1369363 - Crash in nsLayoutUtils::TransformFrameRectToAncestor

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-edfecd4d-21a3-4647-9a51-5a2870170601.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	nsLayoutUtils::TransformFrameRectToAncestor(nsIFrame*, nsRect const&, nsIFrame const*, bool*, mozilla::Maybe<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> >*) 	layout/base/nsLayoutUtils.cpp:3046
1 	xul.dll 	mozilla::dom::DOMIntersectionObserver::Update(nsIDocument*, double) 	dom/base/DOMIntersectionObserver.cpp:397
2 	xul.dll 	nsDocument::UpdateIntersectionObservations() 	dom/base/nsDocument.cpp:12585
3 	xul.dll 	nsRefreshDriver::Tick(__int64, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:1945
4 	xul.dll 	mozilla::RefreshDriverTimer::TickDriver(nsRefreshDriver*, __int64, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:329
5 	xul.dll 	mozilla::RefreshDriverTimer::TickRefreshDrivers(__int64, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) 	layout/base/nsRefreshDriver.cpp:299
6 	xul.dll 	mozilla::RefreshDriverTimer::Tick(__int64, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:320
7 	xul.dll 	mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:711
8 	xul.dll 	mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:624
9 	xul.dll 	mozilla::detail::RunnableMethodImpl<mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver* const, void ( mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp), 1, 0, mozilla::TimeStamp>::Run() 	obj-firefox/dist/include/nsThreadUtils.h:890
10 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1264
11 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/threads/nsThreadUtils.cpp:389
12 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:124
13 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:231
14 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:211
15 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp:156
16 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp:269
17 	xul.dll 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp:283
18 	xul.dll 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp:4499
19 	xul.dll 	XREMain::XRE_main(int, char** const, mozilla::BootstrapConfig const&) 	toolkit/xre/nsAppRunner.cpp:4677
20 	xul.dll 	XRE_main(int, char** const, mozilla::BootstrapConfig const&) 	toolkit/xre/nsAppRunner.cpp:4768
21 	xul.dll 	mozilla::BootstrapImpl::XRE_main(int, char** const, mozilla::BootstrapConfig const&) 	toolkit/xre/Bootstrap.cpp:45
22 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:115
23 	firefox.exe 	__scrt_common_main_seh 	f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:253
24 	kernel32.dll 	BaseThreadInitThunk 	
25 	ntdll.dll 	__RtlUserThreadStart 	
26 	ntdll.dll 	_RtlUserThreadStart

this cross-platform crash signature related to the IntersectionObserver api started occurring on 55.0a1 build 20170430030208 after the feature was turned on (bug 1321865) and on 54.0b after the telemetry experiment was enabled there with bug 1362418 (100% of those crashes on beta are part of the [e-mail] test).

Comment 1

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Hi Jet, this was mentioned at the channel meeting today as a crash seen on Beta54 due to the Intersection observer API experiment. If we can have a fix in Nightly before this hits Beta channel post-merge, that would be great. Thanks!

Comment 2

[Tobias Schneider [:tobytailor]]

I'm looking into this right now.

Comment 3

[Liz Henry (:lizzard) (relman/hg->git project)]

Tracking for 54 and 55 so we can keep an eye on crashes related to this new feature.

Comment 4

[Tobias Schneider [:tobytailor]]

Was able to reproduce the crash. We already target this issue in bug 1359318 which should pass review and land soonish.

Comment 5

[Gerry Chang [:gchang]]

Hi Tobias,
AFAIK, intersection-observer will be disabled in 54 soon, does that mean this is a won't fix in 54?

Comment 6

[Tobias Schneider [:tobytailor]]

Bug 1359318 is going to land soon which will fix this issue.

Comment 7

[Jet Villegas (inactive)]

(In reply to Tobias Schneider [:tobytailor] from comment #4)
> Was able to reproduce the crash. We already target this issue in bug 1359318
> which should pass review and land soonish.

Test URL?

Comment 8

[Tobias Schneider [:tobytailor]]

Attachment: Crashtest

Comment 9

[Tobias Schneider [:tobytailor]]

Attachment: Crashtest

Comment 10

[Tobias Schneider [:tobytailor]]

Try run: https://treeherder.mozilla.org/#/jobs?repo=try&revision=9cbfda8d6a98da0bfa9c38c089b6bc314d3672d8

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1cd8ff732157
Test for crash in nsLayoutUtils::TransformFrameRectToAncestor.

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/1cd8ff732157