Closed Bug 1265280 Opened 9 years ago Closed 2 years ago

crash in nsStyleContext::StyleDisplay, called from ZIndexForFrame

Categories

(Core :: Web Painting, defect)

Unspecified
Windows NT
defect

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox47 --- wontfix
firefox48 --- wontfix
firefox49 --- wontfix
firefox-esr45 --- wontfix
firefox50 --- wontfix
firefox51 --- wontfix
firefox84 --- affected

People

(Reporter: n.nethercote, Unassigned)

References

Details

(Keywords: crash, regression, Whiteboard: qa-not-actionable)

Crash Data

Attachments

(3 files)

This bug was filed from the Socorro interface and is report bp-3b40b941-49b4-4c83-beff-51ecc2160417. ============================================================= We've gotten a handful of these crashes in each of the past 3 Nightly builds (20160415030231, 20160416030220, 20160417030601). The stack is different to the one from bug 1256500 because the second frame is different: > 0 xul.dll nsStyleContext::StyleDisplay() obj-firefox/dist/include/nsStyleStructList.h > 1 xul.dll ZIndexForFrame layout/base/nsDisplayList.cpp > 2 xul.dll IsZOrderLEQ layout/base/nsDisplayList.cpp > 3 xul.dll Sort layout/base/nsDisplayList.cpp > 4 xul.dll nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsRect const&, nsDisplayList*) layout/generic/nsFrame.cpp > 5 xul.dll nsSubDocumentFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsSubDocumentFrame.cpp > 6 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 7 xul.dll DisplayLine layout/generic/nsBlockFrame.cpp > 8 xul.dll nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsBlockFrame.cpp > 9 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 10 xul.dll DisplayLine layout/generic/nsBlockFrame.cpp > 11 xul.dll nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsBlockFrame.cpp > 12 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 13 xul.dll DisplayLine layout/generic/nsBlockFrame.cpp > 14 xul.dll nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsBlockFrame.cpp > 15 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 16 xul.dll nsCanvasFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsCanvasFrame.cpp > 17 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 18 xul.dll mozilla::ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsGfxScrollFrame.cpp > 19 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 20 xul.dll ViewportFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsViewportFrame.cpp > 21 xul.dll nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsRect const&, nsDisplayList*) layout/generic/nsFrame.cpp > 22 xul.dll nsSubDocumentFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsSubDocumentFrame.cpp > 23 xul.dll nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsRect const&, nsDisplayList*) layout/generic/nsFrame.cpp > 24 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 25 xul.dll nsContainerFrame::BuildDisplayListForNonBlockChildren(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsContainerFrame.cpp > 26 xul.dll nsContainerFrame::BuildDisplayListForInline(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsContainerFrame.h > 27 xul.dll nsInlineFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsInlineFrame.cpp > 28 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 29 xul.dll DisplayLine layout/generic/nsBlockFrame.cpp > 30 xul.dll nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsBlockFrame.cpp > 31 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 32 xul.dll DisplayLine layout/generic/nsBlockFrame.cpp > 33 xul.dll nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsBlockFrame.cpp > 34 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 35 xul.dll mozilla::ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsGfxScrollFrame.cpp > 36 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 37 xul.dll DisplayLine layout/generic/nsBlockFrame.cpp > 38 xul.dll nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsBlockFrame.cpp > 39 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 40 xul.dll DisplayLine layout/generic/nsBlockFrame.cpp > 41 xul.dll nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsBlockFrame.cpp > 42 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 43 xul.dll DisplayLine layout/generic/nsBlockFrame.cpp > 44 xul.dll nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsBlockFrame.cpp > 45 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 46 xul.dll DisplayLine layout/generic/nsBlockFrame.cpp > 47 xul.dll nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsBlockFrame.cpp > 48 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 49 xul.dll nsCanvasFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsCanvasFrame.cpp > 50 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 51 xul.dll mozilla::ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsGfxScrollFrame.cpp > 52 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 53 xul.dll ViewportFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsViewportFrame.cpp > 54 xul.dll nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsRect const&, nsDisplayList*) layout/generic/nsFrame.cpp > 55 xul.dll nsSubDocumentFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsSubDocumentFrame.cpp > 56 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 57 xul.dll DisplayLine layout/generic/nsBlockFrame.cpp > 58 xul.dll nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsBlockFrame.cpp > 59 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 60 xul.dll DisplayLine layout/generic/nsBlockFrame.cpp > 61 xul.dll nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsBlockFrame.cpp > 62 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 63 xul.dll nsCanvasFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsCanvasFrame.cpp > 64 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 65 xul.dll mozilla::ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsGfxScrollFrame.cpp > 66 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 67 xul.dll ViewportFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsViewportFrame.cpp > 68 xul.dll nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsRect const&, nsDisplayList*) layout/generic/nsFrame.cpp > 69 xul.dll nsSubDocumentFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsSubDocumentFrame.cpp > 70 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 71 xul.dll DisplayLine layout/generic/nsBlockFrame.cpp > 72 xul.dll nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsBlockFrame.cpp > 73 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 74 xul.dll DisplayLine layout/generic/nsBlockFrame.cpp > 75 xul.dll nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsBlockFrame.cpp > 76 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 77 xul.dll DisplayLine layout/generic/nsBlockFrame.cpp > 78 xul.dll nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsBlockFrame.cpp > 79 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 80 xul.dll mozilla::ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsGfxScrollFrame.cpp > 81 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 82 xul.dll DisplayLine layout/generic/nsBlockFrame.cpp > 83 xul.dll nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsBlockFrame.cpp > 84 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 85 xul.dll DisplayLine layout/generic/nsBlockFrame.cpp > 86 xul.dll nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsBlockFrame.cpp > 87 xul.dll nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int) layout/generic/nsFrame.cpp > 88 xul.dll DisplayLine layout/generic/nsBlockFrame.cpp > 89 xul.dll nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) layout/generic/nsBlockFrame.cpp > 180 xul.dll MessageLoop::Run() ipc/chromium/src/base/message_loop.cc > 181 xul.dll XRE_InitChildProcess toolkit/xre/nsEmbedFunctions.cpp > 182 plugin-container.exe wmain toolkit/xre/nsWindowsWMain.cpp I don't know how to interpret the frame numbers jumping from 89 to 180 in this example stack trace.
dbaron, any idea if this is related to bug 1256500?
Flags: needinfo?(dbaron)
So in this particular minidump (the one from comment 0), nsStyleContext::StyleDisplay is being called with a null |this| pointer. We crash when trying to look at mCachedStyleData, which I did check against the correct source that it is at offset 0x40. Looking up a frame, at ZIndexForFrame, mStyleContext should be at offset 0x20 (leaving room for the vtable pointer at the start, I think), which agrees with the disassembly. That also shows the style context in RCX (as null), and the aFrame in RDI being 000000ABC3CD6520. (The !aFrame->IsAbsPosContainingBlock gets inlined into a call to nsStyleContext::StyleDisplay and then a call to nsStyleDisplay::IsAbsPosContainingBlock.) 000000ABC3CD6520 does seem consistent with heap addresses a few frames down on the stack (e.g., in nsSubDocumentFrame::BuildDisplayList). No bright ideas, really, although it's certainly *not* bug 1256500.
I'd be interested in extension / module correlations for this. (And I do think I've seen crashes like this one on release when I was looking through the nsStyleContext::StyleDisplay crashes; I just filed one of the patterns because I saw what was going on.)
(In reply to David Baron [:dbaron] ⌚️UTC-7 from comment #4) > I'd be interested in extension / module correlations for this. "none found", as best as I can tell.
"None found" means the report is broken, not that there's nothing interesting in the information that would be there if it were working
Summary: crash in nsStyleContext::StyleDisplay → crash in nsStyleContext::StyleDisplay, called from ZIndexForFrame
(The main thing I want out of that abort message is the display item type, but I figure the pointers won't hurt while I'm there.)
So looking at the crash reports again, I was misled by the Visual Studio debugger. In bp-3eab56d0-ad64-4764-a65d-f909a2160425, we're calling nsStyleContext::StyleDisplay with this=0x7ffffffff0de7fff, which is the frame poison pattern. bp-780f5e2d-97b9-4485-bc13-8e9262160425 appears to be the same, although I didn't look as closely. So my debugging patch isn't actually going to work.
... but I should instead test the StyleContext() pointer against mozPoisonValue()
So crashes with the debugging info show up at: https://crash-stats.mozilla.com/signature/?date=%3E%3D2016-04-27&product=Firefox&release_channel=nightly&signature=mozalloc_abort+%7C+NS_DebugBreak+%7C+IsZOrderLEQ&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&page=1#reports So far there's only one: bp-fecc85fb-6390-40d8-b20f-427742160429 and it has: ###!!! ABORT: bad display item 1e1b2027980 type Plugin frame 1e19f569278 (The abort message isn't in crash-stats, but the MSVC debugger shows the value of |buf| in NS_DebugBreak.) It would be nice to get a few more to confirm a pattern.
Two more: bp-528b8c2d-e83f-4586-88dd-698f22160502 ###!!! ABORT: bad display item 28d6dbca2a8 type WrapList frame 28d74a7f5a0 bp-3d240964-198a-4f33-97f7-d50c82160503 ###!!! ABORT: bad display item 1424433f9f0 type WrapList frame 1423dc6b5f0
bp-e4348988-050d-4cf9-9b5a-1c1ae2160504 ###!!! ABORT: bad display item 20d99356820 type WrapList frame 20da4c61480 bp-9ca0f4c0-2449-4203-9731-5d6c92160505 ###!!! ABORT: bad display item 283485b8 type WrapList frame 38b934b0 bp-ad1fd4e1-6062-49b4-800f-264902160505 ###!!! ABORT: bad display item 1e649ed0 type WrapList frame 246393f0 bp-b53fb44b-1c25-434a-801e-e8a802160505 ###!!! ABORT: bad display item 16ddd360 type WrapList frame 177ee9e0 bp-3aa629f6-686d-46af-9016-502b62160505 ###!!! ABORT: bad display item 23264838 type WrapList frame 1f362508 bp-c6b20eaf-467b-4688-8c33-8de452160505 ###!!! ABORT: bad display item 12e74020 type WrapList frame a7142b0 bp-cc231dab-8b7f-4e6d-85c8-b67732160505 ###!!! ABORT: bad display item 1dee2800 type WrapList frame 14b81c50 bp-04ac6a52-e5ab-41de-b70a-6be802160505 ###!!! ABORT: bad display item 115a4398 type WrapList frame 11be63f0 bp-11a54a06-3b4d-4049-a198-b89b42160506 ###!!! ABORT: bad display item 1aa12d38 type WrapList frame 169ea730
bp-391a55a9-4a12-47bd-a25d-0eca02160507 ###!!! ABORT: bad display item 1a3a17e5d90 type WrapList frame 1a3988765f8 (non-e10s, so right there in Socorro) bp-6313510f-8306-485b-9074-1292a2160508 ###!!! ABORT: bad display item 1f4b7e78100 type WrapList frame 1f4b7fe3540 (but no crashes since May 8)
Crash volume for signature 'nsStyleContext::StyleDisplay': - nightly (version 50): 7 crashes from 2016-06-06. - aurora (version 49): 32 crashes from 2016-06-07. - beta (version 48): 567 crashes from 2016-06-06. - release (version 47): 1391 crashes from 2016-05-31. - esr (version 45): 1165 crashes from 2016-04-07. Crash volume on the last weeks: Week N-1 Week N-2 Week N-3 Week N-4 Week N-5 Week N-6 Week N-7 - nightly 2 0 2 0 1 0 1 - aurora 1 5 9 7 5 4 1 - beta 117 53 71 93 90 84 21 - release 213 182 207 214 198 224 68 - esr 148 131 116 140 153 118 74 Affected platforms: Windows, Mac OS X
Crash volume for signature 'nsStyleContext::StyleDisplay': - nightly (version 51): 1 crash from 2016-08-01. - aurora (version 50): 8 crashes from 2016-08-01. - beta (version 49): 147 crashes from 2016-08-02. - release (version 48): 190 crashes from 2016-07-25. - esr (version 45): 1749 crashes from 2016-05-02. Crash volume on the last weeks (Week N is from 08-22 to 08-28): W. N-1 W. N-2 W. N-3 - nightly 0 1 0 - aurora 2 4 0 - beta 52 50 15 - release 63 60 30 - esr 171 200 139 Affected platforms: Windows, Mac OS X Crash rank on the last 7 days: Browser Content Plugin - nightly - aurora #174 - beta #360 #264 - release #442 #146 - esr #56
Component: Layout → Layout: View Rendering
I think this crash now shows up as nsStyleDisplay::IsAbsPosContainingBlock bp-4d12a372-7f74-476e-8121-45c912161116
Crash Signature: [@ nsStyleContext::StyleDisplay] → [@ nsStyleContext::StyleDisplay] [@ nsStyleDisplay::IsAbsPosContainingBlock ]
Component: Layout: View Rendering → Layout: Web Painting
The leave-open keyword is there and there is no activity for 6 months. :mattwoodrow, maybe it's time to close this bug?
Flags: needinfo?(matt.woodrow)

The leave-open keyword is there and there is no activity for 6 months.
:mattwoodrow, maybe it's time to close this bug?

Flags: needinfo?(matt.woodrow)

Looks like this is still crashing (at a low rate), so I'll keep the bug open for now.

Flags: needinfo?(matt.woodrow)
Keywords: leave-open
Whiteboard: qa-not-actionable
Severity: critical → S2

Very few crashes on crash stats -> S3.

Severity: S2 → S3

Closing because no crashes reported for 12 weeks.

Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: