1461832 - Crash in InvalidArrayIndex_CRASH | DirectedAcyclicGraph<T>::GetDirectPredecessors

Status: RESOLVED DUPLICATE of bug 1466945

(Core :: Web Painting, defect, P1)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-ff667cfc-2b23-480b-bec6-964fa0180515.
=============================================================

Seen while looking at nightly crash data: https://bit.ly/2rLkEbc. Crashes started using 20180515100038.

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=45ec8fd380dd2c308e79dbb396ca87f2ce9b3f9c&tochange=cf3ee14023483cbbb57129479537c713e22c1980

Bug 1459441 is in that range. 

Top 10 frames of crashing thread:

0 mozglue.dll MOZ_CrashPrintf mfbt/Assertions.cpp:63
1 xul.dll InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:26
2 xul.dll DirectedAcyclicGraph<OldListUnits>::GetDirectPredecessors layout/painting/RetainedDisplayListHelpers.h:127
3 xul.dll MergeState::ProcessPredecessorsOfOldNode layout/painting/RetainedDisplayListBuilder.cpp:425
4 xul.dll MergeState::ProcessItemFromNewList layout/painting/RetainedDisplayListBuilder.cpp:291
5 xul.dll RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:488
6 xul.dll RetainedDisplayListBuilder::AttemptPartialUpdate layout/painting/RetainedDisplayListBuilder.cpp:1179
7 xul.dll nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:3679
8 xul.dll mozilla::PresShell::Paint layout/base/PresShell.cpp:6350
9 xul.dll nsViewManager::ProcessPendingUpdatesPaint view/nsViewManager.cpp:480

=============================================================

Comment 1

[Matt Woodrow (:mattwoodrow)]

Fairly sure that this is another duplicate of bug 1459997, but leaving it open and we'll see if it drops away once the new assertion patch lands.

Comment 2

[Ryan VanderMeulen [:RyanVM]]

This seems to have gone away after the 05-15 nightlies.

Comment 3

[Marion Daly [:mdaly]]

:Matt can we get someone assigned to this?

Comment 4

[Ryan VanderMeulen [:RyanVM]]

(In reply to Matt Woodrow (:mattwoodrow) from comment #1)
> Fairly sure that this is another duplicate of bug 1459997, but leaving it
> open and we'll see if it drops away once the new assertion patch lands.

FWIW, we were still seeing this on 61.0b13 beta update channel builds.

Comment 5

[Matt Woodrow (:mattwoodrow)]

This is a duplicate of bug 1461832, all the crashes are hitting the release assertion in subspan. This is just a different amount of inlining, leading to a different top frame.

The other bug is newer, but already has a comment with my findings thus far.