130201030927
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x20
App Notes 	
AdapterVendorID: 0x0000, AdapterDeviceID: 0x0000, AdapterSubsysID: 00000000, AdapterDriverVersion: 
Has dual GPUs. GPU #2: AdapterVendorID2: 0x10de, AdapterDeviceID2: 0x0165, AdapterSubsysID2: 0000000c, AdapterDriverVersion2: 8.17.12.9670D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- 
Processor Notes 	sp-processor02.phx1.mozilla.com_9032:2008
EMCheckCompatibility	True
Adapter Vendor ID	0x0000
Adapter Device ID	0x0000
Total Virtual Memory	4294836224
Available Virtual Memory	1812770816
System Memory Use Percentage	66
Available Page File	11019157504
Available Physical Memory	2830016512

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsIFrame::SetNextSibling 	layout/generic/nsIFrame.h:1134
1 	xul.dll 	nsPlaceholderFrame::DestroyFrom 	layout/generic/nsPlaceholderFrame.cpp:148
2 	xul.dll 	nsBlockFrame::DestroyFrom 	layout/generic/nsBlockFrame.cpp:284
3 	xul.dll 	nsIFrame::Destroy 	layout/generic/nsIFrame.h:600
4 	xul.dll 	nsPlaceholderFrame::DestroyFrom 	layout/generic/nsPlaceholderFrame.cpp:148
5 	xul.dll 	nsIFrame::Destroy 	layout/generic/nsIFrame.h:600
6 	xul.dll 	nsBlockFrame::DoRemoveFrame 	layout/generic/nsBlockFrame.cpp:5488
7 	xul.dll 	nsBlockFrame::RemoveFrame 	layout/generic/nsBlockFrame.cpp:5047
8 	xul.dll 	nsCSSFrameConstructor::ContentRemoved 	layout/base/nsCSSFrameConstructor.cpp:7601
9 	xul.dll 	nsCSSFrameConstructor::RecreateFramesForContent 	layout/base/nsCSSFrameConstructor.cpp:9416
10 	xul.dll 	nsCSSFrameConstructor::ProcessRestyledFrames 	layout/base/nsCSSFrameConstructor.cpp:8214
11 	xul.dll 	nsCSSFrameConstructor::RestyleElement 	layout/base/nsCSSFrameConstructor.cpp:8363
12 	xul.dll 	mozilla::css::RestyleTracker::DoProcessRestyles 	layout/base/RestyleTracker.cpp:213
13 	xul.dll 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:3870
14 	xul.dll 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:3759
15 	xul.dll 	nsDocument::FlushPendingNotifications 	content/base/src/nsDocument.cpp:6730
16 	xul.dll 	mozilla::dom::Element::GetPrimaryFrame 	content/base/src/Element.cpp:1627
17 	xul.dll 	mozilla::dom::Element::GetStyledFrame 	content/base/src/Element.cpp:487
18 	xul.dll 	nsGenericHTMLElement::GetOffsetRect 	content/html/content/src/nsGenericHTMLElement.cpp:398
19 	xul.dll 	nsGenericHTMLElement::OffsetTop 	content/html/content/src/nsGenericHTMLElement.h:276
20 	xul.dll 	mozilla::dom::HTMLElementBinding::get_offsetTop 	obj-firefox/dom/bindings/HTMLElementBinding.cpp:1266
21 	xul.dll 	mozilla::dom::HTMLElementBinding::genericGetter 	obj-firefox/dom/bindings/HTMLElementBinding.cpp:5188
22 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:390
23 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:437
24 	mozjs.dll 	js::GetPropertyOperation 	js/src/jsinterpinlines.h:310
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsIFrame%3A%3ASetNextSibling%28nsIFrame*%29
I think we're going to need some URLs here.
Keywords: qawanted
Keywords: qawantedneedURLs
It has been uplifted to Aurora since 20.0a2/20130131. The Aurora regression range is:
http://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?fromchange=2869cb7fdf8e&tochange=a728a1f234a0
It's indeed a regression from bug 830192.
Version: 21 Branch → 20 Branch
It's #9 top browser crasher in 20.0a2 and #25 in 21.0a1.
Keywords: topcrash
Keywords: steps-wanted
ni? on KaiRo for URLs here, to pave the way for QA testing.

Also assigning to roc due to suspicion that bug 830192 is the regressing bug.
Flags: needinfo?(kairo)
Assignee: nobody → roc
Blocks: 839263
I've tried loading these sites and failed to reproduce the crash. Anyone else want to have a go?
Adding QA to see if they can repro with the urls provided
Keywords: qawanted
(In reply to Robert O'Callahan (:roc) (Mozilla Corporation) from comment #7)
> I've tried loading these sites and failed to reproduce the crash. Anyone
> else want to have a go?

roc, BTW, when you are logged into Socorro, you can directly get to the URL list with all of them, even those with 1 hit only, see the URLs tab on https://crash-stats.mozilla.com/report/list?signature=nsIFrame%3A%3ASetNextSibling%28nsIFrame*%29
Crashes stopped after 21.0a1/20130212 and 20.0a2/20130212. The working ranges are:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=36525224b14e&tochange=161a347bda5b
http://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?fromchange=10a9b88b6ac7&tochange=184912994f15
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → WORKSFORME
Depends on: 836990
Resolution: WORKSFORME → FIXED
Target Milestone: --- → mozilla21
You need to log in before you can comment on or make changes to this bug.