1492053 - Crash in <name omitted> | nsIFrame::BuildDisplayListForChild

Status: RESOLVED DUPLICATE of bug 1492034

(Core :: Web Painting, defect)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-24668903-492b-455c-8f4f-e64310180918.
=============================================================

Top 10 frames of crashing thread:

0 XUL <name omitted> layout/painting/nsDisplayList.cpp:2188
1 XUL nsIFrame::BuildDisplayListForChild layout/generic/nsFrame.cpp:3572
2 XUL DisplayLine layout/generic/nsBlockFrame.cpp:6750
3 XUL nsBlockFrame::BuildDisplayList layout/generic/nsBlockFrame.cpp:6844
4 XUL nsIFrame::BuildDisplayListForChild layout/generic/nsFrame.cpp:3536
5 XUL DisplayLine layout/generic/nsBlockFrame.cpp:6750
6 XUL nsBlockFrame::BuildDisplayList layout/generic/nsBlockFrame.cpp:6844
7 XUL nsIFrame::BuildDisplayListForChild layout/generic/nsFrame.cpp:3759
8 XUL mozilla::ScrollFrameHelper::BuildDisplayList layout/generic/nsGfxScrollFrame.cpp:3702
9 XUL nsIFrame::BuildDisplayListForChild layout/generic/nsFrame.cpp:3781

=============================================================

There are 158 crashes (from 64 installations) in nightly 64 with buildid 20180917220115. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1488599.

[1] https://hg.mozilla.org/mozilla-central/rev?node=b08b9f2693cd

Comment 1

[Emil Ghitta, QA [:emilghitta]]

I've just hit this crash.

[Affected platforms]:
macOS 10.13.6
Ubuntu 16.04 64bit.

[Unaffected platforms]:
Windows 10 64bit.

[Steps to reproduce]:
1. Launch Firefox.
2. Access the following link: http://suffolkcamra.co.uk/pubs/cgi-bin/demomap.cgi

[Expected result]:
The website is successfully displayed.

[Actual result]:
Tab crash.

[Regression range]
Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=85bab1e2996212502744d0f5027fcd30b4046599&tochange=b08b9f2693cd4b0d57cd6899deb541a93616c3f4

Comment 2

[Ludovic Hirlimann [:Usul]]

Happens on Linux too.