1417430 - Crash in @0x0 | nsDisplayItem::GetClipWithRespectToASR

Status: RESOLVED WORKSFORME

(Core :: Web Painting, defect, P3)

Description

[baffclan]

This bug was filed from the Socorro interface and is
report bp-7845221a-420c-48aa-b30d-bc75c0171115.
=============================================================

Top 10 frames of crashing thread:

0  @0x0 
1 xul.dll nsDisplayItem::GetClipWithRespectToASR layout/painting/nsDisplayList.cpp:3000
2 xul.dll nsDisplayList::GetClippedBoundsWithRespectToASR layout/painting/nsDisplayList.cpp:2182
3 xul.dll mozilla::FrameLayerBuilder::BuildContainerLayerFor layout/painting/FrameLayerBuilder.cpp:5623
4 xul.dll nsDisplayList::PaintRoot layout/painting/nsDisplayList.cpp:2476
5 xul.dll nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:3941
6 xul.dll mozilla::PresShell::Paint layout/base/PresShell.cpp:6468
7 xul.dll nsViewManager::ProcessPendingUpdatesPaint view/nsViewManager.cpp:480
8 xul.dll nsViewManager::ProcessPendingUpdatesForView view/nsViewManager.cpp:412
9 xul.dll nsViewManager::ProcessPendingUpdates view/nsViewManager.cpp:1102

=============================================================



Application Basics: 
Name: Firefox
Version: 59.0a1
Build ID: 20171115100050
Update Channel: nightly
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
OS: Windows_NT 10.0

Comment 1

[Matt Woodrow (:mattwoodrow)]

Marked as blocking retained-dl, as that seems like a likely cause of the regression.

Do we have any STR for this?

Comment 2

[Matt Woodrow (:mattwoodrow)]

It looks like we crashed with the instruction pointer at 0, and I can't see how that happened.

From nsDisplayItem::GetClipWithRespectToASR (and inwards) it doesn't look like there are any jumps to a variable address.

This is only a single crash at this point, so I'll keep an eye on it.

Comment 3

[Matt Woodrow (:mattwoodrow)]

Setting P3 since we still only have a single report of this crash.

Comment 4

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 5

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 6

[Mats Palmgren (inactive)]

Still occurs in v63.0b10: bp-f6656666-2024-45ed-b109-37fec0181002

Comment 7

[Hani Yacoub, Desktop QA]

Closing this as resolved:worksforme since there were no crashes in the last 6 months for this signature.

Comment 8

[Hani Yacoub, Desktop QA]

I'll Reopen this bug again. There have been crashes with this signature.

Comment 9

[Wayne Mery (:wsmwk)]

All the crashes of the past month (except 1) are for esr78 - nothing newer.