Open Bug 1317655 Opened 8 years ago Updated 2 years ago

Crash at BuildTextRunsScanner::SetupBreakSinksForTextRun(gfxTextRun *,void const *) [nsTextFrame.cpp:f455459b2ae5 : 2583 + 0x12]

Categories

(Core :: Layout, defect, P3)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

People

(Reporter: cbook, Unassigned)

Details

(Keywords: crash)

Attachments

(1 file)

bughunter stack
305.22 KB, text/plain
Details
Attached file bughunter stack — 
found via bughunter on a NSFW Website (ask me for the url) and reproduced on latest m-c tinderbox windows opt and debug build.

affects trunk to debug builds from beta to trunk with crash on load of this page

https://crash-stats.mozilla.com/report/index/28cbf979-5f86-461a-8a11-f3aad2161115 is the opt crash and a (i guess) more useful stack from bughunter attached.
Looks like some infinite recursion happens between HandlePostedReflowCallbacks and FlushPendingNotifications.
We have seen such infinite recursion before, e.g. bug 866767.
Priority: -- → P3
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: