1431474 - Crash in nsPresContext::CacheAllLangs

Status: VERIFIED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-aea96381-d8e3-48ec-8459-a3cf60180118.
=============================================================

Seen while looking at nightly crash stats - started with 20180118100101: http://bit.ly/2DuBFOQ. Affects Fennec more than Firefox.

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4e429d313fd2e0f9202271ee8f3fb798817ec3e7&tochange=0a543687fd36bc0dc4188c3d33d117b0a8174721

Bug 1428491 is in the range. ni on :emilio

Top 10 frames of crashing thread:

0 libxul.so nsPresContext::CacheAllLangs layout/base/nsPresContext.cpp:2024
1 libxul.so mozilla::ServoStyleSet::PreTraverse layout/style/ServoStyleSet.cpp:426
2 libxul.so mozilla::ServoStyleSet::StyleDocument layout/style/ServoStyleSet.cpp:947
3 libxul.so mozilla::ServoRestyleManager::DoProcessPendingRestyles layout/base/ServoRestyleManager.cpp:1139
4 libxul.so mozilla::PresShell::DoFlushPendingNotifications layout/base/PresShell.cpp:4229
5 libxul.so mozilla::AccessibleCaretManager::UpdateCarets layout/base/AccessibleCaretManager.cpp:220
6 libxul.so mozilla::AccessibleCaretManager::OnScrollEnd layout/base/AccessibleCaretManager.cpp:700
7 libxul.so mozilla::AccessibleCaretEventHub::PostScrollState::OnScrollEnd layout/base/AccessibleCaretEventHub.cpp:294
8 libxul.so nsTimerImpl::Fire xpcom/threads/nsTimerImpl.cpp:701
9 libxul.so nsTimerEvent::Run xpcom/threads/TimerThread.cpp:286

=============================================================

Comment 1

[Marcia Knous [:marcia]]

Volume has increased since I filed this - we have about 700 crashes/400 installs for nsPresContext::CacheAllLangs, Firefox and Fennec.

Comment 2

[Emilio Cobos Álvarez (:emilio)]

Yeah, this looks like a null deref. It's definitely caused by bug 1428491... I'm looking into how it can happen.

Comment 3

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1431474: Make AccessibleCaretManager flush notifications through the document.

Review commit: https://reviewboard.mozilla.org/r/214414/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/214414/

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1431474: Try to assert nice things about what's going on on our flushes.

This is green on try... Let's see on the wild.

Review commit: https://reviewboard.mozilla.org/r/214416/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/214416/

Comment 5

[Calixte Denizet (:calixte)]

This crash signature is ranked #1 in nightly top-crashers for FennecAndroid and #4 in nightly top-crashers for Firefox (content process).

Comment 6

[Julian Seward [:jseward]]

This is the #1 topcrash for the Android nightly of 20180118134238.

Comment 7

[[:philipp]]

the underlying bug 1428491 has been backed out from 59 beta.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8944098 [details]
Bug 1431474: Make AccessibleCaretManager flush notifications through the document.

https://reviewboard.mozilla.org/r/214414/#review220742

r=me, but saying in the commit message _why_ the notifications should be flushed through the document is a good idea.

Comment 9

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8944099 [details]
Bug 1431474: Try to assert nice things about what's going on on our flushes.

https://reviewboard.mozilla.org/r/214416/#review220744

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/00ae6912038d
Make AccessibleCaretManager flush notifications through the document. r=bz
https://hg.mozilla.org/integration/autoland/rev/60d339bdf87e
Try to assert nice things about what's going on on our flushes. r=bz

Comment 11

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/00ae6912038d
https://hg.mozilla.org/mozilla-central/rev/60d339bdf87e

Comment 12

[Calixte Denizet (:calixte)]

No more crashes since the patches landed.