1111213 - crash in nsSVGIntegrationUtils::UsingEffectsForFrame(nsIFrame const*)

Status: RESOLVED WORKSFORME

(Core :: SVG, defect)

Description

[Mats Palmgren (inactive)]

This bug was filed from the Socorro interface and is 
report bp-52121fbf-f97a-4f44-b85e-f7c7f2141204.
=============================================================

This signature seems to be on the rise in v37.  It occurs also in
older versions but in relatively low volume.

nsSVGIntegrationUtils::UsingEffectsForFrame(nsIFrame const*)
ComputeEffectsRect
nsIFrame::FinishAndStoreOverflow(nsOverflowAreas&, nsSize, nsSize*)
nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&)
nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&)
nsBlockFrame::ReflowFloat(nsBlockReflowState&, mozilla::LogicalRect const&, nsIFrame*, mozilla::LogicalMargin&, mozilla::LogicalMargin&, bool, unsigned int&)
nsBlockReflowState::FlowAndPlaceFloat(nsIFrame*)
nsBlockReflowState::AddFloat(nsLineLayout*, nsIFrame*, int)
nsLineLayout::ReflowFrame(nsIFrame*, unsigned int&, nsHTMLReflowMetrics*, bool&)
nsBlockFrame::ReflowInlineFrame(nsBlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)
nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)
nsBlockFrame::ReflowInlineFrames(nsBlockReflowState&, nsLineList_iterator, bool*)
nsBlockFrame::ReflowLine(nsBlockReflowState&, nsLineList_iterator, bool*)
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&)
nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsigned int&, nsOverflowContinuationTracker*)
nsHTMLScrollFrame::ReflowScrolledFrame(ScrollReflowState*, bool, bool, nsHTMLReflowMetrics*, bool)
nsHTMLScrollFrame::ReflowContents(ScrollReflowState*, nsHTMLReflowMetrics const&)
...

Comment 1

[Daosheng Mu[:daoshengmu]]

Hi mats, could you provide the test case for tracing?

Comment 2

[Mats Palmgren (inactive)]

Sorry, I have no testcase.  It's just a signature I picked up from crash-stats.

Looking at the stack it seems there is an element with 'float' style involved,
probably with some SVG "effects" on it.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'nsSVGIntegrationUtils::UsingEffectsForFrame':
 - nightly (version 51): 0 crashes from 2016-08-01.
 - aurora  (version 50): 0 crashes from 2016-08-01.
 - beta    (version 49): 24 crashes from 2016-08-02.
 - release (version 48): 26 crashes from 2016-07-25.
 - esr     (version 45): 9 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       0       0       0
 - aurora        0       0       0
 - beta          5      11       0
 - release      10       6       5
 - esr           2       0       0

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora
 - beta    #1803     #3186
 - release #1925
 - esr     #5508

Comment 4

[Daniel Holbert [:dholbert]]

Only two reports in the last 6 months, both in extremely-old version 78.15.0esr :
bp-2dc5611d-de8b-4b3a-adcb-bb47a0220930
bp-577b3e0b-8008-42e7-a4c3-9fb240220530

Given that (substantially lower than the volume in comment 3), I suspect this has been fixed? If we get a crash report with a more recent Firefox version, let's go ahead and reopen, though.