crash in nsFrameList::DestroyFrame

VERIFIED FIXED in Firefox 20

Status

()

Core
Layout
--
critical
VERIFIED FIXED
5 years ago
5 years ago

People

(Reporter: Scoobidiver (away), Assigned: roc)

Tracking

({crash, regression, topcrash})

20 Branch
mozilla21
x86_64
Mac OS X
crash, regression, topcrash
Points:
---

Firefox Tracking Flags

(firefox20+ verified)

Details

(crash signature)

(Reporter)

Description

5 years ago
It's #2 top crasher in 20.0a2 on Mac OS X and first showed up in 20.0a2/20130131. The regression range is:
http://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?fromchange=2869cb7fdf8e&tochange=a728a1f234a0

Nightly is almost unaffected so probably caused by a missing uplift to Aurora.

Signature 	nsFrameList::DestroyFrame(nsIFrame*) More Reports Search
UUID	1e2bd918-2d34-4081-a086-37f2a2130207
Date Processed	2013-02-07 20:38:25
Uptime	14720
Last Crash	4.4 hours before submission
Install Age	4.5 hours since version was first installed.
Install Time	2013-02-07 16:10:27
Product	Firefox
Version	20.0a2
Build ID	20130207042017
Release Channel	aurora
OS	Mac OS X
OS Version	10.8.2 12C60
Build Architecture	amd64
Build Architecture Info	family 6 model 42 stepping 7
Crash Reason	EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash Address	0x30
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x 126GL Context? GL Context+ GL Layers? GL Layers+ 
Processor Notes 	sp-processor02.phx1.mozilla.com_21884:2008; exploitablity tool: ERROR: unable to analyze dump
EMCheckCompatibility	True
Adapter Vendor ID	0x8086
Adapter Device ID	0x 126

Frame 	Module 	Signature 	Source
0 	XUL 	nsFrameList::DestroyFrame 	nsIFrame.h:1133
1 	XUL 	nsFrameManager::RemoveFrame 	nsFrameManager.cpp:496
2 	XUL 	nsPlaceholderFrame::DestroyFrom 	nsPlaceholderFrame.cpp:148
3 	XUL 	nsLineBox::DeleteLineList 	nsLineBox.cpp:372
4 	XUL 	nsBlockFrame::DestroyFrom 	nsBlockFrame.cpp:282
5 	XUL 	nsFrameManager::RemoveFrame 	nsFrameManager.cpp:496
6 	XUL 	nsPlaceholderFrame::DestroyFrom 	nsPlaceholderFrame.cpp:148
7 	XUL 	nsBlockFrame::DoRemoveFrame 	nsIFrame.h:599
8 	XUL 	nsBlockFrame::RemoveFrame 	nsBlockFrame.cpp:4974
9 	XUL 	nsFrameManager::RemoveFrame 	nsFrameManager.cpp:499
10 	XUL 	nsCSSFrameConstructor::ContentRemoved 	nsCSSFrameConstructor.cpp:7599
11 	XUL 	nsCSSFrameConstructor::RecreateFramesForContent 	nsCSSFrameConstructor.cpp:9414
12 	XUL 	nsCSSFrameConstructor::ProcessRestyledFrames 	nsCSSFrameConstructor.cpp:8213
13 	XUL 	nsCSSFrameConstructor::RestyleElement 	nsCSSFrameConstructor.cpp:8362
14 	XUL 	mozilla::css::RestyleTracker::DoProcessRestyles 	RestyleTracker.cpp:123
15 	XUL 	nsCSSFrameConstructor::ProcessPendingRestyles 	RestyleTracker.h:201
16 	XUL 	PresShell::FlushPendingNotifications 	nsPresShell.cpp:3867
17 	XUL 	nsDocument::FlushPendingNotifications 	nsDocument.cpp:6526
18 	XUL 	mozilla::dom::Element::GetStyledFrame 	Element.cpp:1621
19 	XUL 	nsGenericHTMLElement::GetOffsetRect 	nsGenericHTMLElement.cpp:399
20 	XUL 	mozilla::dom::HTMLElementBinding::get_offsetTop 	nsGenericHTMLElement.h:280
21 	XUL 	mozilla::dom::HTMLElementBinding::genericGetter 	HTMLElementBinding.cpp:5018
22 	XUL 	js::InvokeKernel 	jscntxtinlines.h:373
23 	XUL 	js::Invoke 	jsinterp.h:112 
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsFrameList%3A%3ADestroyFrame%28nsIFrame*%29
Seeing "nsPlaceholderFrame" in the stack I think roc's abs/fixed-pos bugs in
that range are the likely cause.  I think the regression fixes for those have
landed on aurora too.  Have the numbers of incidents dropped recently?
Flags: needinfo?(scoobidiver)
(Reporter)

Comment 2

5 years ago
(In reply to Mats Palmgren [:mats] from comment #1)
> Have the numbers of incidents dropped recently?
The latest crashes happened in 20.0a2/20130207 but they skip some builds so we can't conclude yet.
Flags: needinfo?(scoobidiver)

Comment 3

5 years ago
We'll hold on tracking in that case. Thanks for your help Scoobidiver!
The crash stack looks like it might be the same underlying problem as bug 837288.

(In reply to Mats Palmgren [:mats] from comment #1)
> I think the regression fixes for those have landed on aurora too.

Actually, there's one more fix waiting to land - I'll Cc you on the bug...
Depends on: 837288
tracking-firefox20: ? → +
Tracking in that case, since we're also tracking bug 837288
Assigning to roc (same as bug 837288) so we can know what results and if this issue is fixed by the landings in bug 837288.
Assignee: nobody → roc
(Reporter)

Comment 7

5 years ago
There have been no crashes after 20.0a2/20130212.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
status-firefox20: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla21
(In reply to Scoobidiver from comment #7)
> There have been no crashes after 20.0a2/20130212.

There are no crashes on FF 20.b1 in Soccoro for this signature.
(Reporter)

Updated

5 years ago
status-firefox20: fixed → verified
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.