Closed Bug 591657 Opened 14 years ago Closed 14 years ago

Crash in [@ nsWeakFrame::InitInternal(nsIFrame*) ] [@ nsWeakFrame::InitInternal ]

Categories

(Core :: Layout, defect)

defect
Not set
critical

Tracking

()

VERIFIED FIXED
Tracking Status
blocking2.0 --- beta5+

People

(Reporter: scoobidiver, Assigned: tnikkel)

References

Details

(Keywords: crash)

Crash Data

Attachments

(2 files)

Build : Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b5pre) Gecko/20100828 Firefox/4.0b5pre

This is a new crash signature which has been introduced by this build and it is still the #1 crasher for this build.
It is hard to reproduce.

http://crash-stats.mozilla.com/report/index/bp-c29e333b-435b-4715-8717-168c72100828
Signature    nsWeakFrame::InitInternal(nsIFrame*)
UUID    c29e333b-435b-4715-8717-168c72100828
Time     2010-08-28 10:58:21.75752
Uptime    76
Last Crash    126 seconds before submission
Install Age    17589 seconds (4.9 hours) since version was first installed.
Product    Firefox
Version    4.0b5pre
Build ID    20100828040640
Branch    2.0
OS    Windows NT
OS Version    6.1.7600
CPU    x86
CPU Info    GenuineIntel family 6 model 23 stepping 10
Crash Reason    EXCEPTION_ACCESS_VIOLATION
Crash Address    0xfffffffff0de801b

Crashing Thread
Frame     Module     Signature [Expand]     Source
0  	xul.dll  	nsWeakFrame::InitInternal  	 layout/generic/nsFrame.cpp:277
1 	xul.dll 	nsEventStateManager::DispatchMouseEvent 	content/events/src/nsEventStateManager.cpp:3635
2 	xul.dll 	nsEventStateManager::NotifyMouseOver 	content/events/src/nsEventStateManager.cpp:3746
3 	xul.dll 	nsEventStateManager::GenerateMouseEnterExit 	content/events/src/nsEventStateManager.cpp:3776
4 	xul.dll 	nsEventStateManager::PreHandleEvent 	content/events/src/nsEventStateManager.cpp:1151
5 	xul.dll 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:6727
6 	xul.dll 	PresShell::HandlePositionedEvent 	layout/base/nsPresShell.cpp:6586
7 	xul.dll 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6436
8 	xul.dll 	nsViewManager::HandleEvent 	view/src/nsViewManager.cpp:1120
9 	xul.dll 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:1098
10 	xul.dll 	AttachedHandleEvent 	view/src/nsView.cpp:193
11 	xul.dll 	nsWindow::DispatchEvent 	widget/src/windows/nsWindow.cpp:3533
12 	xul.dll 	nsWindow::DispatchWindowEvent 	widget/src/windows/nsWindow.cpp:3559
13 	xul.dll 	nsWindow::DispatchMouseEvent 	widget/src/windows/nsWindow.cpp:3982
14 	xul.dll 	nsWindow::ProcessMessage 	widget/src/windows/nsWindow.cpp:4814
15 	xul.dll 	nsWindow::WindowProcInternal 	widget/src/windows/nsWindow.cpp:4335
16 	xul.dll 	nsWindow::WindowProc 	widget/src/windows/nsWindow.cpp:4287
17 	user32.dll 	InternalCallWinProc 	
18 	user32.dll 	UserCallWinProcCheckWow 	
19 	user32.dll 	DispatchMessageWorker 	
20 	user32.dll 	DispatchMessageW 	
21 	xul.dll 	nsAppShell::ProcessNextNativeEvent 	widget/src/windows/nsAppShell.cpp:286
22 	nspr4.dll 	PR_IntervalNow 	nsprpub/pr/src/misc/prinrval.c:77
23 	xul.dll 	nsBaseAppShell::OnProcessNextEvent 	widget/src/xpwidgets/nsBaseAppShell.cpp:312
24 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:517
25 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:134
26 	xul.dll 	xul.dll@0xb96deb 	
27 	xul.dll 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:219
28 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:202
29 	xul.dll 	_SEH_epilog4 	
30 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:176
31 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:175
32 	xul.dll 	nsAppShell::Run 	widget/src/windows/nsAppShell.cpp:243
33 		@0x773bffff 	
34 		@0x76c3ffff 	
35 		@0x767affff
blocking2.0: --- → ?
I had this crash by going through the following steps:

1. logout from google if you're logged in 
2. open google analytics and go to the page with login form, for me it was:
https://www.google.com/accounts/ServiceLogin?service=analytics&hl=en-US&continue=https%3A%2F%2Fwww.google.com%2Fanalytics%2Fsettings%2F%3Fet%3Dreset%26hl%3Dpl%26et%3Dreset%26hl%3Den-US
3. move your mouse over the orange menu, i.e. open "Blog" (this item made me crash, I didn't check others) and just move your mouse around
Firefox is crashing after opening submenu and moving mouse over this submenu; when you move your mouse just over the main menu bar nothing happens

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b5pre) Gecko/20100828 Firefox/4.0b5pre
Attached file Stack trace (deleted) β€”
Regression pushlog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=01fa971e62ee&tochange=0886ad6e6aaa

Caused by Bug 587944

STR:
1. Visit: http://www.youtube.com/movies/mystery_suspense
2. Place your mouse pointer over any of the movie image tiles
3. Wait till the info pop-up appears then move your mouse off the pop-up
4. Crash.
Just got this crash surfing espn.com
Blocks: 587944
http://crash-stats.mozilla.com/report/index/535dfc51-6162-4757-9ba5-eaf1d2100828
I have enough information to reproduce, just need to fix it.
Just got it here on vzw.com.  It's not restricted to 64bit versions of Win7.

http://crash-stats.mozilla.com/report/index/b381962b-7853-4851-bbc3-54fb42100829

Mozilla/5.0 (Windows NT 6.1; rv:2.0b5pre) Gecko/20100829 Firefox/4.0b5pre ID:20100829040614
So the problem here is that nsWeakFrame weakFrame = otherWeakFrame triggers the copy constructor. Since nsWeakFrame doesn't have a copy constructor defined we get the default copy constructor, which doesn't register the weak frame with the presshell.
Sounds like it should either have a real copy constructor or we should declare the copy constructor private and leave it unimplemented.
Attached patch patch (deleted) β€” β€” Splinter Review
Assignee: nobody → tnikkel
Attachment #470380 - Flags: review?
Comment on attachment 470380 [details] [diff] [review]
patch

Setting multiple review to get a quick review so we can get this into beta5. Just need one review.
Attachment #470380 - Flags: review?(dbaron)
Attachment #470380 - Flags: review?(Olli.Pettay)
Attachment #470380 - Flags: review?
Comment on attachment 470380 [details] [diff] [review]
patch

Fix for a topcrash introduced with bug 130078, would like to fix this for beta5.
Attachment #470380 - Flags: approval2.0?
Attachment #470380 - Flags: review?(Olli.Pettay) → review+
Attachment #470380 - Flags: review?(dbaron) → review+
Attachment #470380 - Flags: approval2.0? → approval2.0+
Seeing this crash @ http://popurls.com/. All you have to do is move your mouse around the window for a few seconds and it will crash.

http://crash-stats.mozilla.com/report/index/f91b6b84-2085-46fb-8c0b-c72bc2100830
blocking2.0: ? → beta5+
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b5pre) Gecko/20100830 Firefox/4.0b5pre

I'm seeing the same crash 100% of the time on Mac OSX 10.6:
http://crash-stats.mozilla.com/report/index/bp-29612180-6a63-48e5-b342-cb5c22100830

STR:
1. Go to docs.google.com
2. Create a new form
3. Hover over the edit button (pencil) for "Sample 2"
4. *CRASH*
Adding [@ nsWeakFrame::InitInternal ] to this gets picked up in crash stats.
OS: Windows 7 → All
Hardware: x86_64 → All
Summary: Crash in [@ nsWeakFrame::InitInternal(nsIFrame*) ] → Crash in [@ nsWeakFrame::InitInternal(nsIFrame*) ] [@ nsWeakFrame::InitInternal ]
Looks like we can check this in, yes?
Checked it in a few minutes ago. I wait until all tests are green before marking the bug resolved.
RESO FIXED?
Ok, still a few jobs to finish, but I'll bend my rule just for you. :)

http://hg.mozilla.org/mozilla-central/rev/3924369cf142
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
I just checked out the latest hourly build with this fix in it, and http://popurls.com/ is no longer causing a crash. Looks good. =)
I still get this crash in the nightly version on Google Maps:
bp-83a0d66e-cdaf-406a-9539-e87d12100831
I don't think the build for that crashreport has the fix for this bug in it. A nightly with the fix for this bug has not been built yet.
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b5pre) Gecko/20100831 Firefox/4.0b5pre

My crash scenario in comment 15 has been resolved.  Marking this bug VERIFIED.
Status: RESOLVED → VERIFIED
I can confirm this - the crash whenever Element Hiding Helper extension is used (https://adblockplus.org/forum/viewtopic.php?f=1&t=5984) is gone as well.

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b5pre) Gecko/20100831 Firefox/4.0b5pre
Crash Signature: [@ nsWeakFrame::InitInternal(nsIFrame*) ] [@ nsWeakFrame::InitInternal ]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: