Closed Bug 1369363 Opened 2 years ago Closed 2 years ago

Crash in nsLayoutUtils::TransformFrameRectToAncestor

Categories

(Core :: Layout, defect, critical)

54 Branch
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla55
Tracking Status
firefox-esr52 --- unaffected
firefox53 --- unaffected
firefox54 + wontfix
firefox55 + fixed

People

(Reporter: philipp, Assigned: tschneider)

References

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file, 1 obsolete file)

This bug was filed from the Socorro interface and is 
report bp-edfecd4d-21a3-4647-9a51-5a2870170601.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	nsLayoutUtils::TransformFrameRectToAncestor(nsIFrame*, nsRect const&, nsIFrame const*, bool*, mozilla::Maybe<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> >*) 	layout/base/nsLayoutUtils.cpp:3046
1 	xul.dll 	mozilla::dom::DOMIntersectionObserver::Update(nsIDocument*, double) 	dom/base/DOMIntersectionObserver.cpp:397
2 	xul.dll 	nsDocument::UpdateIntersectionObservations() 	dom/base/nsDocument.cpp:12585
3 	xul.dll 	nsRefreshDriver::Tick(__int64, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:1945
4 	xul.dll 	mozilla::RefreshDriverTimer::TickDriver(nsRefreshDriver*, __int64, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:329
5 	xul.dll 	mozilla::RefreshDriverTimer::TickRefreshDrivers(__int64, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) 	layout/base/nsRefreshDriver.cpp:299
6 	xul.dll 	mozilla::RefreshDriverTimer::Tick(__int64, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:320
7 	xul.dll 	mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:711
8 	xul.dll 	mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:624
9 	xul.dll 	mozilla::detail::RunnableMethodImpl<mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver* const, void ( mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp), 1, 0, mozilla::TimeStamp>::Run() 	obj-firefox/dist/include/nsThreadUtils.h:890
10 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1264
11 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/threads/nsThreadUtils.cpp:389
12 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:124
13 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:231
14 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:211
15 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp:156
16 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp:269
17 	xul.dll 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp:283
18 	xul.dll 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp:4499
19 	xul.dll 	XREMain::XRE_main(int, char** const, mozilla::BootstrapConfig const&) 	toolkit/xre/nsAppRunner.cpp:4677
20 	xul.dll 	XRE_main(int, char** const, mozilla::BootstrapConfig const&) 	toolkit/xre/nsAppRunner.cpp:4768
21 	xul.dll 	mozilla::BootstrapImpl::XRE_main(int, char** const, mozilla::BootstrapConfig const&) 	toolkit/xre/Bootstrap.cpp:45
22 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:115
23 	firefox.exe 	__scrt_common_main_seh 	f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:253
24 	kernel32.dll 	BaseThreadInitThunk 	
25 	ntdll.dll 	__RtlUserThreadStart 	
26 	ntdll.dll 	_RtlUserThreadStart

this cross-platform crash signature related to the IntersectionObserver api started occurring on 55.0a1 build 20170430030208 after the feature was turned on (bug 1321865) and on 54.0b after the telemetry experiment was enabled there with bug 1362418 (100% of those crashes on beta are part of the intersection-observer-beta54@experiments.mozilla.org test).
Flags: needinfo?(tschneider)
Component: DOM → Layout
Hi Jet, this was mentioned at the channel meeting today as a crash seen on Beta54 due to the Intersection observer API experiment. If we can have a fix in Nightly before this hits Beta channel post-merge, that would be great. Thanks!
Flags: needinfo?(bugs)
Assignee: nobody → tschneider
Flags: needinfo?(tschneider)
I'm looking into this right now.
Tracking for 54 and 55 so we can keep an eye on crashes related to this new feature.
Depends on: 1359318
Was able to reproduce the crash. We already target this issue in bug 1359318 which should pass review and land soonish.
Flags: needinfo?(bugs)
Hi Tobias,
AFAIK, intersection-observer will be disabled in 54 soon, does that mean this is a won't fix in 54?
Flags: needinfo?(tschneider)
Bug 1359318 is going to land soon which will fix this issue.
Flags: needinfo?(tschneider)
(In reply to Tobias Schneider [:tobytailor] from comment #4)
> Was able to reproduce the crash. We already target this issue in bug 1359318
> which should pass review and land soonish.

Test URL?
Flags: needinfo?(tschneider)
Attached patch Crashtest (obsolete) — Splinter Review
Flags: needinfo?(tschneider)
Attached patch CrashtestSplinter Review
Attachment #8874920 - Attachment is obsolete: true
Keywords: checkin-needed
Pushed by ryanvm@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1cd8ff732157
Test for crash in nsLayoutUtils::TransformFrameRectToAncestor.
Keywords: checkin-needed
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
https://hg.mozilla.org/mozilla-central/rev/1cd8ff732157
Flags: in-testsuite+
Target Milestone: --- → mozilla55
You need to log in before you can comment on or make changes to this bug.