1457136 - Crash in nsTArray_base<T>::SwapArrayElements<T> | MergeState::MergeState

Status: RESOLVED FIXED

(Core :: Web Painting, defect, P1)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-82889c6d-2a4c-4f61-8d72-94c360180425.
=============================================================

Seen while looking at nightly crashes: https://bit.ly/2HvUq37. Small volume crashes started using 20180424220100.

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=dfb15917c057f17e5143f7d7c6e1972ba53efc49&tochange=6eeb97ca94f40189d5aa552da9e0b0b11bfa0441

Top 10 frames of crashing thread:

0 xul.dll nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::SwapArrayElements<nsTArrayInfallibleAllocator, nsTArrayInfallibleAllocator> xpcom/ds/nsTArray-inl.h:406
1 xul.dll MergeState::MergeState layout/painting/RetainedDisplayListBuilder.cpp:263
2 xul.dll RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:483
3 xul.dll MergeState::ProcessItemFromNewList layout/painting/RetainedDisplayListBuilder.cpp:279
4 xul.dll RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:487
5 xul.dll MergeState::ProcessItemFromNewList layout/painting/RetainedDisplayListBuilder.cpp:279
6 xul.dll RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:487
7 xul.dll MergeState::ProcessItemFromNewList layout/painting/RetainedDisplayListBuilder.cpp:279
8 xul.dll RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:487
9 xul.dll RetainedDisplayListBuilder::AttemptPartialUpdate layout/painting/RetainedDisplayListBuilder.cpp:1097

=============================================================

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Bug 1439809 presumably based on the regression range and crash stack.

Comment 2

[Marcia Knous [:marcia]]

Here are a few URLs groomed from the crashes:

*https://www.netflix.com/browse 
*http://abc13.com/3389719/?sf187745472=1
*https://www.ok.ru/feed 
*https://colab.research.google.com/notebooks/mlcc/first_steps_with_tensor_flow.ipynb?hl=en#scrollTo=AKWstXXPzOVz

Comment 4

[Marcia Knous [:marcia]]

Changing platform to all since the dupe bug has the Mac and Linux signatures.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

This is responsible for ~1.4% of all content process crashes at the moment.

Comment 6

[Matt Woodrow (:mattwoodrow)]

I'm pretty sure this is the same as bug 1459997 (getting the wrong index, it just happens to be within the array range, and we recurse into the sub-list for the wrong item type).

Leaving it open for now, but I expect the new assertions to stop us hitting this crash.

Comment 7

[Marion Daly [:mdaly]]

Status on this?

Comment 8

[Matt Woodrow (:mattwoodrow)]

No crashes in 61.0b9, so I think this is fixed.