1309982 - Crash in nsCSSFrameConstructor::BeginUpdate

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

This bug was filed from the Socorro interface and is 
report bp-4d165702-8630-4150-8d1c-fc0d62161013.
=============================================================

Firefox 49.0.1 64-bit on Windows 8.1

1. Opened http://www.cracked.com/blog/6-reasons-trumps-rise-that-no-one-talks-about_p2/
2. Opened Print Preview from the File menu while the throbber was still active.
3. Scrolled some lines down.
4. Hit the close button (throbber was likely still active).
Actual result:
Saw this crash twice, but needed a dozen tries in a second profile to reproduce this. Clearing the cache might be necessary between the attempts.

See also bug 496020 - "nsCSSFrameConstructor::BeginUpdate is called when scripts are not blocked" which got fixed 7 years ago. CCing tnikkel as assignee of that bug.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'nsCSSFrameConstructor::BeginUpdate':
 - nightly (version 52): 1 crash from 2016-09-19.
 - aurora  (version 51): 0 crashes from 2016-09-19.
 - beta    (version 50): 419 crashes from 2016-09-20.
 - release (version 49): 348 crashes from 2016-09-05.
 - esr     (version 45): 143 crashes from 2016-07-25.

Crash volume on the last weeks (Week N is from 10-17 to 10-23):
            W. N-1  W. N-2  W. N-3  W. N-4
 - nightly       0       0       0       1
 - aurora        0       0       0       0
 - beta         85     131      96      11
 - release      96     101      91      21
 - esr          29      22      16       9

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora
 - beta    #91
 - release #574      #707
 - esr     #309

Comment 2

[Timothy Nikkel (:tnikkel)]

Attachment: patch

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/713fd01584d9
Check if presshell is destroying before proceeding to do more work in PresShell::ReconstructFrames. r=mats

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/713fd01584d9

Comment 5

[Timothy Nikkel (:tnikkel)]

Comment on attachment 8802803 [details] [diff] [review]
patch

Approval Request Comment
[Feature/regressing bug #]: been around for a very long time
[User impact if declined]: crashes
[Describe test coverage new/current, TreeHerder]: none
[Risks and why]: a safe patch
[String/UUID change made/needed]: none

Comment 6

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8802803 [details] [diff] [review]
patch

There's 20-50 instances of this crash per Beta build, taking it. Aurora51+, Beta50+

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/6e517aa653d6aa0dd846f66ae9b6826821c1bad7
https://hg.mozilla.org/releases/mozilla-beta/rev/def5ec38d5749c1ab9729d1e47f9c8804ea51c95