1152815 - Crash in mozilla::RestyleTracker::GetRestyleData()

Status: RESOLVED INCOMPLETE

(Core :: Layout, defect)

Description

[Hubert Figuiere [:hub]]

Firefox (m-i) built from source changeset 3337571fa164
Linux Fedora 21, x86_64

I was loading a page. Reloading all the tabs didn't trigger the crash again.

Stack trace
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff3f7ee15 in mozilla::RestyleTracker::GetRestyleData (this=0x7fffdb9bdaa8, aElement=0x7fffce9dd9d0, aData=...) at /home/hub/source/mozilla/src/layout/base/RestyleTracker.cpp:387
387	  if (aData->mRestyleHint & eRestyle_LaterSiblings) {
Missing separate debuginfos, use: debuginfo-install PackageKit-gtk3-module-1.0.4-1.fc21.x86_64 at-spi2-atk-2.14.1-1.fc21.x86_64 at-spi2-core-2.14.1-1.fc21.x86_64 bzip2-libs-1.0.6-14.fc21.x86_64 dconf-0.22.0-1.fc21.x86_64 elfutils-libelf-0.161-6.fc21.x86_64 elfutils-libs-0.161-6.fc21.x86_64 expat-2.1.0-10.fc21.x86_64 flac-libs-1.3.1-1.fc21.x86_64 graphite2-1.2.4-3.fc21.x86_64 gsm-1.0.13-12.fc21.x86_64 gvfs-1.22.3-2.fc21.x86_64 harfbuzz-0.9.36-1.fc21.x86_64 json-c-0.12-5.fc21.x86_64 libXau-1.0.8-4.fc21.x86_64 libXcursor-1.1.14-4.fc21.x86_64 libXi-1.7.4-2.fc21.x86_64 libXinerama-1.1.3-4.fc21.x86_64 libXrandr-1.4.2-2.fc21.x86_64 libXt-1.1.4-10.fc21.x86_64 libXxf86vm-1.1.3-4.fc21.x86_64 libattr-2.4.47-9.fc21.x86_64 libbluray-0.7.0-1.fc21.x86_64 libcap-2.24-7.fc21.x86_64 libogg-1.3.0-8.fc21.x86_64 libselinux-2.3-5.fc21.x86_64 libuuid-2.25.2-2.fc21.x86_64 libvorbis-1.3.4-3.fc21.x86_64 libwayland-client-1.6.0-1.fc21.x86_64 libwayland-cursor-1.6.0-1.fc21.x86_64 libwayland-server-1.6.0-1.fc21.x86_64 libxkbcommon-0.5.0-1.fc21.x86_64 libxshmfence-1.2-1.fc21.x86_64 nss-mdns-0.10-15.fc21.x86_64 pcre-8.35-8.fc21.x86_64 systemd-libs-216-21.fc21.x86_64 xz-libs-5.1.2-14alpha.fc21.x86_64
(gdb) bt
#0  0x00007ffff3f7ee15 in mozilla::RestyleTracker::GetRestyleData(mozilla::dom::Element*, nsAutoPtr<mozilla::RestyleTracker::RestyleData>&) (this=0x7fffdb9bdaa8, aElement=0x7fffce9dd9d0, aData=...) at /home/hub/source/mozilla/src/layout/base/RestyleTracker.cpp:387
#1  0x00007ffff3f80b78 in mozilla::RestyleTracker::DoProcessRestyles() (this=this@entry=0x7fffdb9bdaa8) at /home/hub/source/mozilla/src/layout/base/RestyleTracker.cpp:309
#2  0x00007ffff3f8ca9c in mozilla::RestyleManager::ProcessRestyles(mozilla::RestyleTracker&) (this=this@entry=0x7fffdb9bda60, aRestyleTracker=...)
    at /home/hub/source/mozilla/src/layout/base/RestyleManager.h:449
#3  0x00007ffff3f81091 in mozilla::RestyleManager::ProcessPendingRestyles() (this=0x7fffdb9bda60) at /home/hub/source/mozilla/src/layout/base/RestyleManager.cpp:1674
#4  0x00007ffff3febf7a in PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) (this=0x7fffdae5c800, aFlush=...) at /home/hub/source/mozilla/src/layout/base/nsPresShell.cpp:4279
#5  0x00007ffff3f6f478 in nsRefreshDriver::Tick(long, mozilla::TimeStamp) (this=0x7fffdae5c000, aNowEpoch=aNowEpoch@entry=1428591243018233, aNowTime=...)
    at /home/hub/source/mozilla/src/layout/base/nsRefreshDriver.cpp:1613
#6  0x00007ffff3f70c54 in mozilla::RefreshDriverTimer::TickDriver(nsRefreshDriver*, long, mozilla::TimeStamp) (driver=<optimized out>, jsnow=jsnow@entry=1428591243018233, now=..., 
    now@entry=...) at /home/hub/source/mozilla/src/layout/base/nsRefreshDriver.cpp:198
#7  0x00007ffff3f70d93 in mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) (this=this@entry=0x7fffe38279c0, jsnow=1428591243018233, now=...)
    at /home/hub/source/mozilla/src/layout/base/nsRefreshDriver.cpp:189
#8  0x00007ffff3f70ea8 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) (aTimeStamp=..., this=0x7fffe38279c0)
    at /home/hub/source/mozilla/src/layout/base/nsRefreshDriver.cpp:440
#9  0x00007ffff3f70ea8 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) (this=<optimized out>, aVsyncTimestamp=...)
    at /home/hub/source/mozilla/src/layout/base/nsRefreshDriver.cpp:374
#10 0x00007ffff3f6ffef in nsRunnableMethodImpl<void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp), true, mozilla::TimeStamp>::Run() (m=<optimized out>, o=<optimized out>, this=<optimized out>) at ../../dist/include/nsThreadUtils.h:587
#11 0x00007ffff3f6ffef in nsRunnableMethodImpl<void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp), true, mozilla::TimeStamp>::Run() (this=<optimized out>) at ../../dist/include/nsThreadUtils.h:666
#12 0x00007ffff2d03525 in nsThread::ProcessNextEvent(bool, bool*) (this=0x7fffeac0d480, aMayWait=<optimized out>, aResult=0x7fffffffc50f)
    at /home/hub/source/mozilla/src/xpcom/threads/nsThread.cpp:866
#13 0x00007ffff2d18d3f in NS_ProcessNextEvent(nsIThread*, bool) (aThread=<optimized out>, aMayWait=<optimized out>) at /home/hub/source/mozilla/src/xpcom/glue/nsThreadUtils.cpp:265
#14 0x00007ffff2f0463e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) (this=0x7fffeace5f00, aDelegate=0x7ffff7d563a0)
    at /home/hub/source/mozilla/src/ipc/glue/MessagePump.cpp:140
#15 0x00007ffff2ee6bec in MessageLoop::Run() (this=0x7ffff7d563a0) at /home/hub/source/mozilla/src/ipc/chromium/src/base/message_loop.cc:226
#16 0x00007ffff2ee6bec in MessageLoop::Run() (this=0x7ffff7d563a0) at /home/hub/source/mozilla/src/ipc/chromium/src/base/message_loop.cc:200
#17 0x00007ffff3e32260 in nsBaseAppShell::Run() (this=0x7fffeac73f90) at /home/hub/source/mozilla/src/widget/nsBaseAppShell.cpp:164
#18 0x00007ffff439a920 in nsAppStartup::Run() (this=0x7fffe4f1c100) at /home/hub/source/mozilla/src/toolkit/components/startup/nsAppStartup.cpp:281
#19 0x00007ffff43cf643 in XREMain::XRE_mainRun() (this=this@entry=0x7fffffffc7c0) at /home/hub/source/mozilla/src/toolkit/xre/nsAppRunner.cpp:4173
#20 0x00007ffff43cf8e6 in XREMain::XRE_main(int, char**, nsXREAppData const*) (this=this@entry=0x7fffffffc7c0, argc=argc@entry=1, argv=argv@entry=0x7fffffffdcc8, aAppData=aAppData@entry=0x7fffffffc9c0) at /home/hub/source/mozilla/src/toolkit/xre/nsAppRunner.cpp:4249
#21 0x00007ffff43cfb11 in XRE_main(int, char**, nsXREAppData const*, uint32_t) (argc=1, argv=0x7fffffffdcc8, aAppData=0x7fffffffc9c0, aFlags=<optimized out>)
    at /home/hub/source/mozilla/src/toolkit/xre/nsAppRunner.cpp:4469
#22 0x0000000000404785 in do_main(int, char**, nsIFile*) (argc=argc@entry=1, argv=argv@entry=0x7fffffffdcc8, xreDirectory=0x7ffff7d4d900)
    at /home/hub/source/mozilla/src/browser/app/nsBrowserApp.cpp:294
#23 0x0000000000404069 in main(int, char**) (argc=1, argv=0x7fffffffdcc8) at /home/hub/source/mozilla/src/browser/app/nsBrowserApp.cpp:667