Closed
Bug 1469505
Opened 6 years ago
Closed 6 years ago
Crash in mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager
Categories
(Core :: Web Painting, defect, P1)
Tracking
()
RESOLVED
DUPLICATE
of bug 1469472
mozilla62
Tracking | Status | |
---|---|---|
firefox-esr52 | --- | unaffected |
firefox-esr60 | --- | unaffected |
firefox60 | --- | unaffected |
firefox61 | --- | unaffected |
firefox62 | --- | fixed |
People
(Reporter: calixte, Assigned: jnicol)
References
(Blocks 1 open bug)
Details
(5 keywords)
Crash Data
This bug was filed from the Socorro interface and is report bp-bae4d9aa-4ee0-4070-afbc-9de720180619. ============================================================= Top 10 frames of crashing thread: 0 xul.dll mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager layout/painting/FrameLayerBuilder.cpp:2150 1 xul.dll nsIFrame::RemoveDisplayItemDataForDeletion layout/generic/nsFrame.cpp:957 2 xul.dll mozilla::PresShell::NotifyDestroyingFrame layout/base/PresShell.cpp:2111 3 xul.dll nsFrame::DestroyFrom layout/generic/nsFrame.cpp:792 4 xul.dll nsIFrame::Destroy layout/generic/nsIFrame.h:679 5 xul.dll nsCSSFrameConstructor::WillDestroyFrameTree layout/base/nsCSSFrameConstructor.cpp:8354 6 xul.dll mozilla::PresShell::Destroy layout/base/PresShell.cpp:1370 7 xul.dll nsDocumentViewer::DestroyPresShell layout/base/nsDocumentViewer.cpp:4670 8 xul.dll nsDocumentViewer::Destroy layout/base/nsDocumentViewer.cpp:1893 9 xul.dll nsDocShell::Destroy docshell/base/nsDocShell.cpp:5392 ============================================================= There are 10 crashes (from 5 installations) in nightly 62 with buildid 20180618220118. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1468426. [1] https://hg.mozilla.org/mozilla-central/rev?node=b076959d6353
Flags: needinfo?(jnicol)
Comment 1•6 years ago
|
||
I also encountered this, right after I submitted the employee engagement survey, or rather, the subsequent survey about how I liked that engagement survey. My report bp-152e5f25-7f24-4520-b461-af1800180619.
Comment 2•6 years ago
|
||
Adding the Mac specific signature for this crash, which also started using 20180618220118. 41 crashes/23 installs so far.
Crash Signature: [@ mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager] → [@ mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager]
[@ mozilla::DisplayItemData::Disconnect]
Comment 3•6 years ago
|
||
Adding Windows signature mozilla::DisplayItemData::DisplayItemData. The signature mentioned in Comment 2 in not only Mac, but Mac and Windows.
Crash Signature: [@ mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager]
[@ mozilla::DisplayItemData::Disconnect] → [@ mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager]
[@ mozilla::DisplayItemData::Disconnect]
[@ mozilla::DisplayItemData::DisplayItemData]
Comment 4•6 years ago
|
||
(In reply to Marco Zehe (:MarcoZ) from comment #1) > I also encountered this, right after I submitted the employee engagement > survey, or rather, the subsequent survey about how I liked that engagement > survey. My report bp-152e5f25-7f24-4520-b461-af1800180619. Same for me My report https://crash-stats.mozilla.com/report/index/01b6d9e5-1f70-45d4-8d92-a6f650180619
Comment 5•6 years ago
|
||
seeing some security-critical reports in the list of crashes
Group: layout-core-security
Keywords: csectype-uaf,
csectype-wildptr
Assignee | ||
Comment 6•6 years ago
|
||
I think this has the same cause as bug 1469472
Flags: needinfo?(jnicol)
Updated•6 years ago
|
Crash Signature: [@ mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager]
[@ mozilla::DisplayItemData::Disconnect]
[@ mozilla::DisplayItemData::DisplayItemData] → [@ mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager]
[@ mozilla::DisplayItemData::Disconnect]
[@ mozilla::DisplayItemData::DisplayItemData]
[@ std::vector<T>::emplace_back<T>]
Updated•6 years ago
|
Assignee: nobody → jnicol
Priority: -- → P1
Updated•6 years ago
|
Comment 7•6 years ago
|
||
Gone since bug 1469472 shipped.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → DUPLICATE
Target Milestone: --- → mozilla62
Updated•6 years ago
|
Group: layout-core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•