Closed Bug 1451384 Opened 2 years ago Closed 2 years ago

Crash in InvalidArrayIndex_CRASH | MergeState::ProcessItemFromNewList

Categories

(Core :: Web Painting, defect, critical)

Unspecified
Windows 10
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla61
Tracking Status
firefox-esr52 --- unaffected
firefox59 --- unaffected
firefox60 --- unaffected
firefox61 blocking verified

People

(Reporter: marcia, Assigned: mattwoodrow)

References

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is
report bp-fcedef10-73f2-489c-bcf3-f18630180404.
=============================================================

Seen while looking at nightly crash data: https://bit.ly/2q4PL1j. Windows crashes which started in Build 20180404100127. Crash reason ElementAt(aIndex = 0, aLength = 0).

Top 10 frames of crashing thread:

0 mozglue.dll MOZ_CrashPrintf mfbt/Assertions.cpp:63
1 xul.dll InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:26
2 xul.dll MergeState::ProcessItemFromNewList layout/painting/RetainedDisplayListBuilder.cpp:277
3 xul.dll RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:463
4 xul.dll MergeState::ProcessItemFromNewList layout/painting/RetainedDisplayListBuilder.cpp:264
5 xul.dll RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:463
6 xul.dll MergeState::ProcessItemFromNewList layout/painting/RetainedDisplayListBuilder.cpp:264
7 xul.dll RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:463
8 xul.dll MergeState::ProcessItemFromNewList layout/painting/RetainedDisplayListBuilder.cpp:264
9 xul.dll RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:463

=============================================================
STR:

Win7, 20180404100127 Nightly

1) Open google spread sheet with a link is a cell
2) click on tyhe cell, then click on the popup link

result: spreadsheet tab crashes
https://crash-stats.mozilla.com/report/index/eef70ded-7854-43c2-8b22-f19890180404#tab-details
Flags: needinfo?(matt.woodrow)
I hit this crash with the same STR as Jim. I can't reproduce the crash in a clean profile, though. I spend a LOT of my day in Google spreadsheets and only saw this crash today, so this is probably a very recent regression.
Assignee: nobody → matt.woodrow
This site is also crashing with same sig just loading page and waiting a few seconds.

Today's Nightly  cset: https://hg.mozilla.org/mozilla-central/rev/ff0efa4132f0efd78af0910762aec7dcc1a8de66
Win10 x64
(In reply to Jim Jeffery not reading bug-mail 1/2/11 from comment #4)
> This site is also crashing with same sig just loading page and waiting a few
> seconds.
> 
> Today's Nightly  cset:
> https://hg.mozilla.org/mozilla-central/rev/
> ff0efa4132f0efd78af0910762aec7dcc1a8de66
> Win10 x64

Nevermind, I think it was a cookie issue.  site has been redesigned and I had some stale cookies perhaps.
Duplicate of this bug: 1451473
Crash Signature: [@ InvalidArrayIndex_CRASH | MergeState::ProcessItemFromNewList] → [@ InvalidArrayIndex_CRASH | MergeState::ProcessItemFromNewList] [@ InvalidArrayIndex_CRASH | MergeState::Finalize]
Flags: needinfo?(matt.woodrow)
Comment on attachment 8965165 [details]
Bug 1451384 - Check IsChanged on the old item during merging, since that's the one that might have a deleted frame.

https://reviewboard.mozilla.org/r/233846/#review239516

Oh, I see, so IsChanged must never be called on a new item, only on an old item. Should we make the changed state part of the OldItemInfo, then? Having an IsChanged method that accepts any nsDisplayItem* might be prone to misuse.
Attachment #8965165 - Flags: review?(mstange) → review+
Pushed by mwoodrow@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/a9c5a53970bf
Check IsChanged on the old item during merging, since that's the one that might have a deleted frame. r=mstange
(In reply to Markus Stange [:mstange] from comment #8)
> Comment on attachment 8965165 [details]
> Bug 1451384 - Check IsChanged on the old item during merging, since that's
> the one that might have a deleted frame.
> 
> https://reviewboard.mozilla.org/r/233846/#review239516
> 
> Oh, I see, so IsChanged must never be called on a new item, only on an old
> item. Should we make the changed state part of the OldItemInfo, then? Having
> an IsChanged method that accepts any nsDisplayItem* might be prone to misuse.

I've landed as-is, since I had a clean try run and I want to fix the google sheets regression.

That's a great idea, will do a follow-up to fix it.
I am having this issue a lot in the last couple of builds (Windows 10, Nightly). This happens to me when I click on a lot of text fields. For now it happens consistently on GMail, Twitter, Reddit and YouTube. If there is something else I can provide, I 'd be happy to help.
https://hg.mozilla.org/mozilla-central/rev/a9c5a53970bf
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
See Also: → 1451754
Comment on attachment 8965165 [details]
Bug 1451384 - Check IsChanged on the old item during merging, since that's the one that might have a deleted frame.

https://reviewboard.mozilla.org/r/233846/#review240046

::: layout/tools/reftest/runreftest.py:242
(Diff revision 1)
>          self.resolver = self.resolver_cls()
>          self.log = None
>          self.outputHandler = None
>          self.testDumpFile = os.path.join(tempfile.gettempdir(), 'reftests.json')
>  
> -        self.run_by_manifest = True
> +        self.run_by_manifest = False

This seems like a local testing change that you didn't intend to land?
Flags: needinfo?(matt.woodrow)
Comment on attachment 8965165 [details]
Bug 1451384 - Check IsChanged on the old item during merging, since that's the one that might have a deleted frame.

https://reviewboard.mozilla.org/r/233846/#review240046

> This seems like a local testing change that you didn't intend to land?

Yes, this needs to be reverted. It'll cause a large spike of intermittents (on Windows 7 especially).
Backed out just that hunk on central:
https://hg.mozilla.org/mozilla-central/rev/0d661c592a164ca918ed12f87cbcf7f52c293359
Flags: needinfo?(matt.woodrow)
Thanks Andrew!

I noticed that hunk during the review and thought I had commented on it, but apparently I didn't...
Oops! Thanks for fixing it!
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.