1228406 - crash in mozilla::FrameLayerBuilder::ComputeGeometryChangeForItem

Status: RESOLVED WORKSFORME

(Core :: Web Painting, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-a5fde853-af5e-4d42-bde1-6af2f2151125.
=============================================================
Crashing Thread
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::FrameLayerBuilder::ComputeGeometryChangeForItem(mozilla::FrameLayerBuilder::DisplayItemData*) 	layout/base/FrameLayerBuilder.cpp
1 	xul.dll 	mozilla::FrameLayerBuilder::WillEndTransaction() 	layout/base/FrameLayerBuilder.cpp
2 	xul.dll 	nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) 	layout/base/nsDisplayList.cpp
3 	xul.dll 	nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, unsigned int) 	layout/base/nsLayoutUtils.cpp
4 	xul.dll 	PresShell::Paint(nsView*, nsRegion const&, unsigned int) 	layout/base/nsPresShell.cpp

this is a cross-platform and cross-product crash that has been around for a while. (it came to my attention because it is making up 0.3% of crashes in early data for 43.0b6, but the volume is still rather low in absolute numbers).

Comment 1

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I took a look at bp-cf23e48f-3bb1-476c-b4ed-6f0182160316 ; it's crashing on the line aData->mGeometry->MoveBy(shift), where aData->mGeometry seems like a reasonable pointer address, except the vtable pointer in it is 0x00000001, so we crash trying to do the call.

I also looked at bp-ea3c9807-5db9-46ab-b56f-e07602160316, which made much less sense.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'mozilla::FrameLayerBuilder::ComputeGeometryChangeForItem':
 - nightly (version 50): 10 crashes from 2016-06-06.
 - aurora  (version 49): 10 crashes from 2016-06-07.
 - beta    (version 48): 845 crashes from 2016-06-06.
 - release (version 47): 1739 crashes from 2016-05-31.
 - esr     (version 45): 58 crashes from 2016-04-07.

Crash volume on the last weeks:
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       4       1       3       0       1       0       0
 - aurora        0       1       1       1       0       2       4
 - beta        140     126     106     100     129     104      99
 - release     233     263     230     233     208     251     200
 - esr           4      12       8       7       6       5       5

Affected platforms: Windows, Mac OS X, Linux

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'mozilla::FrameLayerBuilder::ComputeGeometryChangeForItem':
 - nightly (version 51): 2 crashes from 2016-08-01.
 - aurora  (version 50): 8 crashes from 2016-08-01.
 - beta    (version 49): 207 crashes from 2016-08-02.
 - release (version 48): 221 crashes from 2016-07-25.
 - esr     (version 45): 87 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       0       2       0
 - aurora        2       4       1
 - beta         67      54      30
 - release      72      64      37
 - esr           8      13       9

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora  #1518     #349
 - beta    #260      #88
 - release #282      #136
 - esr     #1193

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'mozilla::FrameLayerBuilder::ComputeGeometryChangeForItem':
 - nightly (version 52): 2 crashes from 2016-09-19.
 - aurora  (version 51): 4 crashes from 2016-09-19.
 - beta    (version 50): 129 crashes from 2016-09-20.
 - release (version 49): 212 crashes from 2016-09-05.
 - esr     (version 45): 125 crashes from 2016-06-01.

Crash volume on the last weeks (Week N is from 10-03 to 10-09):
            W. N-1  W. N-2
 - nightly       0       2
 - aurora        4       0
 - beta        101      28
 - release     164      48
 - esr          11       7

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora  #685      #503
 - beta    #304      #66
 - release #590      #173
 - esr     #740

Comment 5

[Julien Cristau [:jcristau]]

Too late for firefox 52, mass-wontfix.

Comment 6

[Andrei Purice]

Marking this as Resolved > Worksforme since no other crashes with this signature have been reported in the last 6 months.