1429314 - Crash in AnimatedGeometryRoot::Release

Status: RESOLVED WORKSFORME

(Core :: Web Painting, defect, P2)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is
report bp-dd8901d6-1e09-440d-a4ff-1f6c60180110.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll AnimatedGeometryRoot::Release layout/painting/nsDisplayList.h:188
1 xul.dll nsTHashtable<nsBaseHashtableET<nsPtrHashKey<nsIFrame>, RefPtr<AnimatedGeometryRoot> > >::s_ClearEntry xpcom/ds/nsTHashtable.h:444
2 xul.dll PLDHashTable::~PLDHashTable xpcom/ds/PLDHashTable.cpp:325
3 xul.dll PLDHashTable::ClearAndPrepareForLength xpcom/ds/PLDHashTable.cpp:338
4 xul.dll nsDisplayListBuilder::EndFrame layout/painting/nsDisplayList.cpp:998
5 xul.dll nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:4036
6 xul.dll mozilla::PresShell::Paint layout/base/PresShell.cpp:6489
7 xul.dll nsViewManager::ProcessPendingUpdatesPaint view/nsViewManager.cpp:480
8 xul.dll nsViewManager::ProcessPendingUpdatesForView view/nsViewManager.cpp:412
9 xul.dll nsViewManager::ProcessPendingUpdates view/nsViewManager.cpp:1102

=============================================================

this content crash signature is newly showing up since firefox 58 in code that seems to have been touched by code landing for the retained display list.

Comment 1

[Matt Woodrow (:mattwoodrow)]

Setting P2 since this is super low volume.

Had a look at a crash dump, we're calling AnimatedGeometryRoot::Release with this==0xe5.

I can't see any way that value could have ever got into the hashtable (especially since we'd have crashed trying to call AddRef when adding it), so this seems like our hashtable entry got corrupted :(

Comment 2

[Liz Henry (:lizzard) (relman/hg->git project)]

Too late to fix in 59, but we can still take a patch for 60/61 if they are affected.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.