Closed Bug 1469505 Opened 6 years ago Closed 6 years ago

Crash in mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager

Categories

(Core :: Web Painting, defect, P1)

Unspecified
Windows 10
defect

Tracking

()

RESOLVED DUPLICATE of bug 1469472
mozilla62
Tracking Status
firefox-esr52 --- unaffected
firefox-esr60 --- unaffected
firefox60 --- unaffected
firefox61 --- unaffected
firefox62 --- fixed

People

(Reporter: calixte, Assigned: jnicol)

References

(Blocks 1 open bug)

Details

(5 keywords)

Crash Data

This bug was filed from the Socorro interface and is
report bp-bae4d9aa-4ee0-4070-afbc-9de720180619.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager layout/painting/FrameLayerBuilder.cpp:2150
1 xul.dll nsIFrame::RemoveDisplayItemDataForDeletion layout/generic/nsFrame.cpp:957
2 xul.dll mozilla::PresShell::NotifyDestroyingFrame layout/base/PresShell.cpp:2111
3 xul.dll nsFrame::DestroyFrom layout/generic/nsFrame.cpp:792
4 xul.dll nsIFrame::Destroy layout/generic/nsIFrame.h:679
5 xul.dll nsCSSFrameConstructor::WillDestroyFrameTree layout/base/nsCSSFrameConstructor.cpp:8354
6 xul.dll mozilla::PresShell::Destroy layout/base/PresShell.cpp:1370
7 xul.dll nsDocumentViewer::DestroyPresShell layout/base/nsDocumentViewer.cpp:4670
8 xul.dll nsDocumentViewer::Destroy layout/base/nsDocumentViewer.cpp:1893
9 xul.dll nsDocShell::Destroy docshell/base/nsDocShell.cpp:5392

=============================================================

There are 10 crashes (from 5 installations) in nightly 62 with buildid 20180618220118. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1468426.

[1] https://hg.mozilla.org/mozilla-central/rev?node=b076959d6353
Flags: needinfo?(jnicol)
I also encountered this, right after I submitted the employee engagement survey, or rather, the subsequent survey about how I liked that engagement survey. My report bp-152e5f25-7f24-4520-b461-af1800180619.
Adding the Mac specific signature for this crash, which also started using 20180618220118. 41 crashes/23 installs so far.
Crash Signature: [@ mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager] → [@ mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager] [@ mozilla::DisplayItemData::Disconnect]
Adding Windows signature mozilla::DisplayItemData::DisplayItemData. The signature mentioned in Comment 2 in not only Mac, but Mac and Windows.
Crash Signature: [@ mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager] [@ mozilla::DisplayItemData::Disconnect] → [@ mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager] [@ mozilla::DisplayItemData::Disconnect] [@ mozilla::DisplayItemData::DisplayItemData]
(In reply to Marco Zehe (:MarcoZ) from comment #1)
> I also encountered this, right after I submitted the employee engagement
> survey, or rather, the subsequent survey about how I liked that engagement
> survey. My report bp-152e5f25-7f24-4520-b461-af1800180619.

Same for me My report https://crash-stats.mozilla.com/report/index/01b6d9e5-1f70-45d4-8d92-a6f650180619
seeing some security-critical reports in the list of crashes
Group: layout-core-security
I think this has the same cause as bug 1469472
Flags: needinfo?(jnicol)
Crash Signature: [@ mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager] [@ mozilla::DisplayItemData::Disconnect] [@ mozilla::DisplayItemData::DisplayItemData] → [@ mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager] [@ mozilla::DisplayItemData::Disconnect] [@ mozilla::DisplayItemData::DisplayItemData] [@ std::vector<T>::emplace_back<T>]
Assignee: nobody → jnicol
Priority: -- → P1
Depends on: 1469472
Keywords: sec-high
Gone since bug 1469472 shipped.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → DUPLICATE
Target Milestone: --- → mozilla62
Group: layout-core-security
You need to log in before you can comment on or make changes to this bug.