875253 - crash in nsMenuPopupFrame::DestroyFrom @ nsFrame::DestroyFrom

Status: RESOLVED DUPLICATE of bug 673931

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

It's #15 browser crasher in 23.0a2 and #42 in 24.0a1.
It started spiking in 23.0a1/20130508. The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b842d26dd5f0&tochange=b980d32c366f

Signature 	nsFrame::DestroyFrom(nsIFrame*) More Reports Search
UUID	74662faa-8260-453e-9cf9-72dde2130522
Date Processed	2013-05-22 05:36:43
Uptime	2197
Install Age	36.6 minutes since version was first installed.
Install Time	2013-05-22 05:59:44
Product	Firefox
Version	24.0a1
Build ID	20130521031106
Release Channel	nightly
OS	Windows NT
OS Version	6.2.9200
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 58 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0xfffffffff0de803f
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x0166, AdapterSubsysID: 05521028, AdapterDriverVersion: 9.17.10.2849
Has dual GPUs. GPU #2: AdapterVendorID2: 0x10de, AdapterDeviceID2: 0x0fd1, AdapterSubsysID2: 05521028, AdapterDriverVersion2: 9.18.13.1106D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ WebGL? EGL? EGL+ GL Context? GL Context+ WebGL+ 
Processor Notes 	sp-processor10_phx1_mozilla_com_28189:2012; non-integer value of "SecondsSinceLastCrash"
EMCheckCompatibility	True
Adapter Vendor ID	0x8086
Adapter Device ID	0x0166
Total Virtual Memory	4294836224
Available Virtual Memory	3645181952
System Memory Use Percentage	25
Available Page File	7685431296
Available Physical Memory	4680241152
Accessibility	Active

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsFrame::DestroyFrom 	layout/generic/nsFrame.cpp:663
1 	xul.dll 	nsContainerFrame::DestroyFrom 	layout/generic/nsContainerFrame.cpp:268
2 	xul.dll 	nsMenuPopupFrame::DestroyFrom 	layout/xul/base/src/nsMenuPopupFrame.cpp:1899
3 	xul.dll 	nsFrameList::DestroyFramesFrom 	layout/generic/nsFrameList.cpp:57
4 	xul.dll 	nsPopupSetFrame::DestroyFrom 	layout/xul/base/src/nsPopupSetFrame.cpp:99
5 	xul.dll 	nsContainerFrame::DestroyFrom 	layout/generic/nsContainerFrame.cpp:252
6 	xul.dll 	nsBoxFrame::DestroyFrom 	layout/xul/base/src/nsBoxFrame.cpp:945
7 	xul.dll 	nsDocElementBoxFrame::DestroyFrom 	layout/xul/base/src/nsDocElementBoxFrame.cpp:78
8 	xul.dll 	nsContainerFrame::DestroyFrom 	layout/generic/nsContainerFrame.cpp:252
9 	xul.dll 	nsBoxFrame::DestroyFrom 	layout/xul/base/src/nsBoxFrame.cpp:945
10 	xul.dll 	nsContainerFrame::DestroyFrom 	layout/generic/nsContainerFrame.cpp:252
11 	xul.dll 	nsFrameManager::Destroy 	layout/base/nsFrameManager.cpp:203
12 	xul.dll 	nsCSSFrameConstructor::WillDestroyFrameTree 	layout/base/nsCSSFrameConstructor.cpp:8552
13 	xul.dll 	PresShell::Destroy 	layout/base/nsPresShell.cpp:1049
14 	xul.dll 	nsDocumentViewer::DestroyPresShell 	layout/base/nsDocumentViewer.cpp:4373
15 	xul.dll 	nsDocumentViewer::Destroy 	layout/base/nsDocumentViewer.cpp:1615
16 	xul.dll 	nsDocumentViewer::~nsDocumentViewer 	layout/base/nsDocumentViewer.cpp:583
17 	xul.dll 	nsDocumentViewer::Release 	layout/base/nsDocumentViewer.cpp:555
18 	xul.dll 	nsCOMPtr_base::assign_with_AddRef 	obj-firefox/xpcom/build/nsCOMPtr.cpp:49
19 	xul.dll 	nsDocShell::Destroy 	docshell/base/nsDocShell.cpp:4908
20 	xul.dll 	nsXULWindow::Destroy 	xpfe/appshell/src/nsXULWindow.cpp:472
21 	xul.dll 	nsWebShellWindow::Destroy 	xpfe/appshell/src/nsWebShellWindow.cpp:754
22 	xul.dll 	nsWebShellWindow::RequestWindowClose 	xpfe/appshell/src/nsWebShellWindow.cpp:311
23 	xul.dll 	nsWindow::ProcessMessage 	widget/windows/nsWindow.cpp:4768
24 	xul.dll 	nsWindow::WindowProcInternal 	widget/windows/nsWindow.cpp:4390
25 	xul.dll 	CallWindowProcCrashProtected 	xpcom/base/nsCrashOnException.cpp:32
26 	xul.dll 	nsWindow::WindowProc 	widget/windows/nsWindow.cpp:4342
27 	user32.dll 	InternalCallWinProc 	
28 	user32.dll 	UserCallWinProcCheckWow 	
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsFrame%3A%3ADestroyFrom%28nsIFrame*%29

Comment 1

[Mats Palmgren (inactive)]

My gut feeling is that this is related to bug 850571, but let's keep this
separate for now.  Are there any interesting URLs related to this signature
that can help us reproduce the crash?  (you can restrict the query to 23.x
and 24.x)

Comment 2

[Tracy Walker [:tracy]]

top URL's from crash-stats:

19 	https://www.facebook.com/
17 	about:blank
11 	https://muisca.dian.gov.co/WebDiligenciamiento/DefGestionFirmasPopup.faces
6 	http://www.yandex.ru/
2 	https://www.facebook.com/?ref=tn_tnmn
2 	http://www.yandex.ua/
2 	http://www.facebook.com/logout.php
2 	http://www.facebook.com/
2 	http://www.udenti.li/luse.php

Comment 3

[kalviskajaks]

Im not sure if i need to post in bug 673931 or bug 875253 so im posting in both. Sorry. 

I can reproduce this crash in nightly. Steps are
1) Open firefox
2) Go to http://www.youtube.com/watch?v=73K6CTuSWxo
3) Close firefox
4) Crash

Crash report link
https://crash-stats.mozilla.com/report/index/87ced348-3eac-46c9-b048-5362a2131108

Tested mozilla-inbound builds from http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-win32/

http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-win32/1383850066/

no crash

http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-win32/1383850244/

crash

Comment 4

[Timothy Nikkel (:tnikkel)]

That gives this range
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=471db633b20c&tochange=fe7fe682aa17

This doesn't seem a very likely patch to cause this, especially since this crash has existed since before that patch landed. More likely is that the bug doesn't reproduce every time so getting a regression range would be tricky to do.

The STR are very helpful. I will try to reproduce with them.

Comment 5

[kalviskajaks]

Looks like your right. Just tried again and turns out it has like 75% percent chance to crash doing the same steps repeatedly. Will try zero in on the range again.

Comment 6

[kalviskajaks]

Sigh.. Seems that every build up to the oldest available one from 
https://crash-stats.mozilla.com/report/index/87ced348-3eac-46c9-b048-5362a2131108 
crashes. Tried quite a few of them. The bug not happening every time when repeating steps makes the testing quite tedious.

Thank god i actually looked into one of the crash reports and the signature in some of them had changed!

Signature: xul.dll@0x4ce901 | xul.dll@0x25fddb | xul.dll@0x25da63 | xul.dll@0x2315b3 | xul.dll@0x24ba57 | xul.dll@0x23c920 | xul.dll@0x2515f3 | xul.dll@0x24ba57 | xul.dll@0x231596 | xul.dll@0x24ba57 | xul.dll@0x23c920 | xul.dll@0x2515f3 | xul.dll@0x25da63 | xul.d...

https://crash-stats.mozilla.com/report/index/13198b1b-8b16-4d91-9589-7d3842131111

Due to firefox not crashing every time while testing, i could not pinpoint, if 
a)there is a build at which the crash signature changes from one to another 
or 
b)they both have a chance to happen and its just random which one will you get when closing window.

P.S. Interesting coincidence. Several months ago i had the crash in Bug 850571, which is now fixed. But the steps to reproduce where/are identical to this bug.

Hope this helps.

Comment 7

[Robert Kaiser]

Usually, the signature change when inducing crashes right now might just indicate the point when we remove symbols from the server. But then, the build of bp-13198b1b-8b16-4d91-9589-7d3842131111 is only from 2013-11-07, so 4 days ago, and we surely have not removed symbols for that yet. But then, this might not be a nightly build and we IIRC only have symbols for nightly builds.

Comment 8

[kalviskajaks]

Latest nightly, firefox still is crashing on demand. Anybody plans to do something about this?

Comment 9

[Tobias B. Besemer [:BesTo] (QA)]

While shooting down FF41.0a2, 64bit, e10s on Win7, 64bit, the plugin-container.exe stops with this signature too: https://crash-stats.mozilla.com/report/index/161ab947-ef1c-43a3-bc9a-798c82150803
(Now more the one time ...)

Is this the same problem?
(Be a lot of time on Facebbok.com ...)

Crashing Thread
Frame 	Module 	Signature 	Source
0 	xul.dll 	nsFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsFrame.cpp
1 	xul.dll 	nsContainerFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsContainerFrame.cpp
2 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) 	layout/generic/nsLineBox.cpp
3 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsBlockFrame.cpp
4 	xul.dll 	nsContainerFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsContainerFrame.cpp
5 	xul.dll 	nsFrameList::DestroyFramesFrom(nsIFrame*) 	layout/generic/nsFrameList.cpp
6 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsBlockFrame.cpp
7 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) 	layout/generic/nsLineBox.cpp
8 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsBlockFrame.cpp
9 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) 	layout/generic/nsLineBox.cpp
10 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsBlockFrame.cpp
11 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) 	layout/generic/nsLineBox.cpp
12 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsBlockFrame.cpp
13 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) 	layout/generic/nsLineBox.cpp
14 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsBlockFrame.cpp
15 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) 	layout/generic/nsLineBox.cpp
16 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsBlockFrame.cpp
17 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) 	layout/generic/nsLineBox.cpp
18 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsBlockFrame.cpp
19 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) 	layout/generic/nsLineBox.cpp
20 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsBlockFrame.cpp
21 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) 	layout/generic/nsLineBox.cpp
22 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsBlockFrame.cpp
23 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) 	layout/generic/nsLineBox.cpp
24 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsBlockFrame.cpp
25 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) 	layout/generic/nsLineBox.cpp
26 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsBlockFrame.cpp
27 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) 	layout/generic/nsLineBox.cpp
28 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsBlockFrame.cpp
29 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) 	layout/generic/nsLineBox.cpp
30 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsBlockFrame.cpp
31 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) 	layout/generic/nsLineBox.cpp
32 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsBlockFrame.cpp
33 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) 	layout/generic/nsLineBox.cpp
34 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsBlockFrame.cpp
35 	xul.dll 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*) 	layout/generic/nsLineBox.cpp
36 	xul.dll 	nsBlockFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsBlockFrame.cpp
37 	xul.dll 	nsContainerFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsContainerFrame.cpp
38 	xul.dll 	nsContainerFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsContainerFrame.cpp
39 	xul.dll 	nsContainerFrame::DestroyFrom(nsIFrame*) 	layout/generic/nsContainerFrame.cpp
40 	xul.dll 	nsFrameManager::Destroy() 	layout/base/nsFrameManager.cpp
41 	xul.dll 	PresShell::Destroy() 	layout/base/nsPresShell.cpp
42 	xul.dll 	nsDocumentViewer::DestroyPresShell() 	layout/base/nsDocumentViewer.cpp
43 	xul.dll 	nsDocumentViewer::Destroy() 	layout/base/nsDocumentViewer.cpp
44 	xul.dll 	nsDocShell::Destroy() 	docshell/base/nsDocShell.cpp
45 	xul.dll 	nsWebBrowser::SetDocShell(nsIDocShell*) 	embedding/browser/nsWebBrowser.cpp
46 	xul.dll 	nsWebBrowser::InternalDestroy() 	embedding/browser/nsWebBrowser.cpp
47 	xul.dll 	nsWebBrowser::Destroy() 	embedding/browser/nsWebBrowser.cpp
48 	xul.dll 	mozilla::dom::TabChild::DestroyWindow() 	dom/ipc/TabChild.cpp
49 	xul.dll 	mozilla::dom::TabChild::RecvDestroy() 	dom/ipc/TabChild.cpp
50 	xul.dll 	mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PBrowserChild.cpp
51 	xul.dll 	mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PContentChild.cpp
52 	xul.dll 	mozilla::ipc::MessageChannel::DispatchMessageW(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
53 	xul.dll 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	ipc/glue/MessageChannel.cpp
54 	xul.dll 	RunnableMethod<mozilla::ipc::MessageChannel, void ( mozilla::ipc::MessageChannel::*)(void), Tuple0>::Run() 	ipc/chromium/src/base/task.h
55 	xul.dll 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
56 	xul.dll 	mozilla::ipc::DoWorkRunnable::Run() 	ipc/glue/MessagePump.cpp
57 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
58 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
59 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
60 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
61 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
62 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
63 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp
64 	xul.dll 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp
65 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
66 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
67 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
68 	xul.dll 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp
69 	plugin-container.exe 	content_process_main(int, char** const) 	ipc/contentproc/plugin-container.cpp
70 	plugin-container.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
71 	plugin-container.exe 	__tmainCRTStartup 	f:/dd/vctools/crt/crtw32/startup/crt0.c:255
72 	kernel32.dll 	BaseThreadInitThunk 	
73 	ntdll.dll 	RtlUserThreadStart

Comment 10

[Tobias B. Besemer [:BesTo] (QA)]

Guess it don't really depends on Bug Bug 673931 ...

Comment 11

[Mats Palmgren (inactive)]

(In reply to Tobias B. Besemer [:BesTo] (QA) from comment #9)
> Is this the same problem?

No, that looks like a separate problem.  Please file a new bug.

Comment 12

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'nsFrame::DestroyFrom':
 - nightly(version 50):1 crash from 2016-06-06.
 - aurora (version 49):1 crash from 2016-06-07.
 - beta   (version 48):177 crashes from 2016-06-06.
 - release(version 47):348 crashes from 2016-05-31.
 - esr    (version 45):14 crashes from 2016-04-07.

Crash volume on the last weeks:
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       0       0       0       0       1       0       0
 - aurora        0       0       1       0       0       0       0
 - beta         23      15      23      27      19      25      29
 - release      44      54      50      42      42      50      58
 - esr           1       0       1       1       2       1       3

Affected platforms: Windows, Mac OS X, Linux

Comment 13

[Daniel Holbert [:dholbert]]

Dropping to S3 given low crash volume.

Comment 14

[Daniel Holbert [:dholbert]]

And actually, all of the crashes in the last 6 months are in 78esr or older. Looks like this went away at some point after that, probably because nsFrame::DestroyFrom no longer exists under that name; it was renamed to nsIFrame::DestroyFrom (note the "I") in bug 1630704 as part of Firefox 80.

We do have bug 673931 which has the function's new name as one of its crash signatures; let's just dupe this to that bug, since any crashes here would now be under that bug's umbrella.

Comment 15

[Daniel Holbert [:dholbert]]

Looks like I have to clear the crash signature field here or else the relman bot will insist on copying these nonexistent-as-of-firefox-80 crash signatures over to the dupe target.