1472525 - Crash in firefox-bin@0x148fe

Status: RESOLVED WONTFIX

(Core :: Web Painting, defect, P2)

Description

[Julian Seward [:jseward]]

This bug was filed from the Socorro interface and is
report bp-293c6ca3-e76e-49d1-ae73-7b8de0180628.
=============================================================

This was seen in two different installations in the Linux nightly
of 20180628130527.  Crash reasons are

Item found was in the wrong list! type 71 (outer type was 71 at depth 1, now is 0)
Item found was in the wrong list! type 71 (outer type was 37 at depth 4, now is 71)

Top 10 frames of crashing thread:

0 firefox-bin firefox-bin@0x148fe 
1 libxul.so MergeState::HasMatchingItemInOldList layout/painting/nsDisplayList.h:2842
2 libxul.so MergeState::ProcessItemFromNewList layout/painting/RetainedDisplayListBuilder.cpp:287
3 libxul.so RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:517
4 libxul.so RetainedDisplayListBuilder::AttemptPartialUpdate layout/painting/RetainedDisplayListBuilder.cpp:1202
5 libxul.so nsLayoutUtils::PaintFrame [clone .cold.1086] 
6 libxul.so mozilla::PresShell::Paint 
7 libxul.so nsViewManager::ProcessPendingUpdates 
8 libxul.so nsRefreshDriver::Tick 
9 libxul.so mozilla::RefreshDriverTimer::Tick layout/base/nsRefreshDriver.cpp:328

=============================================================

Comment 1

[Matt Woodrow (:mattwoodrow)]

This looks to be a duplicate of bug 1466010, but without symbols.

Bug 1472076 will hopefully fix the 37 version of the crash, and I have a lead on the 71/0 version that I'll pursue this week.

Comment 2

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.