QA/Topcrashes: Difference between revisions

From MozillaWiki
< QA
Jump to navigation Jump to search
No edit summary
 
(263 intermediate revisions by 10 users not shown)
Line 1: Line 1:
'''In progress. I have a lot more work to do on this page.'''
This page is a tracking document for handling and following topcrashes on the trunk.


This page is a tracking document for handling and following topcrashes on the trunk.
Info on weekly status meetings for tracking improvements to the crash reporting system is at [[Breakpad/Status_Meetings]]
 
If you find an extension or plugin that is the source of a crash consider filing a blocklist request - [[Blocklisting]]
 
An archive of this page is available here: [[QA/Topcrashes/Archive]]


__TOC__
__TOC__


== Current topcrashes being tracked for beta 4 ==
== Current topcrashes being tracked 3.5b4 ==
=== Summary ===
'''Date''' - Summary
 
=== Queries ===
* [http://crash-stats.mozilla.com/?do_query=1&product=Firefox&version=Firefox%3A3.5b4&query_search=signature&query_type=contains&query=&date=&range_value=1&range_unit=weeks Firefox 3.5b4 crashes in the past 1 ''week'']
* [http://crash-stats.mozilla.com/?do_query=1&product=Firefox&version=Firefox%3A3.5b4&query_search=signature&query_type=contains&query=&date=&range_value=1&range_unit=days Firefox 3.5b4 crashes in the past 1 ''day'']
* [http://crash-stats.mozilla.com/?do_query=1&product=Firefox&version=Firefox%3A3.5b4&query_search=signature&query_type=contains&query=&date=&range_value=4&range_unit=hours Firefox 3.5b4 crashes in the past 4 ''hours'']
 
=== List ===
(Using the last week query.


{| class="fullwidth-table"
{| class="fullwidth-table"
Line 13: Line 27:
| style="background:#efefef" | '''where'''
| style="background:#efefef" | '''where'''
| style="background:#efefef" | '''status'''
| style="background:#efefef" | '''status'''
|-
|-  
| 1
| 1
| {{bug|422018}}
| {{bug|491514}}
| googletoolbar.dll@0x4b2f libgoogletoolbar.dylib@0x4fbd
| nanojit::LIns::isTramp()
| google toolbar?  core?
| js engine / nanojit
|
| possible fix landed; crash "went away" on trunk with landing of {{bug|488775}}
|-
|-  
| 2, 3, 14, 17
| 2
| {{bug|416521}} (70%), {{bug|422024}} (20%)
| {{bug|462728}}
| RtlEnterCriticalSection, free, arena_dalloc_small, ntdll.dll@0x42e7b
| nsJARChannel::OnStartRequest(nsIRequest*, nsISupports*)
| this is what shows up when we crash in free()
| networking: jar
| {{bug|422024}} is related to scriptable plugin API
| patch in bug, landed on trunk
|-
|-
| 3
| {{bug|467167}}
| _PR_MD_SEND
| netwerk
| probably malware; timeless thinks LSPs, but not clear that's possible with module analysis.
|-  
| 4
| 4
| {{bug|470500}}
| nssutil3.dll@0x34c0
|  
|  
| MultiByteToWideChar
| (was 11)
| internet download manager
|-  
| always has to do with idmmzcc.dll, which some Google searches associate with [http://www.internetdownloadmanager.com/ internet download manager]
| 5
|-
| {{bug|492492}}
| 5, 15
| libawt.jnilib@0x11e1
| {{bug|421303}}
| java on Mac?
| jsds_ScriptHookProc
| seems to happen when trying to download windows 7 rc on mac... but how? that requires activex. need more investigation.
|
|-  
| Fixed, 2008-03-10
|-
| 6
| 6
| maybe {{bug|292549}} or {{bug|380015}}
| {{bug|470487}}
| nsFrame::BoxReflow
| nsWindow::GetParentWindow()
|
| widget
|
| might require major rework; could pick up in 1.9.1.x release
|-
|-  
| 7
| 7
| {{bug|422028}}
| {{bug|493177}}
| JS_SetPrivate
| js_Interpret
|
| think these js_Interp and upVar bugs are all fixed in the same bug.
| related to scriptable plugin API
|  
|-
|-  
| 8, 13
| 8
| {{bug|419695}}
| {{bug|492504}}
| js_GetGCThingTraceKind, JS_CallTracer, JS_TraceChildren
| js3250.dll@0x73075
| crashing on yahoo mail  (maybe not all of the JS_CallTracer crashes, though?)
| seen on many facebook apps and ebay auctions
|
|  
|-
|-  
| 9
| 9
| {{bug|391311}}
| {{bug|492675}}
| nsChromeRegistry::CheckForNewChrome
| nsStyleSet::FileRules(int (*)(nsIStyleRuleProcessor*, void*), RuleProcessorData*)
|
|  
|
|  
|-
|-  
| 10
| 10
| {{bug|418384}}
| {{bug|493287}}
| ClientData::GetOtlTable
| gfxTextRun::`vector deleting destructor'(unsigned int)
|
|  
| has testcase (requires particular font)
|  
|-
|-  
| 11
| 11
| {{bug|418381}}
| {{bug|485799}}
| HashString
| memmove
|
|  
|
|  
|-
|-  
| 12
| 12
|
| {{bug|470487}}
| piclens.dll
| nsBaseWidget::Destroy()
| the [http://piclens.com piclens] extension
| getting closer to understanding plugin window destruction prob.
| their extension doesn't appear to be compatible, or marked as such (although it can't be installed due to not providing secure updates), and the crash is exactly what you'd expect from using a binary extension with incompatible interface changes.  Is this entirely from people overriding extension compat?
|  
|-
|-
| 13
|
| PL_DHashTableOperate
|
|
|-
| 14
|
| dtoa
|
|
|-
| 15
|
| nsSocketTransport::OnSocketEvent(unsigned int, unsigned int, nsISupports*)
|
|
|-  
| 16
| 16
| 0x0
|  
|
| GraphWalker::DoWalk(nsDeque&)
| didn't find any common patterns in sample of ten; this is mixed crashes (although about half the stacks are useless) -[[User:Dbaron|David Baron]]
|
|
|  
|-
|-  
| 17
|
| arena_dalloc_small | arena_dalloc
|  
|  
|-  
| 18
| 18
| {{bug|418382}}
| UniscribeItem::SaveGlyphs(gfxTextRun*)
| core
|  
|  
|-
| ntdll.dll@0x43387
| 19 (2 on mac)
|
| {{bug|421294}}
|
| DocumentViewerImpl::GetCopyable
|-  
|
| 19
| fixed 2008-03-06
| {{bug|485072}}
| CallQueryInterface<nsISupports, nsXPCOMCycleCollectionParticipant>(nsISupports*, nsXPCOMCycleCollectionParticipant**)
| Crashes at shutdown and after installing a new add on
|
|-
| 20
|
| @0x0
|
|
|-
| 21
| {{bug|492487}}
| js_DeepBail
| easy to reproduce on aim.search.aol.com
|
|-
| 27
| {{bug|491604}}
| js_NewGCThing
| js engine, likely
| bug just filed
|-  
| 33+97 maybe others
| {{bug|492496}}
|  [@ specializeTreesToMissingGlobals ] js3250.dll@0x60b87 js3250.dll@0x60b7e
| one-clickr and boom!
|
|}
|}


== Current topcrashes being tracked for beta 3 ==
== Current topcrashes being tracked 3.0.11 ==
Topcrashers for beta3 are currently considered "old". We need to re-track for beta4. I'm using this "old" data as sample data to see if what format works.
=== Summary ===
'''Date''' -
 
=== Queries ===
 
* [http://crash-stats.mozilla.com/query/query?do_query=1&product=Firefox&version=Firefox%3A3.0.11&query_search=signature&query_type=contains&query=&date=&range_value=7&range_unit=days Firefox 3.0.11 crashes in the past 1 ''week'']
* [http://crash-stats.mozilla.com/query/query?do_query=1&product=Firefox&version=Firefox%3A3.0.11&query_search=signature&query_type=contains&query=&date=&range_value=1&range_unit=days Firefox 3.0.11 crashes in the past 1 ''day'']
* [http://crash-stats.mozilla.com/query/query?do_query=1&product=Firefox&version=Firefox%3A3.0.11&query_search=signature&query_type=contains&query=&date=&range_value=4&range_unit=hours Firefox 3.0.11 crashes in the past 4 ''hours'']
 
=== List ===


{| class="fullwidth-table"
{| class="fullwidth-table"
Line 108: Line 185:
| style="background:#efefef" | '''where'''
| style="background:#efefef" | '''where'''
| style="background:#efefef" | '''status'''
| style="background:#efefef" | '''status'''
|-
|-
| 1
| {{bug|482578}}
| nsSubDocumentFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&)
| dom
| patch in bug; hoping to take it in 1.9.0.13
|-
| 2
| {{bug|498971}}
| Flash_EnforceLocalSecurity
| mac-only flash
| came out of nowhere; likely caused by flash upgrade/problem/bad ad
|-
| 3
| {{bug|467167}}
| _PR_MD_SEND
|
| probably malware
|-  
| 4
| 4
| [https://bugzilla.mozilla.org/show_bug.cgi?id=405357 405357]
| {{bug|427715}}
| jpinscp.dll@0xcf45
| NSSRWLock_LockRead_Util
| java plugin
| psm
|
| patch in bug; might take in 1.9.0.13
|-
|-
| 5
| {{bug|498971}}
| CFReadStreamGetStatus
| mac-only flash
| came out of nowhere; likely caused by flash upgrade/problem/bad ad
|-  
| 6
| 6
| [https://bugzilla.mozilla.org/show_bug.cgi?id=418378 418378]
| {{bug|444930}}
| nsGlobalWindow::SaveWindowState(nsISupports**)
| nsIFrame::GetAncestorWithView()
| core
| plug-ins
|  
|  
|-
|-  
| 7
| 7
| [https://bugzilla.mozilla.org/show_bug.cgi?id=391311 391311]
| {{bug|500575}}, {{bug|464213}}
| nsChromeRegistry::CheckForNewChrome
| ntdll.dll@0x43387
| core
| plugins/add-ons
| some flash, some Norton Confidential (coFFPlgn.dll), a bunch of [http://www.eset.com/products/nod32.php NOD32] crashes (imon.dll)
|-
| 8
|  
| @0x0
|  
|  
|-
| needs investigation
|-  
| 9
| 9
| [https://bugzilla.mozilla.org/show_bug.cgi?id=418382 418382]
| {{bug|466024}}
| UniscribeItem::SaveGlyphs(gfxTextRun*)
| nsStyleSet::AddImportantRules(nsRuleNode*, nsRuleNode*)
| core
| css/add-on?
| probably caused by bad toolbar/add-ons
|-
| 10
| {{bug|437449}}
| nsCycleCollector::MarkRoots(GCGraphBuilder&)
| xpcom
|  
|  
|-
|-  
| 11
| 11
| [https://bugzilla.mozilla.org/show_bug.cgi?id=418381 418381]
| HashString(nsAString_internal const&)
| core
|  
|  
|-
| PL_DHashTableOperate
|
| needs investigation
|-
| 12
| {{bug|500105}}
| GraphWalker::DoWalk(nsDeque&)
|
|
|-
| 13
|
| arena_run_reg_alloc
|
| needs investigation
|-  
| 14
| 14
| [https://bugzilla.mozilla.org/show_bug.cgi?id=418379 418379]
| nsNavHistoryFolderResultNode::FindChildById(__int64, unsigned int*)
| core
|  
|  
|-
| memcpy | fillInCell
|
| needs investigation
|-
| 15
|
| user32.dll@0x11911
|
| needs investigation
|-
| 16
| {{bug|470487}}
| nsWindow::GetParentWindow()
| widget
| supposedly fixed on 1.9.1, but not really; maybe fixed in {{bug|493601}} for 1.9.0.12
|-
| 17
|
| kernel32.dll@0x12afb
|
|
|-
| 18
|
| avgssff.dll@0x9ba3
|
|
|-
| 19
|
| msvcr80.dll@0xf880
|
|
|-
| 20
|
| NPSWF32.dll@0x15a4bf
|
|
|-
| 21
|
| GoogleDesktopMozilla.dll@0x5512
| google desktop
|
|-
| 22
|
| wcslen
|
|
|-
| 23
|
| user32.dll@0x8815
|
|
|-
| 24
|
| msvcr80.dll@0xf870
|
|
|-
| 25
|
| msvcrt.dll@0x37fd4
|
|
|-  
| 26
| 26
| [https://bugzilla.mozilla.org/show_bug.cgi?id=418384 418384]
| ClientData::GetOtlTable(long, unsigned char const**, unsigned long*)
| core
|  
|  
|-
| js_TraceObject
|
|
|-
| 27
|
| ntdll.dll@0x1b21a
|
|
|-
| 28
|
| Flash Player@0x91bd0
|
|
|-
| 29
|
| coFFPlgn.dll@0x2e2f1
|
|
|-
| 30
|
| radhslib.dll@0x3b6f
|
|
|-
| 31
|
| NPSWF32.dll@0xa7edc
|
|
|-
| 32
|
| JS_TraceChildren
|
|
|-
| 33
|
| coWbAuth.dll@0x14e9e
|
|
|-
| 34
|
| GoogleDesktopMozilla.dll@0x5500
|
|
|-
| 35
|
| RtlpWaitForCriticalSection
|
|
|-
| 36
|
| ageSelectionCallback
|
|
|-  
| 37
| 37
| [https://bugzilla.mozilla.org/show_bug.cgi?id=380015 380015]
|  
| nsFrame::BoxReflow(nsBoxLayoutState&, nsPresContext*, nsHTMLReflowMetrics&, nsIRenderingContext*, int, int, int, int, int)
| NPSWF32.dll@0xbbff7
| core
|
|
|-
| 38
|
| ntdll.dll@0x19c2f
|
|
|-
| 39
|
| NPSWF32.dll@0x7c043
|
|
|-
| 40
|
| GoogleDesktopNetwork3.dll@0x3dfb
|
|
|-
| 41
|
| extent_tree_ad_s_RB_REMOVE
|
|
|-
| 42
|
| nsBaseWidget::Destroy()
|
|
|-
| 43
|
| @0x0 | coFFPlgn.dll@0x2db6a
|
|
|-
| 44
|
| js_GC
|
|
|-
| 45
|
| UserCallWinProcCheckWow
|
|
|-
| 46
|
| NPSWF32.dll@0x1b9cf9
|
|
|-
| 47
|
| RaiseException
|
|
|-
| 48
|
| js_Interpret
|
|
|-
| 49
|
| NPSWF32.dll@0x77540
|  
|
|-
| 50
|
| nsGenericElement::cycleCollection::Traverse(void*, nsCycleCollectionTraversalCallback&)
|  
|  
|  
|}
|}
== What do I do? ==
So, someone CCed you to a topcrash bug and asked for your help. What should you do?
There are several steps that developers and QA need to go through to help fix a crash. As a developer, we're specifically asking that you comment in the bug when you've completed all the steps and specifically state which steps you completed.

Latest revision as of 01:28, 26 June 2009

This page is a tracking document for handling and following topcrashes on the trunk.

Info on weekly status meetings for tracking improvements to the crash reporting system is at Breakpad/Status_Meetings

If you find an extension or plugin that is the source of a crash consider filing a blocklist request - Blocklisting

An archive of this page is available here: QA/Topcrashes/Archive

Current topcrashes being tracked 3.5b4

Summary

Date - Summary

Queries

List

(Using the last week query.

# bug stack where status
1 bug 491514 nanojit::LIns::isTramp() js engine / nanojit possible fix landed; crash "went away" on trunk with landing of bug 488775
2 bug 462728 nsJARChannel::OnStartRequest(nsIRequest*, nsISupports*) networking: jar patch in bug, landed on trunk
3 bug 467167 _PR_MD_SEND netwerk probably malware; timeless thinks LSPs, but not clear that's possible with module analysis.
4 bug 470500 nssutil3.dll@0x34c0 (was 11)
5 bug 492492 libawt.jnilib@0x11e1 java on Mac? seems to happen when trying to download windows 7 rc on mac... but how? that requires activex. need more investigation.
6 bug 470487 nsWindow::GetParentWindow() widget might require major rework; could pick up in 1.9.1.x release
7 bug 493177 js_Interpret think these js_Interp and upVar bugs are all fixed in the same bug.
8 bug 492504 js3250.dll@0x73075 seen on many facebook apps and ebay auctions
9 bug 492675 nsStyleSet::FileRules(int (*)(nsIStyleRuleProcessor*, void*), RuleProcessorData*)
10 bug 493287 gfxTextRun::`vector deleting destructor'(unsigned int)
11 bug 485799 memmove
12 bug 470487 nsBaseWidget::Destroy() getting closer to understanding plugin window destruction prob.
13 PL_DHashTableOperate
14 dtoa
15 nsSocketTransport::OnSocketEvent(unsigned int, unsigned int, nsISupports*)
16 GraphWalker::DoWalk(nsDeque&)
17 arena_dalloc
18 ntdll.dll@0x43387
19 bug 485072 CallQueryInterface<nsISupports, nsXPCOMCycleCollectionParticipant>(nsISupports*, nsXPCOMCycleCollectionParticipant**) Crashes at shutdown and after installing a new add on
20 @0x0
21 bug 492487 js_DeepBail easy to reproduce on aim.search.aol.com
27 bug 491604 js_NewGCThing js engine, likely bug just filed
33+97 maybe others bug 492496 [@ specializeTreesToMissingGlobals ] js3250.dll@0x60b87 js3250.dll@0x60b7e one-clickr and boom!

Current topcrashes being tracked 3.0.11

Summary

Date -

Queries

List

# bug stack where status
1 bug 482578 nsSubDocumentFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) dom patch in bug; hoping to take it in 1.9.0.13
2 bug 498971 Flash_EnforceLocalSecurity mac-only flash came out of nowhere; likely caused by flash upgrade/problem/bad ad
3 bug 467167 _PR_MD_SEND probably malware
4 bug 427715 NSSRWLock_LockRead_Util psm patch in bug; might take in 1.9.0.13
5 bug 498971 CFReadStreamGetStatus mac-only flash came out of nowhere; likely caused by flash upgrade/problem/bad ad
6 bug 444930 nsIFrame::GetAncestorWithView() plug-ins
7 bug 500575, bug 464213 ntdll.dll@0x43387 plugins/add-ons some flash, some Norton Confidential (coFFPlgn.dll), a bunch of NOD32 crashes (imon.dll)
8 @0x0 needs investigation
9 bug 466024 nsStyleSet::AddImportantRules(nsRuleNode*, nsRuleNode*) css/add-on? probably caused by bad toolbar/add-ons
10 bug 437449 nsCycleCollector::MarkRoots(GCGraphBuilder&) xpcom
11 PL_DHashTableOperate needs investigation
12 bug 500105 GraphWalker::DoWalk(nsDeque&)
13 arena_run_reg_alloc needs investigation
14 fillInCell needs investigation
15 user32.dll@0x11911 needs investigation
16 bug 470487 nsWindow::GetParentWindow() widget supposedly fixed on 1.9.1, but not really; maybe fixed in bug 493601 for 1.9.0.12
17 kernel32.dll@0x12afb
18 avgssff.dll@0x9ba3
19 msvcr80.dll@0xf880
20 NPSWF32.dll@0x15a4bf
21 GoogleDesktopMozilla.dll@0x5512 google desktop
22 wcslen
23 user32.dll@0x8815
24 msvcr80.dll@0xf870
25 msvcrt.dll@0x37fd4
26 js_TraceObject
27 ntdll.dll@0x1b21a
28 Flash Player@0x91bd0
29 coFFPlgn.dll@0x2e2f1
30 radhslib.dll@0x3b6f
31 NPSWF32.dll@0xa7edc
32 JS_TraceChildren
33 coWbAuth.dll@0x14e9e
34 GoogleDesktopMozilla.dll@0x5500
35 RtlpWaitForCriticalSection
36 ageSelectionCallback
37 NPSWF32.dll@0xbbff7
38 ntdll.dll@0x19c2f
39 NPSWF32.dll@0x7c043
40 GoogleDesktopNetwork3.dll@0x3dfb
41 extent_tree_ad_s_RB_REMOVE
42 nsBaseWidget::Destroy()
43 coFFPlgn.dll@0x2db6a
44 js_GC
45 UserCallWinProcCheckWow
46 NPSWF32.dll@0x1b9cf9
47 RaiseException
48 js_Interpret
49 NPSWF32.dll@0x77540
50 nsGenericElement::cycleCollection::Traverse(void*, nsCycleCollectionTraversalCallback&)
Retrieved from "https://wiki.mozilla.org/index.php?title=QA/Topcrashes&oldid=152020"