1213617 - Firefox 42 backtrace (reproducible) : CSSStyleSheet.cpp:384, nsDocumentRuleResultCacheKey::Matches (MOZ_ASSERT(pm >= pm_end || *pm == *pr)

Status: RESOLVED DUPLICATE of bug 1196379

(Core :: CSS Parsing and Computation, defect)

Description

[u209627]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:39.0) Gecko/20100101 Firefox/39.0
Build ID: 20150807162358

Steps to reproduce:

I'm getting this segfault since Firefox 40. Now I'm able to reproducible with the same backtrace output.

Steps to reproduce:

1) go to:
http://exchangewar.info/coinprice?BTC_BRL

2) Firefox crashes with the following backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff3b26310 in nsDocumentRuleResultCacheKey::Matches (this=this@entry=0x7fffc275ae38, aPresContext=aPresContext@entry=0x7fff92512000, aRules=...)
    at /home/fraga/src/mozilla/layout/style/CSSStyleSheet.cpp:384
384           MOZ_ASSERT(pm >= pm_end || *pm == *pr,
(gdb) bt
#0  0x00007ffff3b26310 in nsDocumentRuleResultCacheKey::Matches (this=this@entry=0x7fffc275ae38, aPresContext=aPresContext@entry=0x7fff92512000, aRules=...)
    at /home/fraga/src/mozilla/layout/style/CSSStyleSheet.cpp:384
#1  0x00007ffff3b559ec in mozilla::RuleProcessorCache::DoGetRuleProcessor (this=<optimized out>, aSheets=..., aPresContext=0x7fff92512000)
    at /home/fraga/src/mozilla/layout/style/RuleProcessorCache.cpp:155
#2  0x00007ffff3b70fea in mozilla::RuleProcessorCache::GetRuleProcessor (aSheets=..., aPresContext=<optimized out>) at /home/fraga/src/mozilla/layout/style/RuleProcessorCache.cpp:105
#3  0x00007ffff3bba91d in nsStyleSet::GatherRuleProcessors (this=this@entry=0x7fffd21ec500, aType=aType@entry=nsStyleSet::eUserSheet)
    at /home/fraga/src/mozilla/layout/style/nsStyleSet.cpp:536
#4  0x00007ffff3bbb371 in nsStyleSet::EndUpdate (this=0x7fffd21ec500) at /home/fraga/src/mozilla/layout/style/nsStyleSet.cpp:791
#5  0x00007ffff3c89810 in nsDocumentViewer::InitPresentationStuff (this=0x7fffa75f2120, aDoInitialReflow=<optimized out>) at /home/fraga/src/mozilla/layout/base/nsDocumentViewer.cpp:646
#6  0x00007ffff3c8a444 in nsDocumentViewer::InitInternal (this=0x7fffa75f2120, aParentWidget=<optimized out>, aState=aState@entry=0x0, aBounds=..., aDoCreation=aDoCreation@entry=true, 
    aNeedMakeCX=aNeedMakeCX@entry=true, aForceSetNewDocument=<optimized out>) at /home/fraga/src/mozilla/layout/base/nsDocumentViewer.cpp:895
#7  0x00007ffff3c8a485 in nsDocumentViewer::Init (this=<optimized out>, aParentWidget=<optimized out>, aBounds=...) at /home/fraga/src/mozilla/layout/base/nsDocumentViewer.cpp:621
#8  0x00007ffff3f6caa2 in nsDocShell::SetupNewViewer (this=this@entry=0x7fffae422000, aNewViewer=aNewViewer@entry=0x7fffa75f2120) at /home/fraga/src/mozilla/docshell/base/nsDocShell.cpp:9167
#9  0x00007ffff3f7291f in nsDocShell::Embed (this=this@entry=0x7fffae422000, aContentViewer=0x7fffa75f2120, aCommand=aCommand@entry=0x7ffff4deec00 "", aExtraInfo=aExtraInfo@entry=0x0)
    at /home/fraga/src/mozilla/docshell/base/nsDocShell.cpp:7068
#10 0x00007ffff3f72ffc in nsDocShell::CreateContentViewer (this=0x7fffae422000, aContentType=..., aRequest=aRequest@entry=0x7fffafe65858, 
    aContentHandler=aContentHandler@entry=0x7fffb8a4e6a8) at /home/fraga/src/mozilla/docshell/base/nsDocShell.cpp:8975
#11 0x00007ffff3f733f7 in nsDSURIContentListener::DoContent (this=this@entry=0x7fffb8a41fa0, aContentType=..., aIsContentPreferred=aIsContentPreferred@entry=false, 
    aRequest=aRequest@entry=0x7fffafe65858, aContentHandler=aContentHandler@entry=0x7fffb8a4e6a8, aAbortProcess=aAbortProcess@entry=0x7fffffffbf6b)
    at /home/fraga/src/mozilla/docshell/base/nsDSURIContentListener.cpp:129
#12 0x00007ffff29083f7 in nsDocumentOpenInfo::TryContentListener (this=this@entry=0x7fffb8a4e680, aListener=0x7fffb8a41fa0, aChannel=0x7fffafe65858)
    at /home/fraga/src/mozilla/uriloader/base/nsURILoader.cpp:725
#13 0x00007ffff290877f in nsDocumentOpenInfo::DispatchContent (this=this@entry=0x7fffb8a4e680, request=request@entry=0x7fffafe65858, aCtxt=aCtxt@entry=0x0)
    at /home/fraga/src/mozilla/uriloader/base/nsURILoader.cpp:398
#14 0x00007ffff29092a2 in nsDocumentOpenInfo::OnStartRequest (this=0x7fffb8a4e680, request=0x7fffafe65858, aCtxt=0x0) at /home/fraga/src/mozilla/uriloader/base/nsURILoader.cpp:259
#15 0x00007ffff2363320 in mozilla::net::nsHttpChannel::CallOnStartRequest (this=this@entry=0x7fffafe65800) at /home/fraga/src/mozilla/netwerk/protocol/http/nsHttpChannel.cpp:1021
#16 0x00007ffff2363ce1 in mozilla::net::nsHttpChannel::ContinueOnStartRequest3 (this=this@entry=0x7fffafe65800, result=result@entry=nsresult::NS_OK)
    at /home/fraga/src/mozilla/netwerk/protocol/http/nsHttpChannel.cpp:5728
#17 0x00007ffff2363d4d in mozilla::net::nsHttpChannel::ContinueOnStartRequest2 (this=this@entry=0x7fffafe65800, result=result@entry=nsresult::NS_OK)
    at /home/fraga/src/mozilla/netwerk/protocol/http/nsHttpChannel.cpp:5719
#18 0x00007ffff23653ab in mozilla::net::nsHttpChannel::OnStartRequest (this=0x7fffafe65800, request=0x7fffbc97ddc0, ctxt=<optimized out>)
    at /home/fraga/src/mozilla/netwerk/protocol/http/nsHttpChannel.cpp:5692
#19 0x00007ffff2218fd9 in nsInputStreamPump::OnStateStart (this=this@entry=0x7fffbc97ddc0) at /home/fraga/src/mozilla/netwerk/base/nsInputStreamPump.cpp:527
#20 0x00007ffff2224cb7 in nsInputStreamPump::OnInputStreamReady (this=0x7fffbc97ddc0, stream=<optimized out>) at /home/fraga/src/mozilla/netwerk/base/nsInputStreamPump.cpp:429
#21 0x00007ffff217a2b5 in nsInputStreamReadyEvent::Run (this=0x7fffa83f9c80) at /home/fraga/src/mozilla/xpcom/io/nsStreamUtils.cpp:91
#22 0x00007ffff218f989 in nsThread::ProcessNextEvent (this=0x7ffff6ba3310, aMayWait=<optimized out>, aResult=0x7fffffffc3ff) at /home/fraga/src/mozilla/xpcom/threads/nsThread.cpp:867
#23 0x00007ffff21b6599 in NS_ProcessNextEvent (aThread=0x7ffff6ba3310, aMayWait=<optimized out>) at /home/fraga/src/mozilla/xpcom/glue/nsThreadUtils.cpp:277
#24 0x00007ffff2428eae in mozilla::ipc::MessagePump::Run (this=0x7fffe4f0ff80, aDelegate=0x7ffff6b984e0) at /home/fraga/src/mozilla/ipc/glue/MessagePump.cpp:95
#25 0x00007ffff2401e8d in MessageLoop::RunInternal (this=0x7ffff6b984e0) at /home/fraga/src/mozilla/ipc/chromium/src/base/message_loop.cc:234
#26 0x00007ffff2401ebd in MessageLoop::RunHandler (this=<optimized out>) at /home/fraga/src/mozilla/ipc/chromium/src/base/message_loop.cc:227
#27 MessageLoop::Run (this=<optimized out>) at /home/fraga/src/mozilla/ipc/chromium/src/base/message_loop.cc:201
#28 0x00007ffff3a28419 in nsBaseAppShell::Run (this=0x7fffdf613700) at /home/fraga/src/mozilla/widget/nsBaseAppShell.cpp:165
#29 0x00007ffff41a4d57 in nsAppStartup::Run (this=0x7fffdf604920) at /home/fraga/src/mozilla/toolkit/components/startup/nsAppStartup.cpp:280
#30 0x00007ffff41f33d2 in XREMain::XRE_mainRun (this=this@entry=0x7fffffffc6d0) at /home/fraga/src/mozilla/toolkit/xre/nsAppRunner.cpp:4287
#31 0x00007ffff41f36b3 in XREMain::XRE_main (this=this@entry=0x7fffffffc6d0, argc=argc@entry=1, argv=argv@entry=0x7fffffffdb48, aAppData=aAppData@entry=0x7fffffffc8d0)
    at /home/fraga/src/mozilla/toolkit/xre/nsAppRunner.cpp:4380
#32 0x00007ffff41f38ea in XRE_main (argc=1, argv=0x7fffffffdb48, aAppData=0x7fffffffc8d0, aFlags=<optimized out>) at /home/fraga/src/mozilla/toolkit/xre/nsAppRunner.cpp:4482
#33 0x0000000000404f14 in do_main (argc=argc@entry=1, argv=argv@entry=0x7fffffffdb48, xreDirectory=0x7ffff6b54840) at /home/fraga/src/mozilla/browser/app/nsBrowserApp.cpp:212
#34 0x00000000004047fd in main (argc=1, argv=0x7fffffffdb48) at /home/fraga/src/mozilla/browser/app/nsBrowserApp.cpp:399

If you need more tests, just ask.

Comment 1

[u209627]

No one? Can somebody at least test on the site with Firefox 42?

http://exchangewar.info/coinprice?BTC_BRL

Comment 2

[Mats Palmgren (inactive)]

Loading the URL in Firefox 41.0.1 on Linux64 works fine for me.
It seems to work fine also in a debug trunk build but I do get this assertion:

ASSERTION: aElement should be the element and not the pseudo-element: 'pseudoType == nsCSSPseudoElements::ePseudo_NotPseudoElement || !elementForAnimation->GetPrimaryFrame() || elementForAnimation->GetPrimaryFrame()->StyleContext()-> GetPseudoType() == nsCSSPseudoElements::ePseudo_NotPseudoElement', file layout/style/nsStyleSet.cpp, line 1714

Comment 3

[Mats Palmgren (inactive)]

Dâniel, can you crash it again in a debugger and post the values for the local
variables there?  (pm, pm_end, pr, pr_end and also *this and *aPresContext)  Thanks!

BTW, if you're debugging this using your default Firefox profile, please make sure
you make a backup copy of it first, just in case.

Comment 4

[Mats Palmgren (inactive)]

BTW, does it also crash using a fresh profile?

The easiest way to test that is to give an empty directory as the profile
directory on the command line, like so:
mkdir /tmp/x
firefox -profile /tmp/x

Comment 5

[u209627]

(In reply to Mats Palmgren (:mats) from comment #3)
> Dâniel, can you crash it again in a debugger and post the values for the
> local
> variables there?  (pm, pm_end, pr, pr_end and also *this and *aPresContext) 
> Thanks!

Thanks Mats. pm, pm_end, pr and pr_end were optimized out. The problem is that if I recompile without optimization, maybe it will not crash (do you want me to recompile without any optimization to test?). But I got *this and *aPresContext:

(gdb) p *this
$7 = {mMatchingRules = {<nsTArray_Impl<mozilla::css::DocumentRule*, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
        mHdr = 0x7fffbe62a080}, <nsTArray_TypedBase<mozilla::css::DocumentRule*, nsTArray_Impl<mozilla::css::DocumentRule*, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::css::DocumentRule*, nsTArray_Impl<mozilla::css::DocumentRule*, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, 
      static NoIndex = <optimized out>}, <No data fields>}, mFinalized = true}

*********************************************************************************

(gdb) p *PresContext
$8 = {<nsIObserver> = {<nsISupports> = {_vptr.nsISupports = 0x7ffff64aa7f8 <vtable for nsPresContext+16>}, <No data fields>}, mRefCnt = {mRefCntAndFlags = 9}, _mOwningThread = {
    mThread = 0x7ffff6b9e380}, static _cycleCollectorGlobal = {<nsXPCOMCycleCollectionParticipant> = {<nsScriptObjectTracer> = {<nsCycleCollectionParticipant> = {
          _vptr.nsCycleCollectionParticipant = 0x7ffff64aa890 <vtable for nsPresContext::cycleCollection+16>, mMightSkip = false}, <No data fields>}, <No data fields>}, <No data fields>}, 
  mType = nsPresContext::eContext_Galley, mShell = 0x7fffa1c05000, mDocument = {mRawPtr = 0x7fff9da58000}, mDeviceContext = {mRawPtr = 0x7fff9b776040}, mEventManager = {
    mRawPtr = 0x7fffa18dab20}, mRefreshDriver = {mRawPtr = 0x7fffac6f5c00}, mTransitionManager = {mRawPtr = 0x7fff9bb9c6a0}, mAnimationManager = {mRawPtr = 0x7fffa00ed6f0}, 
  mRestyleManager = {mRawPtr = 0x7fffaef3fba0}, mCounterStyleManager = {mRawPtr = 0x7fffa1c472e0}, mMedium = 0x7fffe357e1c0, mMediaEmulated = {mRawPtr = 0x7fffe357e1c0}, 
  mLinkHandler = 0x7fffa1c36a10, mLanguage = {mRawPtr = 0x7fffd518c520}, mInflationDisabledForShrinkWrap = false, mContainer = {mRef = {mPtr = 0x7fff9ddb8cc0}}, mBaseMinFontSize = 0, 
  mTextZoom = 1, mFullZoom = 1, mLastFontInflationScreenSize = {<mozilla::gfx::BaseSize<double, gfxSize>> = {width = -1, height = -1}, <No data fields>}, mCurAppUnitsPerDevPixel = 60, 
  mAutoQualityMinFontSizePixelsPref = 20, mTheme = {mRawPtr = 0x0}, mLangService = {mRawPtr = 0x7fffd5caa380}, mPrintSettings = {mRawPtr = 0x0}, mPrefChangedTimer = {mRawPtr = 0x0}, 
  mPropertyTable = {mEntries = {mTable = {mOps = 0x7ffff64ab6e0 <nsTHashtable<mozilla::FramePropertyTable::Entry>::Ops()::sOps>, mHashShift = 29, mEntrySize = 32, mEntryCount = 0, 
        mRemovedCount = 0, mEntryStore = {mEntryStore = 0x0, mGeneration = 0}, mChecker = {static kIdle = 0, static kRead1 = 1, static kReadMax = 9999, static kWrite = 10000, 
          mState = {<mozilla::detail::AtomicBaseIncDec<unsigned int, (mozilla::MemoryOrdering)2>> = {<mozilla::detail::AtomicBase<unsigned int, (mozilla::MemoryOrdering)2>> = {
                mValue = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 0}, <No data fields>}}, <No data fields>}, <No data fields>}, 
          mIsWritable = {<mozilla::detail::AtomicBaseIncDec<unsigned int, (mozilla::MemoryOrdering)2>> = {<mozilla::detail::AtomicBase<unsigned int, (mozilla::MemoryOrdering)2>> = {
                mValue = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 1}, <No data fields>}}, <No data fields>}, <No data fields>}}, 
        static kMaxCapacity = 67108864, static kMinCapacity = 8, static kMaxInitialLength = 33554432, static kDefaultInitialLength = 4, static kHashBits = 32, 
        static kGoldenRatio = 2654435769, static kCollisionFlag = 1}}, mLastFrame = 0x0, mLastEntry = 0x0}, mInvalidateRequestsSinceLastPaint = {
    mRequests = {<nsTArray_Impl<nsInvalidateRequestList::Request, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
          mHdr = 0x7ffff6793a48 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<nsInvalidateRequestList::Request, nsTArray_Impl<nsInvalidateRequestList::Request, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<nsInvalidateRequestList::Request, nsTArray_Impl<nsInvalidateRequestList::Request, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}}, mUndeliveredInvalidateRequestsBeforeLastPaint = {
    mRequests = {<nsTArray_Impl<nsInvalidateRequestList::Request, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
          mHdr = 0x7ffff6793a48 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<nsInvalidateRequestList::Request, nsTArray_Impl<nsInvalidateRequestList::Request, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<nsInvalidateRequestList::Request, nsTArray_Impl<nsInvalidateRequestList::Request, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}}, mTextPerf = {mRawPtr = 0x0}, mMissingFonts = {mRawPtr = 0x0}, 
  mVisibleArea = {<mozilla::gfx::BaseRect<int, nsRect, nsPoint, nsSize, nsMargin>> = {x = 0, y = 0, width = 0, height = 0}, <No data fields>}, 
  mPageSize = {<mozilla::gfx::BaseSize<int, nsSize>> = {width = -1, height = -1}, <No data fields>}, mPageScale = 0, mPPScale = 1, mDefaultColor = 4278190080, mBackgroundColor = 4294967295, 
  mLinkColor = 4293787648, mActiveLinkColor = 4278190318, mVisitedLinkColor = 4287306325, mFocusBackgroundColor = 4280448785, mFocusTextColor = 4294967295, mBodyTextColor = 4278190080, 
  mViewportStyleScrollbar = {mHorizontal = 3 '\003', mVertical = 3 '\003', mScrollBehavior = 0 '\000', mScrollSnapTypeX = 0 '\000', mScrollSnapTypeY = 0 '\000', mScrollSnapPointsX = {
      mUnit = eStyleUnit_None, mValue = {mInt = 0, mFloat = 0, mPointer = 0x0}}, mScrollSnapPointsY = {mUnit = eStyleUnit_None, mValue = {mInt = 0, mFloat = 0, mPointer = 0x0}}, 
    mScrollSnapDestinationX = {mLength = 0, mPercent = 0, mHasPercent = false}, mScrollSnapDestinationY = {mLength = 0, mPercent = 0, mHasPercent = false}}, mFocusRingWidth = 1 '\001', 
  mExistThrottledUpdates = false, mImageAnimationMode = 0, mImageAnimationModePref = 0, mLangGroupFontPrefs = {mLangGroup = {mRawPtr = 0x0}, mMinimumFontSize = 0, mDefaultVariableFont = {
      fontlist = {mFontlist = {<nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
              mHdr = 0x7fff9bfcc7c0}, <nsTArray_TypedBase<mozilla::FontFamilyName, nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::FontFamilyName, nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
        mDefaultFontType = mozilla::eFamily_none}, style = 0 '\000', systemFont = false, variantCaps = 0 '\000', variantNumeric = 0 '\000', variantPosition = 0 '\000', variantLigatures = 0, 
      variantEastAsian = 0, variantAlternates = 0, decorations = 0 '\000', smoothing = 0 '\000', weight = 400, stretch = 0, kerning = 0 '\000', synthesis = 3 '\003', size = 0, 
      sizeAdjust = -1, alternateValues = {<nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
            mHdr = 0x7ffff6793a48 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<gfxAlternateValue, nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<gfxAlternateValue, nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
      featureValueLookup = {mRawPtr = 0x0}, 
      fontFeatureSettings = {<nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
            mHdr = 0x7ffff6793a48 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<gfxFontFeature, nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<gfxFontFeature, nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
      languageOverride = {<nsAString_internal> = {mData = 0x7ffff4caf80a <gNullChar> u"", mLength = 0, mFlags = 1}, <No data fields>}}, mDefaultFixedFont = {fontlist = {
        mFontlist = {<nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
              mHdr = 0x7fff9bfcc7e0}, <nsTArray_TypedBase<mozilla::FontFamilyName, nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::FontFamilyName, nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
        mDefaultFontType = mozilla::eFamily_none}, style = 0 '\000', systemFont = false, variantCaps = 0 '\000', variantNumeric = 0 '\000', variantPosition = 0 '\000', variantLigatures = 0, 
      variantEastAsian = 0, variantAlternates = 0, decorations = 0 '\000', smoothing = 0 '\000', weight = 400, stretch = 0, kerning = 0 '\000', synthesis = 3 '\003', size = 0, 
      sizeAdjust = -1, alternateValues = {<nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
            mHdr = 0x7ffff6793a48 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<gfxAlternateValue, nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<gfxAlternateValue, nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
      featureValueLookup = {mRawPtr = 0x0}, 
      fontFeatureSettings = {<nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
            mHdr = 0x7ffff6793a48 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<gfxFontFeature, nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<gfxFontFeature, nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
      languageOverride = {<nsAString_internal> = {mData = 0x7ffff4caf80a <gNullChar> u"", mLength = 0, mFlags = 1}, <No data fields>}}, mDefaultSerifFont = {fontlist = {
        mFontlist = {<nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
              mHdr = 0x7fff9bfcc860}, <nsTArray_TypedBase<mozilla::FontFamilyName, nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::FontFamilyName, nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
        mDefaultFontType = mozilla::eFamily_none}, style = 0 '\000', systemFont = false, variantCaps = 0 '\000', variantNumeric = 0 '\000', variantPosition = 0 '\000', variantLigatures = 0, 
      variantEastAsian = 0, variantAlternates = 0, decorations = 0 '\000', smoothing = 0 '\000', weight = 400, stretch = 0, kerning = 0 '\000', synthesis = 3 '\003', size = 0, 
      sizeAdjust = -1, alternateValues = {<nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
            mHdr = 0x7ffff6793a48 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<gfxAlternateValue, nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<gfxAlternateValue, nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
      featureValueLookup = {mRawPtr = 0x0}, 
      fontFeatureSettings = {<nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
            mHdr = 0x7ffff6793a48 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<gfxFontFeature, nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<gfxFontFeature, nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
      languageOverride = {<nsAString_internal> = {mData = 0x7ffff4caf80a <gNullChar> u"", mLength = 0, mFlags = 1}, <No data fields>}}, mDefaultSansSerifFont = {fontlist = {
        mFontlist = {<nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
              mHdr = 0x7fff9bfcc880}, <nsTArray_TypedBase<mozilla::FontFamilyName, nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::FontFamilyName, nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
        mDefaultFontType = mozilla::eFamily_none}, style = 0 '\000', systemFont = false, variantCaps = 0 '\000', variantNumeric = 0 '\000', variantPosition = 0 '\000', variantLigatures = 0, 
      variantEastAsian = 0, variantAlternates = 0, decorations = 0 '\000', smoothing = 0 '\000', weight = 400, stretch = 0, kerning = 0 '\000', synthesis = 3 '\003', size = 0, 
      sizeAdjust = -1, alternateValues = {<nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
            mHdr = 0x7ffff6793a48 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<gfxAlternateValue, nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<gfxAlternateValue, nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
      featureValueLookup = {mRawPtr = 0x0}, 
      fontFeatureSettings = {<nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
            mHdr = 0x7ffff6793a48 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<gfxFontFeature, nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<gfxFontFeature, nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
      languageOverride = {<nsAString_internal> = {mData = 0x7ffff4caf80a <gNullChar> u"", mLength = 0, mFlags = 1}, <No data fields>}}, mDefaultMonospaceFont = {fontlist = {
        mFontlist = {<nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
              mHdr = 0x7fff9bfcc8e0}, <nsTArray_TypedBase<mozilla::FontFamilyName, nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::FontFamilyName, nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
        mDefaultFontType = mozilla::eFamily_none}, style = 0 '\000', systemFont = false, variantCaps = 0 '\000', variantNumeric = 0 '\000', variantPosition = 0 '\000', variantLigatures = 0, 
      variantEastAsian = 0, variantAlternates = 0, decorations = 0 '\000', smoothing = 0 '\000', weight = 400, stretch = 0, kerning = 0 '\000', synthesis = 3 '\003', size = 0, 
      sizeAdjust = -1, alternateValues = {<nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
            mHdr = 0x7ffff6793a48 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<gfxAlternateValue, nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<gfxAlternateValue, nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
      featureValueLookup = {mRawPtr = 0x0}, 
      fontFeatureSettings = {<nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
            mHdr = 0x7ffff6793a48 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<gfxFontFeature, nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<gfxFontFeature, nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
      languageOverride = {<nsAString_internal> = {mData = 0x7ffff4caf80a <gNullChar> u"", mLength = 0, mFlags = 1}, <No data fields>}}, mDefaultCursiveFont = {fontlist = {
        mFontlist = {<nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
              mHdr = 0x7fff9bfcc900}, <nsTArray_TypedBase<mozilla::FontFamilyName, nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::FontFamilyName, nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
        mDefaultFontType = mozilla::eFamily_none}, style = 0 '\000', systemFont = false, variantCaps = 0 '\000', variantNumeric = 0 '\000', variantPosition = 0 '\000', variantLigatures = 0, 
      variantEastAsian = 0, variantAlternates = 0, decorations = 0 '\000', smoothing = 0 '\000', weight = 400, stretch = 0, kerning = 0 '\000', synthesis = 3 '\003', size = 0, 
      sizeAdjust = -1, alternateValues = {<nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
            mHdr = 0x7ffff6793a48 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<gfxAlternateValue, nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<gfxAlternateValue, nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
      featureValueLookup = {mRawPtr = 0x0}, 
      fontFeatureSettings = {<nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
            mHdr = 0x7ffff6793a48 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<gfxFontFeature, nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<gfxFontFeature, nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
      languageOverride = {<nsAString_internal> = {mData = 0x7ffff4caf80a <gNullChar> u"", mLength = 0, mFlags = 1}, <No data fields>}}, mDefaultFantasyFont = {fontlist = {
        mFontlist = {<nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
              mHdr = 0x7fff9bfcc920}, <nsTArray_TypedBase<mozilla::FontFamilyName, nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::FontFamilyName, nsTArray_Impl<mozilla::FontFamilyName, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
        mDefaultFontType = mozilla::eFamily_none}, style = 0 '\000', systemFont = false, variantCaps = 0 '\000', variantNumeric = 0 '\000', variantPosition = 0 '\000', variantLigatures = 0, 
      variantEastAsian = 0, variantAlternates = 0, decorations = 0 '\000', smoothing = 0 '\000', weight = 400, stretch = 0, kerning = 0 '\000', synthesis = 3 '\003', size = 0, 
      sizeAdjust = -1, alternateValues = {<nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
            mHdr = 0x7ffff6793a48 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<gfxAlternateValue, nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<gfxAlternateValue, nsTArray_Impl<gfxAlternateValue, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
      featureValueLookup = {mRawPtr = 0x0}, 
      fontFeatureSettings = {<nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = {
            mHdr = 0x7ffff6793a48 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<gfxFontFeature, nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<gfxFontFeature, nsTArray_Impl<gfxFontFeature, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, 
      languageOverride = {<nsAString_internal> = {mData = 0x7ffff4caf80a <gNullChar> u"", mLength = 0, mFlags = 1}, <No data fields>}}, mNext = {mRawPtr = 0x0}}, mBorderWidthTable = {60, 
    180, 300}, mInterruptChecksToSkip = 0, mFramesConstructed = 0, mFramesReflowed = 0, mReflowStartTime = {mValue = 0}, mLastStyleUpdateForAllAnimations = {mValue = 109043384692600}, 
  mHasPendingInterrupt = 0, mInterruptsEnabled = 0, mUseDocumentFonts = 1, mUseDocumentColors = 1, mUnderlineLinks = 1, mSendAfterPaintToContent = 0, mUseFocusColors = 0, 
  mFocusRingOnAnything = 0, mFocusRingStyle = 1, mDrawImageBackground = 1, mDrawColorBackground = 1, mNeverAnimate = 0, mIsRenderingOnlySelection = 0, mPaginated = 0, 
  mCanPaginatedScroll = 0, mDoScaledTwips = 1, mIsRootPaginatedDocument = 0, mPrefBidiDirection = 1, mPrefScrollbarSide = 0, mPendingSysColorChanged = 0, mPendingThemeChanged = 0, 
  mPendingUIResolutionChanged = 0, mPendingMediaFeatureValuesChanged = 0, mPrefChangePendingNeedsReflow = 0, mIsEmulatingMedia = 0, mAllInvalidated = 0, mIsGlyph = 0, mUsesRootEMUnits = 0, 
  mUsesExChUnits = 0, mUsesViewportUnits = 0, mPendingViewportChange = 0, mCounterStylesDirty = 1, mPostedFlushCounterStyles = 0, mSuppressResizeReflow = 0, mIsVisual = 0, 
  mFireAfterPaintEvents = 0, mIsChrome = 0, mIsChromeOriginImage = 0, mPaintFlashing = 0, mPaintFlashingInitialized = 0, mHasWarnedAboutPositionedTableParts = 0, mQuirkSheetAdded = 1, 
  mNeedsPrefUpdate = 0, mRestyleLoggingEnabled = false, mInitialized = true, mLayoutPhaseCount = {0, 0, 0}}

Comment 6

[u209627]

(In reply to Mats Palmgren (:mats) from comment #4)
> BTW, does it also crash using a fresh profile?
> 
> The easiest way to test that is to give an empty directory as the profile
> directory on the command line, like so:
> mkdir /tmp/x
> firefox -profile /tmp/x

You're right. With a fresh profile it doesn't crash. So maybe some extension is causing this? I'll try to see if I can sort it out what's happening. Thanks!

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Does the patch from bug 1196379 help?

Comment 8

[u209627]

(In reply to David Baron [:dbaron] ⌚UTC-7 from comment #7)
> Does the patch from bug 1196379 help?

Yes! :) Thanks David. I'm marking this as duplicate of bug 1196379.

Thank you VERY much!