Crash at BuildTextRunsScanner::SetupBreakSinksForTextRun(gfxTextRun *,void const *) [nsTextFrame.cpp:f455459b2ae5 : 2583 + 0x12]

NEW
Unassigned

Status

()

P3
normal
2 years ago
2 years ago

People

(Reporter: cbook, Unassigned)

Tracking

(Blocks: 1 bug, {crash})

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

2 years ago
Created attachment 8810787 [details]
bughunter stack

found via bughunter on a NSFW Website (ask me for the url) and reproduced on latest m-c tinderbox windows opt and debug build.

affects trunk to debug builds from beta to trunk with crash on load of this page

https://crash-stats.mozilla.com/report/index/28cbf979-5f86-461a-8a11-f3aad2161115 is the opt crash and a (i guess) more useful stack from bughunter attached.
Looks like some infinite recursion happens between HandlePostedReflowCallbacks and FlushPendingNotifications.
We have seen such infinite recursion before, e.g. bug 866767.
Priority: -- → P3
You need to log in before you can comment on or make changes to this bug.