Crash in nsCSSFrameConstructor::BeginUpdate

RESOLVED FIXED in Firefox 50

Status

()

Core
Layout
--
critical
RESOLVED FIXED
2 years ago
a year ago

People

(Reporter: aryx, Assigned: tnikkel)

Tracking

({crash})

unspecified
mozilla52
Unspecified
Windows 8
crash
Points:
---

Firefox Tracking Flags

(firefox49 wontfix, firefox-esr45 wontfix, firefox50 fixed, firefox51 fixed, firefox52 fixed)

Details

(crash signature)

Attachments

(1 attachment)

This bug was filed from the Socorro interface and is 
report bp-4d165702-8630-4150-8d1c-fc0d62161013.
=============================================================

Firefox 49.0.1 64-bit on Windows 8.1

1. Opened http://www.cracked.com/blog/6-reasons-trumps-rise-that-no-one-talks-about_p2/
2. Opened Print Preview from the File menu while the throbber was still active.
3. Scrolled some lines down.
4. Hit the close button (throbber was likely still active).
Actual result:
Saw this crash twice, but needed a dozen tries in a second profile to reproduce this. Clearing the cache might be necessary between the attempts.

See also bug 496020 - "nsCSSFrameConstructor::BeginUpdate is called when scripts are not blocked" which got fixed 7 years ago. CCing tnikkel as assignee of that bug.
Crash volume for signature 'nsCSSFrameConstructor::BeginUpdate':
 - nightly (version 52): 1 crash from 2016-09-19.
 - aurora  (version 51): 0 crashes from 2016-09-19.
 - beta    (version 50): 419 crashes from 2016-09-20.
 - release (version 49): 348 crashes from 2016-09-05.
 - esr     (version 45): 143 crashes from 2016-07-25.

Crash volume on the last weeks (Week N is from 10-17 to 10-23):
            W. N-1  W. N-2  W. N-3  W. N-4
 - nightly       0       0       0       1
 - aurora        0       0       0       0
 - beta         85     131      96      11
 - release      96     101      91      21
 - esr          29      22      16       9

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora
 - beta    #91
 - release #574      #707
 - esr     #309
status-firefox49: --- → affected
status-firefox50: --- → affected
status-firefox52: --- → affected
status-firefox-esr45: --- → affected
(Assignee)

Comment 2

2 years ago
Created attachment 8802803 [details] [diff] [review]
patch
Assignee: nobody → tnikkel
Attachment #8802803 - Flags: review?(mats)

Updated

2 years ago
Attachment #8802803 - Flags: review?(mats) → review+

Comment 3

2 years ago
Pushed by tnikkel@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/713fd01584d9
Check if presshell is destroying before proceeding to do more work in PresShell::ReconstructFrames. r=mats

Comment 4

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/713fd01584d9
Status: NEW → RESOLVED
Last Resolved: 2 years ago
status-firefox52: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla52
(Assignee)

Comment 5

2 years ago
Comment on attachment 8802803 [details] [diff] [review]
patch

Approval Request Comment
[Feature/regressing bug #]: been around for a very long time
[User impact if declined]: crashes
[Describe test coverage new/current, TreeHerder]: none
[Risks and why]: a safe patch
[String/UUID change made/needed]: none
Attachment #8802803 - Flags: approval-mozilla-beta?
Attachment #8802803 - Flags: approval-mozilla-aurora?

Updated

2 years ago
status-firefox51: --- → affected

Comment 6

2 years ago
Comment on attachment 8802803 [details] [diff] [review]
patch

There's 20-50 instances of this crash per Beta build, taking it. Aurora51+, Beta50+
Attachment #8802803 - Flags: approval-mozilla-beta?
Attachment #8802803 - Flags: approval-mozilla-beta+
Attachment #8802803 - Flags: approval-mozilla-aurora?
Attachment #8802803 - Flags: approval-mozilla-aurora+

Updated

a year ago
Depends on: 1326500
status-firefox49: affected → wontfix
status-firefox-esr45: affected → wontfix
You need to log in before you can comment on or make changes to this bug.