Closed Bug 1324203 Opened 4 years ago Closed 4 years ago

Crash in InvalidArrayIndex_CRASH | nsDocument::NotifyIntersectionObservers

Categories

(Core :: Widget: Cocoa, defect)

Product:
Core
Component:
Widget: Cocoa
Platform:
Unspecified
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1324209
Tracking Flags:
Tracking Status
firefox53 --- affected

People

(Reporter: marcia, Unassigned)

Details

(Keywords: crash, reproducible)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-535e3c59-b278-41d3-8a95-9ea2a2161217.
=============================================================

Seen while running Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:53.0) Gecko/20100101 Firefox/53.0 ID:20161217030205 CSet: 34a1ab064cb5b868fa75cb74d052e978eb34d6c1

STR:

1. Load cnn.com
2. Scroll up using the touchbar (new Macbook Pro 13")
3. Tab crashes - 100% reproducible.

I have all gestures enabled in the Trackpad settings.

ni on markus in case he has some ideas (and this is probably in the wrong component)
Flags: needinfo?(mstange)
Looks like a runnable scheduled by nsDocument::ScheduleIntersectionObserverNotification. Does NewRunnableMethod add a reference to the document? Otherwise nothing is keeping the document alive while we wait to run the runnable and could be running in a free'd document?
Flags: needinfo?(tschneider)
Bug 1324209 has a bit more information, so duping forward.
Status: NEW → RESOLVED
Closed: 4 years ago
Flags: needinfo?(tschneider)
Flags: needinfo?(mstange)
Resolution: --- → DUPLICATE
Duplicate of bug: 1324209
(In reply to Timothy Nikkel (:tnikkel) from comment #1)
> Does NewRunnableMethod add a reference to the document?

Yes it does. There's a comment above NewRunnableMethod that says:
"MyClass must define AddRef and Release methods"

http://searchfox.org/mozilla-central/source/xpcom/glue/nsThreadUtils.h#840
You need to log in before you can comment on or make changes to this bug.