Closed Bug 799856 Opened 12 years ago Closed 12 years ago

crash in mozilla::InternalInvalidateThebesLayersInSubtree , Firefox17b1 crashes when I canceled login to Facebook

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Version:
17 Branch
Type:
defect
Priority:
Not set
Severity:
blocker

Tracking

()

Status:
VERIFIED FIXED
Tracking Flags:
Tracking Status
firefox16 --- unaffected
firefox17 + verified
firefox18 --- unaffected

People

(Reporter: alice0775, Unassigned)

References

Details

(4 keywords)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-2056b9e7-1591-41d7-bff4-fd60f2121010 .
============================================================= 

Firefox17b1 crashes.
However, Aurora18.a2 and Nightly19.0a1 do not crash.

Reproducible: Always

Steps To reproduce:
1. Start Firefox with clean profile
2. Open http://www.facebook.com/alice.white.3382
3. "To connect with Alice, sign up for Facebook today. Log In Sin UP" dialog pops up
4. Click "Close" blue button
Keywords: reproducible
Summary: crash in mozilla::InternalInvalidateThebesLayersInSubtree → crash in mozilla::InternalInvalidateThebesLayersInSubtree , Firefox17b1 crashes when I canceled login to Facebook
Regression window(beta channel)
Good:
http://hg.mozilla.org/releases/mozilla-beta/rev/62cd5d1049f7
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20121008 Firefox/16.0 ID:20121008111035
Crash:
http://hg.mozilla.org/releases/mozilla-beta/rev/f335e7dacdc1
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20121008113033
Pushlog:
http://hg.mozilla.org/releases/mozilla-beta/pushloghtml?fromchange=62cd5d1049f7&tochange=f335e7dacdc1
Regression window(aurora channel)
Good:
http://hg.mozilla.org/releases/mozilla-aurora/rev/7b56051aeb49
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20121008082334
Crash:
http://hg.mozilla.org/releases/mozilla-aurora/rev/7f293a7c521d
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20121008085633
Pushlog:
http://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?fromchange=7b56051aeb49&tochange=7f293a7c521d

Triggered by:
7f293a7c521d	Robert O'Callahan — Bug 786740 - Fix invalidations on out-of-flow frames. r=cwiiis a=akeybl We invalidate following the frame-tree, but we build the display-list following placeholder frames, so if any non-shared ancestors of the placeholder and out-of-flow frames aren't shared, and they create container layers, invalidations will be lost. Fix this by checking if any of the ancestors of placeholder frames for out-of-flow frames have container layers and doing a full invalidation on the first frame we find that satisfies this condition.
Blocks: 786740
Component: Layout: View Rendering → Graphics: Layers
OS: Windows NT → Windows 7
Component: Graphics: Layers → Layout
Keywords: regression
OS: Windows 7 → All
Hardware: x86 → All
It's currently #1 top crasher in 17.0b1 (hit by 20 users).
Severity: critical → blocker
Keywords: topcrash
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/17.0 Firefox/17.0

Reproducible on Mac OS X 10.6. I scrolled through notifications on Home page and tried to open a picture and it crashed.

https://crash-stats.mozilla.com/report/index/bp-f50029df-9f4a-4694-866a-a1c812121010
Interesting stack - it crashes when it gets the frame properties... Will have a look.
Backed out: https://hg.mozilla.org/releases/mozilla-beta/rev/4aeb1704699f
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Simona, please verify this is fixed with the next Beta builds.
status-firefox17: affected → fixed
Keywords: verifyme
QA Contact: simona.marcu
Verified on Firefox 17 beta 1 build 2 that the crash does not occur when:
- following the steps from the Description
- scrolling through the notifications and posts on the Home page (as mentioned in Comment 5) 
- opening any photos (as mentioned in Comment 6)

Verified on Windows 7. Ubuntu 12.04 and Mac OS X 10.7:
Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/17.0 Firefox/17.0
Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/17.0 Firefox/17.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/17.0 Firefox/17.0
status-firefox17: fixed → verified
It would be nice to have a reduced testcase for this crash for our regression
test suite, since apparently this is an edge case we don't have coverage for.
Flags: in-testsuite?
Keywords: testcase-wanted
There is a crashtest in my patch in bug 786740.
Ah, indeed there is, thanks!
Keywords: testcase-wanted
Marking verified fixed based on comment 10.
Status: RESOLVED → VERIFIED
Keywords: verifyme
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.