1514528 - Crash in MergeState::ProcessOldNode

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect, P1)

Description

[Kevin Brosnan [Ex-Mozilla]]

This bug was filed from the Socorro interface and is
report bp-2e9b00d1-457a-47c6-870d-a92880181215.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll void MergeState::ProcessOldNode layout/painting/RetainedDisplayListBuilder.cpp:525
1 xul.dll class RetainedDisplayList MergeState::Finalize layout/painting/RetainedDisplayListBuilder.cpp:461
2 xul.dll bool RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:669
3 xul.dll class mozilla::Maybe<Index<MergedListUnits> > MergeState::ProcessItemFromNewList layout/painting/RetainedDisplayListBuilder.cpp:363
4 xul.dll bool RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:666
5 xul.dll class mozilla::Maybe<Index<MergedListUnits> > MergeState::ProcessItemFromNewList layout/painting/RetainedDisplayListBuilder.cpp:363
6 xul.dll bool RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:666
7 xul.dll RetainedDisplayListBuilder::AttemptPartialUpdate layout/painting/RetainedDisplayListBuilder.cpp:1336
8 xul.dll nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:3620
9 xul.dll mozilla::PresShell::Paint layout/base/PresShell.cpp:6011

=============================================================

Crashed on startup restoring video playback from https://onlinexperiences.com/scripts/Server.nxp

Comment 1

[Julien Wajsberg [:julienw]]

Got it on https://www.moulinex.fr/Petit-D%C3%A9jeuner/Machines-%C3%A0-pain/Machine-%C3%A0-pain/PAIN-PLAISIR-1KG/p/7211002269 while "playing" with the pictures. (I can't reproduce when trying again)
=> https://crash-stats.mozilla.org/report/index/7df47ac3-758d-4a15-aeee-307780181216

Comment 2

[Matthias Versen [:Matti]]

I always crash when I try to load https://www.mydealz.de/new (bp-e261dec4-cbe8-426f-b701-cace50181216)

Comment 3

[Dave Townsend [:mossop]]

Seeing this on many websites, makes nightly near unusable.

Comment 4

[Mark]

Attachment: Mark12547's about:support for crash bp-4f2221ad-e23e-400e-8855-972520181216

This is my about:support for crash  https://crash-stats.mozilla.org/report/index/bp-4f2221ad-e23e-400e-8855-972520181216 in Firefox Nightly on my Windows 10 (64-bit) system.

I got the crash when doing a search for Broadway Gondolier on page https://dvd.netflix.com/Movie/Hover/81001119 (NOT reproducible).

Comment 5

[Matthias Versen [:Matti]]

I tried to find the regression with mozregression but the crash is not 100% reproduce able for me.

I'm not certain that the result is correct.
This is the result https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=d86d184dc7d6aa246ada69063e07dbb503c33092&tochange=10aa1d02448438169fc49d467dd7f9a0fd70ca1f which contains the fix for bug 1500864

Comment 6

[Dave Townsend [:mossop]]

(In reply to Matthias Versen [:Matti] from comment #5)
> I tried to find the regression with mozregression but the crash is not 100%
> reproduce able for me.
> 
> I'm not certain that the result is correct.
> This is the result
> https://hg.mozilla.org/mozilla-central/
> pushloghtml?fromchange=d86d184dc7d6aa246ada69063e07dbb503c33092&tochange=10aa
> 1d02448438169fc49d467dd7f9a0fd70ca1f which contains the fix for bug 1500864

The code at the top of all of my crashes come from that bug, so I think it's a pretty good bet.

Comment 7

[Ryan VanderMeulen (PTO, back 6-April)]

Let's run with that. Backed out bug 1500864 and triggered new nightlies.
https://hg.mozilla.org/mozilla-central/rev/36a2f27ecc47

Comment 10

[Daniel Bodea [:danibodea]]

Considering that the initial page to test this issue is "Temporarily unavailable", is there another way I could verify it?

Comment 11

[Matt Woodrow (:mattwoodrow)]

The regressing change got backed out, so I don't think you need to worry about verifying if the original link doesn't work.

Comment 12

[Daniel Bodea [:danibodea]]

Considering the comment above, I will remove the "qe-verify+" tag. Thank you.

Comment 13

[Firefox Bug Husbandry Bot]

Please specify a root cause for this bug. See :tmaity for more information.