1492034 - Crash in nsDisplayListBuilder::RemoveFromWillChangeBudget

Status: RESOLVED FIXED

(Core :: Web Painting, defect)

Description

[Makoto Kato [:m_kato]]

- Step
Open https://mozilla.doorkeeper.jp/events/80256

- Result
This bug was filed from the Socorro interface and is
report bp-47ac2568-49c3-482c-8ec0-d8fc80180918.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll nsDisplayListBuilder::RemoveFromWillChangeBudget layout/painting/nsDisplayList.cpp:2188
1 xul.dll nsIFrame::BuildDisplayListForChild layout/generic/nsFrame.cpp:3572
2 xul.dll static void DisplayLine layout/generic/nsBlockFrame.cpp:6750
3 xul.dll nsBlockFrame::BuildDisplayList layout/generic/nsBlockFrame.cpp:6844
4 xul.dll nsIFrame::BuildDisplayListForStackingContext layout/generic/nsFrame.cpp:3055
5 xul.dll nsIFrame::BuildDisplayListForChild layout/generic/nsFrame.cpp:3721
6 xul.dll static void DisplayLine layout/generic/nsBlockFrame.cpp:6750
7 xul.dll nsBlockFrame::BuildDisplayList layout/generic/nsBlockFrame.cpp:6844
8 xul.dll nsIFrame::BuildDisplayListForStackingContext layout/generic/nsFrame.cpp:3055
9 xul.dll nsIFrame::BuildDisplayListForChild layout/generic/nsFrame.cpp:3721

=============================================================

Regression range is 

2018-09-18T13:54:18: DEBUG : Found commit message:
Bug 1488599 - Part 2: Fix will-change budget r=mattwoodrow

Depends on D5245

Differential Revision: https://phabricator.services.mozilla.com/D5246

Comment 1

[Cameron McCormack (:heycam)]

Probably similar to bug 1492031.

Comment 2

[Takanori MATSUURA]

bp-cc621451-69c6-42c9-ac13-bf3650180918

When I zoom in the Google Maps content attached with https://mozilla.doorkeeper.jp/events/80256 (and other URLs), Fx crashed.
However when I accesses to the Google Maps directly and zoom in/out the map, Fx not crashed.

Comment 3

[Pulse]

This is happening for me on Nightly when attempting to load any channel on Twitch.

bp-ba19e675-7acc-450e-a812-06a130180918

Comment 4

[Brian Birtles (:birtles, Feb 26~ parental leave)]

Crashes for me every time I try to load the AV1 demo videos on Youtube, e.g.:
https://www.youtube.com/watch?v=w4LkSRXrK34&t=0s&index=4&list=PLyqf6gJt7KuHBmeVzZteZUlNUQAVLwrZS

bp-d24799bd-279b-4aa9-ac13-e2dc20180918

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Crash is gone in nightly builds with bug 1488599 backed out.