1425271 - Crash in nsTArray_Impl<T>::IndexOf<T> | nsDisplayItem::~nsDisplayItem

Status: RESOLVED FIXED

(Core :: Web Painting, defect, P1)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-de5c6f27-729e-4ebd-bf22-5cdf50171214.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll nsTArray_Impl<mozilla::FrameProperties::PropertyValue, nsTArrayInfallibleAllocator>::IndexOf<mozilla::FramePropertyDescriptorUntyped const*, mozilla::FrameProperties::PropertyComparator> xpcom/ds/nsTArray.h:1156
1 xul.dll nsDisplayItem::~nsDisplayItem layout/painting/nsDisplayList.h:1921
2 xul.dll nsDisplayWrapList::`scalar deleting destructor' 
3 xul.dll nsDisplayWrapList::Destroy layout/painting/nsDisplayList.h:4659
4 xul.dll nsDisplayWrapList::Destroy layout/painting/nsDisplayList.h:4658
5 xul.dll nsDisplayListBuilder::~nsDisplayListBuilder layout/painting/nsDisplayList.cpp:1303
6 xul.dll RetainedDisplayListBuilder::`scalar deleting destructor' 
7 xul.dll mozilla::FramePropertyDescriptor<RetainedDisplayListBuilder>::Destruct<&DeleteValue<RetainedDisplayListBuilder> layout/base/FrameProperties.h:102
8 xul.dll mozilla::FrameProperties::PropertyValue::DestroyValueFor layout/base/FrameProperties.h:376
9 xul.dll mozilla::FrameProperties::DeleteAll layout/base/FrameProperties.h:295

=============================================================

There 156 crashes in nightly 59 with buildid 20171214100315.
:miko, could you investigate please ?

Comment 1

[Miko Mynttinen]

This seems to be caused by temporary display items getting deleted without nsDisplayItem::RemoveFrame() getting called.

Comment 2

[Itiel]

Reproducible for me sometimes when I surf in this page:
https://www.fxp.co.il/forumdisplay.php?f=45
This URL is on a tab which I never close. After a while when I get back to this tab, I (often) get this crash.

https://crash-stats.mozilla.com/report/index/62108e86-30c7-45aa-9147-222a90171214
https://crash-stats.mozilla.com/report/index/7582248f-b110-4735-be7d-9c2770171214

Comment 3

[Marcia Knous [:marcia]]

Adding a Mac/Linux signature.

Comment 4

[Calixte Denizet (:calixte)]

The crash signature is ranked #3 in nightly 59 for content process.

Comment 6

[Miko Mynttinen]

Attachment: Bug 1425271 - Improve temporary display item removal

Review commit: https://reviewboard.mozilla.org/r/207912/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/207912/

Comment 7

[Matt Woodrow (:mattwoodrow)]

Comment on attachment 8937197 [details]
Bug 1425271 - Improve temporary display item removal

https://reviewboard.mozilla.org/r/207912/#review213774

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/229639982d5b
Improve temporary display item removal r=mattwoodrow

Comment 9

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/229639982d5b