Closed Bug 1381390 Opened 7 years ago Closed 7 years ago

stylo: Crash in nsFrameManager::RemoveFrame

Categories

(Core :: CSS Parsing and Computation, defect, P1)

Product:
Core
Component:
CSS Parsing and Computation
Platform:
Unspecified
macOS
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla56
Tracking Flags:
Tracking Status
firefox-esr52 --- unaffected
firefox54 --- unaffected
firefox55 --- unaffected
firefox56 --- fixed

People

(Reporter: cpeterson, Assigned: heycam)

References

(Blocks 1 open bug)

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-46aff620-fec3-401e-b1b5-6880f0170716.
=============================================================
This is pretty much just another place where an use-after-free absolute frame can lead to crash.
This specific crash I got when clicking Publish in mozreview.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Er, I don't understand why that closes the bug...
Flags: needinfo?(cam)
Must have misclicked.

Anyway, currently looking into this.
Assignee: nobody → cam
Status: RESOLVED → REOPENED
Flags: needinfo?(cam)
Resolution: FIXED → ---
Status: REOPENED → ASSIGNED
FWIW, the crashes happen only OS X?
I did encounter it on OS X, and am currently trying to reproduce on Linux in rr.
No longer happened since 20170716100325.
Cameron, please re-open if you see this crash again.
Status: ASSIGNED → RESOLVED
Closed: 7 years ago → 7 years ago
Resolution: --- → FIXED
status-firefox54: --- → unaffected
status-firefox55: --- → unaffected
status-firefox56: --- → fixed
status-firefox-esr52: --- → unaffected
Target Milestone: --- → mozilla56
You need to log in before you can comment on or make changes to this bug.