1379617 - stylo: Crash in nsIFrame::SetNextSibling

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect, P1)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-a8141646-372b-40d9-84da-e6d630170710.
=============================================================

55 crashes/16 installs that have stylo enabled (at least the 6 reports I spot checked): http://bit.ly/2tG1O5U

Not sure who to need info, is it bholley?

Comment 1

[Xidorn Quan [:xidorn] UTC+11]

My guess is that the frame constructor somehow messes things up, and we end up violating this assertion: https://hg.mozilla.org/mozilla-central/file/06c1a0dc0fd8/layout/generic/nsFrameList.cpp#l90

Not sure what happens behind, though, since there is no reproducible steps...

Comment 2

[Patrick Albrecht]

I had this crash to twice in the last days.
I can only remember one crash partly and there the tab crashed in a JIRA Case ticket (e.g. https://MY-SYSTEM.atlassian.net/browse/ABC-4901). I think I just tried to open or close an image, but I'm not sure.

Comment 3

[Kacper Michajłow [:kasper93]]

I can trigger this bug by opening and closing popup image, and scrolling the page between. It result in page visual glitch and tab crashes soon after. It is quite rare, so it is hard to provide exact steps to reproduce.

But I also hit bug 1379218 crash while doing my test, so they might have the same cause.

Comment 4

[Marco Bonardo [:mak]]

I can hit this crash pretty often when editing the general review comment in mozreview.

Comment 5

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Please note that there is also bug 1381475 which gets triggered by review comments in mozreview. Are both crashes somehow related?

Comment 6

[Grant]

I can trigger this bug easily with the following steps:

1. Go to https://www.youtube.com/testtube and sign up for the Material design beta
2. Browse some videos, in a few minutes you will get a crash with this bug

Comment 7

[Chris Peterson [:cpeterson]]

Cameron volunteered to investigate this top crash.

Comment 8

[Cameron McCormack (:heycam)]

(In reply to Grant from comment #6)
> 1. Go to https://www.youtube.com/testtube and sign up for the Material
> design beta
> 2. Browse some videos, in a few minutes you will get a crash with this bug

Hi Grant, can you clarify the STR for me?  Do I need to click Sign Up, and go through the lengthy questionnaire where I provide Google with my details for their UX researches to contact me?  Or it it just the "Try new YouTube" button on youtube.com/testtube that I need (which has a Material Design logo next to it)?

Comment 9

[Ed Morley [:emorley]]

I can repro about once in every 5-10 pageloads of https://zapier.com/

Comment 10

[Ed Morley [:emorley]]

Oops sorry that was meant for bug 1381475.

Comment 11

[Cameron McCormack (:heycam)]

I haven't had any luck reproducing this so far, but I see that the aren't any reports of this crash on crash-stats after the 20170716030208 build.

Comment 12

[Henrik Skupin [:whimboo][⌚️UTC+1]]

I could assume that this is maybe overlayed by bug 1381475? If that assumption is true we should see the signature again very soon.

Comment 13

[Cameron McCormack (:heycam)]

Yes, that might be it.  Let's see if it crops up again with today's nightly.

Comment 14

[Hiroyuki Ikezoe (:hiro)]

No longer happened since 20170716030208. I think this crash also has been fixed by bug 1371450. Waiting for a reply from Grant a couple of more days.

Comment 15

[Hiroyuki Ikezoe (:hiro)]

Though we have no reply from Grant yet, we haven't received new crash reports since 20170716030208 build. Closing.