1265280 - crash in nsStyleContext::StyleDisplay, called from ZIndexForFrame

Status: RESOLVED WORKSFORME

(Core :: Web Painting, defect)

Description

[Nicholas Nethercote [inactive]]

This bug was filed from the Socorro interface and is 
report bp-3b40b941-49b4-4c83-beff-51ecc2160417.
=============================================================

We've gotten a handful of these crashes in each of the past 3 Nightly builds (20160415030231, 20160416030220, 20160417030601).

The stack is different to the one from bug 1256500 because the second frame is different:

>  0 	xul.dll 	nsStyleContext::StyleDisplay() 	obj-firefox/dist/include/nsStyleStructList.h
> 1 	xul.dll 	ZIndexForFrame 	layout/base/nsDisplayList.cpp
> 2 	xul.dll 	IsZOrderLEQ 	layout/base/nsDisplayList.cpp
> 3 	xul.dll 	Sort 	layout/base/nsDisplayList.cpp
> 4 	xul.dll 	nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsRect const&, nsDisplayList*) 	layout/generic/nsFrame.cpp
> 5 	xul.dll 	nsSubDocumentFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsSubDocumentFrame.cpp
> 6 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 7 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp
> 8 	xul.dll 	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsBlockFrame.cpp
> 9 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 10 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp
> 11 	xul.dll 	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsBlockFrame.cpp
> 12 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 13 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp
> 14 	xul.dll 	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsBlockFrame.cpp
> 15 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 16 	xul.dll 	nsCanvasFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsCanvasFrame.cpp
> 17 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 18 	xul.dll 	mozilla::ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsGfxScrollFrame.cpp
> 19 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 20 	xul.dll 	ViewportFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsViewportFrame.cpp
> 21 	xul.dll 	nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsRect const&, nsDisplayList*) 	layout/generic/nsFrame.cpp
> 22 	xul.dll 	nsSubDocumentFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsSubDocumentFrame.cpp
> 23 	xul.dll 	nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsRect const&, nsDisplayList*) 	layout/generic/nsFrame.cpp
> 24 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 25 	xul.dll 	nsContainerFrame::BuildDisplayListForNonBlockChildren(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsContainerFrame.cpp
> 26 	xul.dll 	nsContainerFrame::BuildDisplayListForInline(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsContainerFrame.h
> 27 	xul.dll 	nsInlineFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsInlineFrame.cpp
> 28 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 29 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp
> 30 	xul.dll 	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsBlockFrame.cpp
> 31 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 32 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp
> 33 	xul.dll 	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsBlockFrame.cpp
> 34 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 35 	xul.dll 	mozilla::ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsGfxScrollFrame.cpp
> 36 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 37 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp
> 38 	xul.dll 	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsBlockFrame.cpp
> 39 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 40 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp
> 41 	xul.dll 	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsBlockFrame.cpp
> 42 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 43 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp
> 44 	xul.dll 	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsBlockFrame.cpp
> 45 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 46 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp
> 47 	xul.dll 	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsBlockFrame.cpp
> 48 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 49 	xul.dll 	nsCanvasFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsCanvasFrame.cpp
> 50 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 51 	xul.dll 	mozilla::ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsGfxScrollFrame.cpp
> 52 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 53 	xul.dll 	ViewportFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsViewportFrame.cpp
> 54 	xul.dll 	nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsRect const&, nsDisplayList*) 	layout/generic/nsFrame.cpp
> 55 	xul.dll 	nsSubDocumentFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsSubDocumentFrame.cpp
> 56 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 57 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp
> 58 	xul.dll 	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsBlockFrame.cpp
> 59 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 60 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp
> 61 	xul.dll 	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsBlockFrame.cpp
> 62 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 63 	xul.dll 	nsCanvasFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsCanvasFrame.cpp
> 64 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 65 	xul.dll 	mozilla::ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsGfxScrollFrame.cpp
> 66 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 67 	xul.dll 	ViewportFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsViewportFrame.cpp
> 68 	xul.dll 	nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsRect const&, nsDisplayList*) 	layout/generic/nsFrame.cpp
> 69 	xul.dll 	nsSubDocumentFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsSubDocumentFrame.cpp
> 70 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 71 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp
> 72 	xul.dll 	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsBlockFrame.cpp
> 73 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 74 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp
> 75 	xul.dll 	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsBlockFrame.cpp
> 76 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 77 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp
> 78 	xul.dll 	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsBlockFrame.cpp
> 79 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 80 	xul.dll 	mozilla::ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsGfxScrollFrame.cpp
> 81 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 82 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp
> 83 	xul.dll 	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsBlockFrame.cpp
> 84 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 85 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp
> 86 	xul.dll 	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsBlockFrame.cpp
> 87 	xul.dll 	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) 	layout/generic/nsFrame.cpp
> 88 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp
> 89 	xul.dll 	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) 	layout/generic/nsBlockFrame.cpp
> 180 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
> 181 	xul.dll 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp
> 182 	plugin-container.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp

I don't know how to interpret the frame numbers jumping from 89 to 180 in this example stack trace.

Comment 1

[Nicholas Nethercote [inactive]]

dbaron, any idea if this is related to bug 1256500?

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: complete stack, from minidump

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

So in this particular minidump (the one from comment 0), nsStyleContext::StyleDisplay is being called with a null |this| pointer.  We crash when trying to look at mCachedStyleData, which I did check against the correct source that it is at offset 0x40.

Looking up a frame, at ZIndexForFrame, mStyleContext should be at offset 0x20 (leaving room for the vtable pointer at the start, I think), which agrees with the disassembly.  That also shows the style context in RCX (as null), and the aFrame in RDI being 000000ABC3CD6520.  (The !aFrame->IsAbsPosContainingBlock gets inlined into a call to nsStyleContext::StyleDisplay and then a call to nsStyleDisplay::IsAbsPosContainingBlock.)  000000ABC3CD6520 does seem consistent with heap addresses a few frames down on the stack (e.g., in nsSubDocumentFrame::BuildDisplayList).

No bright ideas, really, although it's certainly *not* bug 1256500.

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I'd be interested in extension / module correlations for this.

(And I do think I've seen crashes like this one on release when I was looking through the nsStyleContext::StyleDisplay crashes; I just filed one of the patterns because I saw what was going on.)

Comment 5

[Nicholas Nethercote [inactive]]

(In reply to David Baron [:dbaron] ⌚️UTC-7 from comment #4)
> I'd be interested in extension / module correlations for this.

"none found", as best as I can tell.

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

"None found" means the report is broken, not that there's nothing interesting in the information that would be there if it were working

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

From the reports in https://crash-analysis.mozilla.com/crash_analysis/ , no interesting correlations.

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

In addition to bug 1265283, the crashes in https://crash-stats.mozilla.com/signature/?date=%3E%3D2015-06-01&product=Firefox&signature=ZIndexForFrame might be related

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: Temporary debugging code to crash with a useful abort message

MozReview-Commit-ID: G1XOUcfwY20

Comment 10

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

(The main thing I want out of that abort message is the display item type, but I figure the pointers won't hurt while I'm there.)

Comment 11

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ff82389380c1e4c550314ffe536191075a405b0b
Bug 1265280 - Temporary debugging code to crash with a useful abort message.  r=khuey

Comment 12

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/ff82389380c1

Comment 13

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Backed out the debugging code from aurora:
https://hg.mozilla.org/releases/mozilla-aurora/rev/ca6ab5be342e

Comment 14

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

So looking at the crash reports again, I was misled by the Visual Studio debugger.

In bp-3eab56d0-ad64-4764-a65d-f909a2160425, we're calling nsStyleContext::StyleDisplay with this=0x7ffffffff0de7fff, which is the frame poison pattern.

bp-780f5e2d-97b9-4485-bc13-8e9262160425 appears to be the same, although I didn't look as closely.

So my debugging patch isn't actually going to work.

Comment 15

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

... but I should instead test the StyleContext() pointer against mozPoisonValue()

Comment 16

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: Fix temporary debugging patch for so we'll hit the condition

MozReview-Commit-ID: 11gaY1Fz9nf

Comment 17

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bc4c7468a198c88505c03fc3eeeac720530f401a
Fix temporary debugging patch for bug 1265280 so we'll hit the condition.  r=khuey

Comment 18

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/bc4c7468a198

Comment 19

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

So crashes with the debugging info show up at:
https://crash-stats.mozilla.com/signature/?date=%3E%3D2016-04-27&product=Firefox&release_channel=nightly&signature=mozalloc_abort+%7C+NS_DebugBreak+%7C+IsZOrderLEQ&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&page=1#reports

So far there's only one:
bp-fecc85fb-6390-40d8-b20f-427742160429
and it has:
###!!! ABORT: bad display item 1e1b2027980 type Plugin frame 1e19f569278

(The abort message isn't in crash-stats, but the MSVC debugger shows the value of |buf| in NS_DebugBreak.)

It would be nice to get a few more to confirm a pattern.

Comment 20

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Two more:
bp-528b8c2d-e83f-4586-88dd-698f22160502
###!!! ABORT: bad display item 28d6dbca2a8 type WrapList frame 28d74a7f5a0

bp-3d240964-198a-4f33-97f7-d50c82160503
###!!! ABORT: bad display item 1424433f9f0 type WrapList frame 1423dc6b5f0

Comment 21

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

bp-e4348988-050d-4cf9-9b5a-1c1ae2160504
###!!! ABORT: bad display item 20d99356820 type WrapList frame 20da4c61480

bp-9ca0f4c0-2449-4203-9731-5d6c92160505
###!!! ABORT: bad display item 283485b8 type WrapList frame 38b934b0

bp-ad1fd4e1-6062-49b4-800f-264902160505
###!!! ABORT: bad display item 1e649ed0 type WrapList frame 246393f0

bp-b53fb44b-1c25-434a-801e-e8a802160505
###!!! ABORT: bad display item 16ddd360 type WrapList frame 177ee9e0

bp-3aa629f6-686d-46af-9016-502b62160505
###!!! ABORT: bad display item 23264838 type WrapList frame 1f362508

bp-c6b20eaf-467b-4688-8c33-8de452160505
###!!! ABORT: bad display item 12e74020 type WrapList frame a7142b0

bp-cc231dab-8b7f-4e6d-85c8-b67732160505
###!!! ABORT: bad display item 1dee2800 type WrapList frame 14b81c50

bp-04ac6a52-e5ab-41de-b70a-6be802160505
###!!! ABORT: bad display item 115a4398 type WrapList frame 11be63f0

bp-11a54a06-3b4d-4049-a198-b89b42160506
###!!! ABORT: bad display item 1aa12d38 type WrapList frame 169ea730

Comment 22

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

bp-391a55a9-4a12-47bd-a25d-0eca02160507
###!!! ABORT: bad display item 1a3a17e5d90 type WrapList frame 1a3988765f8
(non-e10s, so right there in Socorro)

bp-6313510f-8306-485b-9074-1292a2160508
###!!! ABORT: bad display item 1f4b7e78100 type WrapList frame 1f4b7fe3540


(but no crashes since May 8)

Comment 23

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5a4acb31f6c0659edd048cdc201a7b419d869050
Back out temporary debugging patch for bug 1265280 (changeset ff82389380c1).

Comment 24

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'nsStyleContext::StyleDisplay':
 - nightly (version 50): 7 crashes from 2016-06-06.
 - aurora  (version 49): 32 crashes from 2016-06-07.
 - beta    (version 48): 567 crashes from 2016-06-06.
 - release (version 47): 1391 crashes from 2016-05-31.
 - esr     (version 45): 1165 crashes from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          2          0          2          0          1          0          1
 - aurora           1          5          9          7          5          4          1
 - beta           117         53         71         93         90         84         21
 - release        213        182        207        214        198        224         68
 - esr            148        131        116        140        153        118         74

Affected platforms: Windows, Mac OS X

Comment 25

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'nsStyleContext::StyleDisplay':
 - nightly (version 51): 1 crash from 2016-08-01.
 - aurora  (version 50): 8 crashes from 2016-08-01.
 - beta    (version 49): 147 crashes from 2016-08-02.
 - release (version 48): 190 crashes from 2016-07-25.
 - esr     (version 45): 1749 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       0       1       0
 - aurora        2       4       0
 - beta         52      50      15
 - release      63      60      30
 - esr         171     200     139

Affected platforms: Windows, Mac OS X

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora            #174
 - beta    #360      #264
 - release #442      #146
 - esr     #56

Comment 26

[Mats Palmgren (inactive)]

I think this crash now shows up as nsStyleDisplay::IsAbsPosContainingBlock
bp-4d12a372-7f74-476e-8121-45c912161116

Comment 27

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:mattwoodrow, maybe it's time to close this bug?

Comment 28

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:mattwoodrow, maybe it's time to close this bug?

Comment 29

[Matt Woodrow (:mattwoodrow)]

Looks like this is still crashing (at a low rate), so I'll keep the bug open for now.

Comment 30

[Timothy Nikkel (:tnikkel)]

Very few crashes on crash stats -> S3.

Comment 31

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.