1107353 - crash in nsRect::nsRect(nsRect const&)

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Mats Palmgren (inactive)]

This bug was filed from the Socorro interface and is 
report bp-0adc9bbd-edd6-4315-a582-9324c2141202.
=============================================================

The crash address for most of these crashes is 0x98 which
suggests 'aInstance' or 'aInstance->mAsyncScroll' is null here:
http://hg.mozilla.org/releases/mozilla-release/annotate/456394191c90/layout/generic/nsGfxScrollFrame.cpp#l1945

It's interesting that the crash stems from a local event loop
associated with a sync XHR request:

nsRect::nsRect(nsRect const&)
mozilla::ScrollFrameHelper::AsyncScrollCallback(mozilla::ScrollFrameHelper*, mozilla::TimeStamp)
mozilla::ScrollFrameHelper::AsyncScroll::WillRefresh(mozilla::TimeStamp)
nsRefreshDriver::Tick(__int64, mozilla::TimeStamp)
mozilla::RefreshDriverTimer::Tick()
nsTimerImpl::Fire()
nsTimerEvent::Run()
nsThread::ProcessNextEvent(bool, bool*)
NS_ProcessNextEvent(nsIThread*, bool)
nsXMLHttpRequest::Send(nsIVariant*, mozilla::dom::Nullable<nsXMLHttpRequest::RequestBody> const&)
...


More crashes here:
https://crash-stats.mozilla.com/report/list?signature=nsRect%3A%3AnsRect%28nsRect+const%26%29&product=Firefox&query_type=contains&range_unit=weeks&process_type=any&hang_type=any&range_value=4#tab-reports

All of the crashes are on Windows.  (The 3 crashes on Linux with
the same signature are unrelated.)

Comment 1

[Mats Palmgren (inactive)]

Attachment: wallpaper

I suggest we wallpaper this for now until we can figure out the
root cause.

https://tbpl.mozilla.org/?tree=Try&rev=9097b59a8bed

Comment 2

[:kip (Kearwood Gilbert)]

Comment on attachment 8531803 [details] [diff] [review]
wallpaper

Review of attachment 8531803 [details] [diff] [review]:
-----------------------------------------------------------------

Simple patch, no issues that I can see.

Comment 3

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/6915e633dbaf

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/6915e633dbaf