876594 - crash in nsObjectFrame::SetEmptyWidgetConfiguration

Status: RESOLVED INCOMPLETE

(Core :: Layout, defect, P5)

Description

[Scoobidiver (away)]

It's #48 browser crasher in 23.0a2 and #363 in 24.0a1.
With the stack trace below, it first showed up in 23.0a1/20130428. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=0e45f1b9521f&tochange=9d8977cbbfc6

Signature 	nsTArray_Impl<nsIntRect, nsTArrayInfallibleAllocator>::Clear() More Reports Search
UUID	040522b2-0fc9-48b1-8525-6075d2130527
Date Processed	2013-05-27 09:44:49
Uptime	95347
Last Crash	1.1 days before submission
Install Age	1.2 days since version was first installed.
Install Time	2013-05-26 05:22:34
Product	Firefox
Version	24.0a1
Build ID	20130524050555
Release Channel	nightly
OS	Windows NT
OS Version	6.2.9200
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 58 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x0166, AdapterSubsysID: 00000000, AdapterDriverVersion: 9.17.10.2817
Processor Notes 	sp-processor04_phx1_mozilla_com_24908:2012; WARNING: raw_crash missing Add-ons
EMCheckCompatibility	True
Adapter Vendor ID	0x8086
Adapter Device ID	0x0166
Total Virtual Memory	4294836224
Available Virtual Memory	3396653056
System Memory Use Percentage	46
Available Page File	2035851264
Available Physical Memory	2244579328

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsTArray_Impl<nsIntRect,nsTArrayInfallibleAllocator>::Clear 	obj-firefox/dist/include/nsTArray.h:1121
1 	xul.dll 	nsObjectFrame::SetEmptyWidgetConfiguration 	layout/generic/nsObjectFrame.h:115
2 	xul.dll 	SetPluginHidden 	layout/base/nsPresContext.cpp:2621
3 	xul.dll 	nsTHashtable<nsBaseHashtableET<nsCStringHashKey,`anonymous namespace'::AutoHasht 	obj-firefox/dist/include/nsTHashtable.h:486
4 	xul.dll 	PL_DHashTableEnumerate 	obj-firefox/xpcom/build/pldhash.cpp:714
5 	xul.dll 	nsTHashtable<nsPtrHashKey<mozilla::dom::Element> >::EnumerateEntries 	obj-firefox/dist/include/nsTHashtable.h:237
6 	xul.dll 	nsRootPresContext::ComputePluginGeometryUpdates 	layout/base/nsPresContext.cpp:2637
7 	xul.dll 	nsLayoutUtils::PaintFrame 	layout/base/nsLayoutUtils.cpp:2114
8 	xul.dll 	PresShell::Paint 	layout/base/nsPresShell.cpp:5588
9 	xul.dll 	nsViewManager::ProcessPendingUpdatesForView 	view/src/nsViewManager.cpp:402
10 	xul.dll 	nsRefreshDriver::Tick 	layout/base/nsRefreshDriver.cpp:1049
11 	xul.dll 	nsTArray_Impl<nsCOMPtr<nsIAtom>,nsTArrayInfallibleAllocator>::AppendElements<nsC 	obj-firefox/dist/include/nsTArray.h:1044
12 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:547
13 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:634
14 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:627
15 	xul.dll 	NS_ProcessNextEvent 	obj-firefox/xpcom/build/nsThreadUtils.cpp:238
16 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:82
17 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:212
18 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:186
19 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:163
20 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:113
21 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:269
22 	xul.dll 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3872
23 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3939
24 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:4151
25 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp:272
26 	firefox.exe 	NS_internal_main 	browser/app/nsBrowserApp.cpp:632
27 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:105
28 	firefox.exe 	__tmainCRTStartup 	crtexe.c:552
29 	kernel32.dll 	BaseThreadInitThunk 	
30 	ntdll.dll 	ntdll.dll@0x5bf39 	
31 	ntdll.dll 	ntdll.dll@0x5bf0c 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsTArray_Impl%3CnsIntRect%2C+nsTArrayInfallibleAllocator%3E%3A%3AClear%28%29

Comment 1

[Mats Palmgren (inactive)]

There are only three reports in the past 28 days matching "SetEmptyWidgetConfiguration".
Two of them have "[e-mail]" in the list of extensions.

Comment 2

[Mats Palmgren (inactive)]

I think these might be the same problem:
bp-74975821-183e-4507-97b3-09b902150521
bp-abc150f9-ce2f-485d-92bf-943e82150520

i.e. the nsObjectFrame::SetEmptyWidgetConfiguration stack frame is gone
now (at least in some builds).  It still occurs in others:
bp-3a1310cc-4bcb-4a10-b938-9acd42150511

There are a few SeaMonkey crashes with this stack:
nsPluginFrame::SetEmptyWidgetConfiguration()
SetPluginHidden
...

e.g. bp-0a648107-4afc-4c53-a87a-39b132150518
which is probably the same issue.

It's still very low volume.  There are zero crashes in Firefox 37/38 which is
the versions most users are on atm, so I don't think it's worth tracking this.