1320367 - Firefox crashes in [@ PLDHashTable::Search | mozilla::dom::DOMIntersectionObserver::UnlinkTarget ] & [@ NS_TableDrivenQI ]

Status: RESOLVED DUPLICATE of bug 1317415

(Core :: DOM: Core & HTML, defect)

Description

[Gary [:streetwolf52]]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:53.0) Gecko/20100101 Firefox/53.0
Build ID: 20161125030214

Steps to reproduce:

Played this video...   http://money.cnn.com/2016/11/25/media/rogue-one-tickets/


Actual results:

e10s - Tab crash
non-e10s - Fx crash


Expected results:

Shouldn't crash.

Regression range taken from inbound:

Bad
https://hg.mozilla.org/integration/mozilla-inbound/rev/53a9ff4a083a2c790d25939a598ec8378e77abf4

Good
https://hg.mozilla.org/integration/mozilla-inbound/rev/54f07489d3c0b282d407ad437b72d030df981fa6

Crash doesn't always happen when playing a video.  The video I gave consistently crashes.  Sites like cnn.com and msn.com produce the most crashes, some not videos.

Comment 1

[Gary [:streetwolf52]]

Crash report:

 https://crash-stats.mozilla.com/report/index/93e9041f-95a1-4795-8f73-0b3f22161125

This one is related to the video I gave.  There are others out there where I crashed when not playing any videos.

Comment 2

[Gary [:streetwolf52]]

Latest Nightly now has the 'bad' patch.

Comment 3

[Gary [:streetwolf52]]

Other crashes:

https://crash-stats.mozilla.com/report/index/7be48be1-f0f1-4435-a5b1-f6e5a2161125#tab-details

Comment 4

[Alice0775 White]

seems regressed by bf9f20dbe8d8	Tobias Schneider — Bug 1315837 - Crash in mozilla::dom::Element::UpdateIntersectionObservation. r=mrbkap

Comment 5

[Alice0775 White]

Latest Aurora 52.0a21 tinderbox build also crashes.
https://hg.mozilla.org/releases/mozilla-aurora/rev/8102d0d48f8d7ea0f6fa76710ca8c44c620190e3

Comment 6

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

[Tracking Requested - why for this release]: Regression

Comment 7

[Gary [:streetwolf52]]

I'm crashing very often when in cnn.com when I go to a link.  Crashes on other sites are few and far between.  Wonder what's up with cnn.com?

Comment 8

[Alice0775 White]

On Aurora52.0a2, the offending patch was backed out(Bug 1315837 Comment 43).

Comment 9

[Ludovic Hirlimann [:Usul]]

Isn't that a dupe of https://bugzilla.mozilla.org/show_bug.cgi?id=1317415 ?
I crashed with both nightly Linux and nightly android on lemonde.fr

Comment 10

[Jim Jeffery not reading bug-mail 1/2/11]

(In reply to Ludovic Hirlimann [:Usul] from comment #9)
> Isn't that a dupe of https://bugzilla.mozilla.org/show_bug.cgi?id=1317415 ?
> I crashed with both nightly Linux and nightly android on lemonde.fr

We can't tell that for sure because 1317415 is a 'security bug' and most of us, short of developers can't see what that bug is all about.

Comment 11

[Bill Gianopoulos [:WG9s]]

I get this carsh at least 50% of the time on any page i try to reference on the BBC website.

Comment 12

[Gary [:streetwolf52]]

What's the story with this? I would think a bug report marked Critical would get attention.

Comment 13

[Marcia Knous [:marcia]]

The 2 crash signatures in this bug are also present in Bug 1317415 - I made a comment referencing this bug in that bug - so the developers are aware of these crashes and we are actively investigating.

Comment 14

[Marcia Knous [:marcia]]

Tracking 53+ to make sure this crash gets addressed.

Comment 16

[Marcia Knous [:marcia]]

Updating tracking flags based on the fact this is a dupe.