1492206 - Crash in @0x0 | nsContainerFrame::PositionFrameView

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P3)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-bbb7ca8f-a5b1-4def-aeae-a40670180918.
=============================================================

Seen while looking at nightly crash stats: https://bit.ly/2D8B0DG. Crashes started using 20180917221255. Bug 1376919 has a similar signature, but the stack of this crash looks a bit different.

Possible regression range based on build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=7ed950e60f3c1f8a47c117c04124d31e94a66e32&tochange=7ac2e2fc613b444a5f972c83502848082d3302cd

Top 10 frames of crashing thread:

0  @0x0 
1 libxul.so nsContainerFrame::PositionFrameView layout/generic/nsContainerFrame.cpp:438
2 libxul.so nsContainerFrame::PositionChildViews layout/generic/nsContainerFrame.cpp:1040
3 libxul.so nsContainerFrame::PositionChildViews layout/generic/nsContainerFrame.cpp:1042
4 libxul.so nsBlockFrame::GetChildLists const layout/generic/nsBlockFrame.cpp:589
5 libxul.so nsContainerFrame::PositionChildViews layout/generic/nsContainerFrame.cpp:1042
6 libxul.so nsBlockFrame::GetChildLists const layout/generic/nsBlockFrame.cpp:589
7 libxul.so nsContainerFrame::PositionChildViews layout/generic/nsContainerFrame.cpp:1042
8 libxul.so nsContainerFrame::PositionChildViews layout/generic/nsContainerFrame.cpp:1042
9 libxul.so nsBlockFrame::GetChildLists const layout/generic/nsBlockFrame.cpp:589

=============================================================

Comment 1

[Mats Palmgren (inactive)]

Bug 1489149 seems like the most likely culprit in that range.

The crashes here happens later in reflow though so it's not
clear to me what the problem might be.

Comment 2

[Mats Palmgren (inactive)]

It's weird that it only appears to affect Android...

Comment 3

[Mats Palmgren (inactive)]

I tried a couple of crash URLs:
http://www.mitsubishicarbide.com/en/technical_information/tec_turning_tools/tec_threading/tec_threading_formula_top/tec_threading_formula
https://www.smh.com.au/
in various configs in responsive design mode, but they didn't crash for me.

Comment 4

[Mats Palmgren (inactive)]

It's be nice if QA could try to reproduce this on an Android device, thanks.

Comment 5

[Marcia Knous [:marcia]]

ni on Ioana - Pixel and Pixel XL are crashing, I believe you have those devices in your inventory. 

One other URLs:
* https://www.iltalehti.fi/kotimaa/ecb23dea-bb38-4e53-8213-3dabca20c68f_u0.shtml

Comment 6

[Mats Palmgren (inactive)]

One other URL:
https://www.zerohedge.com/news/2018-09-17/netherlands-prosceutes-its-own-citizen-calling-turkish-dictator-goat-fcker#comment_stream

Comment 7

[Ioana Chiorean]

We tried  for several days now - but none was crashing for us, in the office (CJ). 
Stefan, can you try on the Pixel you have in BM?

Comment 8

[Marcia Knous [:marcia]]

The spike that occurred on the nightly from the 17th seems to have gone away. Will leave this open and continue to monitor.

Comment 9

[Stefan Deiac]

Hi, tried to reproduce the crash following the information filed here and also some additional steps, but with no success. Scenarios used for this were: navigate on affected sites, pin tabs, copy/select text, open multiple tabs, sharing tabbs.
Builds tested: the affected version of Nightly (64.0a1 2018-09-17) and the latest version Nightly (64.0a1 2018-09-25).
Devices: Google Pixel (Android 9), OnePlus 5T (Android 8.1.0), Oneplus Two (Android 6.0.1).

Comment 10

[Sean Voisen (:svoisen)]

Setting to P3 given it's a 1-day spike. Bump up if it happens again.

Comment 11

[Marcia Knous [:marcia]]

This signature started again in 65.0b12 and continues into 65.0b13. Correlations show (92.86% in signature vs 27.14% overall) android_board = msm8996, which I think means this is Snapdragon 820/821 again.

Comment 12

[Ryan VanderMeulen [:RyanVM]]

No sign of this in the RC builds. Fits the bill for the other 820/821 crashes.

Comment 13

[Marcia Knous [:marcia]]

No recent crashes. Closing as WFM.