Closed Bug 1461832 Opened 6 years ago Closed 6 years ago

Crash in InvalidArrayIndex_CRASH | DirectedAcyclicGraph<T>::GetDirectPredecessors

Categories

(Core :: Web Painting, defect, P1)

Unspecified
Windows 10
defect

Tracking

()

RESOLVED DUPLICATE of bug 1466945

People

(Reporter: marcia, Unassigned)

Details

(Keywords: crash, regression)

Crash Data

This bug was filed from the Socorro interface and is
report bp-ff667cfc-2b23-480b-bec6-964fa0180515.
=============================================================

Seen while looking at nightly crash data: https://bit.ly/2rLkEbc. Crashes started using 20180515100038.

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=45ec8fd380dd2c308e79dbb396ca87f2ce9b3f9c&tochange=cf3ee14023483cbbb57129479537c713e22c1980

Bug 1459441 is in that range. 

Top 10 frames of crashing thread:

0 mozglue.dll MOZ_CrashPrintf mfbt/Assertions.cpp:63
1 xul.dll InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:26
2 xul.dll DirectedAcyclicGraph<OldListUnits>::GetDirectPredecessors layout/painting/RetainedDisplayListHelpers.h:127
3 xul.dll MergeState::ProcessPredecessorsOfOldNode layout/painting/RetainedDisplayListBuilder.cpp:425
4 xul.dll MergeState::ProcessItemFromNewList layout/painting/RetainedDisplayListBuilder.cpp:291
5 xul.dll RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:488
6 xul.dll RetainedDisplayListBuilder::AttemptPartialUpdate layout/painting/RetainedDisplayListBuilder.cpp:1179
7 xul.dll nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:3679
8 xul.dll mozilla::PresShell::Paint layout/base/PresShell.cpp:6350
9 xul.dll nsViewManager::ProcessPendingUpdatesPaint view/nsViewManager.cpp:480

=============================================================
Flags: needinfo?(matt.woodrow)
Fairly sure that this is another duplicate of bug 1459997, but leaving it open and we'll see if it drops away once the new assertion patch lands.
Flags: needinfo?(matt.woodrow)
Priority: -- → P1
Crash Signature: [@ InvalidArrayIndex_CRASH | DirectedAcyclicGraph<T>::GetDirectPredecessors] → [@ InvalidArrayIndex_CRASH | DirectedAcyclicGraph<T>::GetDirectPredecessors] [@ DirectedAcyclicGraph<T>::GetDirectPredecessors]
:Matt can we get someone assigned to this?
Flags: needinfo?(matt.woodrow)
(In reply to Matt Woodrow (:mattwoodrow) from comment #1)
> Fairly sure that this is another duplicate of bug 1459997, but leaving it
> open and we'll see if it drops away once the new assertion patch lands.

FWIW, we were still seeing this on 61.0b13 beta update channel builds.
This is a duplicate of bug 1461832, all the crashes are hitting the release assertion in subspan. This is just a different amount of inlining, leading to a different top frame.

The other bug is newer, but already has a comment with my findings thus far.
Status: NEW → RESOLVED
Closed: 6 years ago
Flags: needinfo?(matt.woodrow)
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.