Closed Bug 1519468 Opened 5 years ago Closed 5 years ago

Crash in mozilla::layout::ScrollAnchorContainer::ExamineAnchorCandidate

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
Unspecified
Windows 10
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla66
Tracking Flags:
Tracking Status
firefox-esr60 --- unaffected
firefox64 --- unaffected
firefox65 --- unaffected
firefox66 --- fixed

People

(Reporter: calixte, Assigned: rhunt)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

Bug 1519468 - Consistently check if a frame has content in ScrollAnchorContainer. r?emilio
47 bytes, text/x-phabricator-request
Details | Review

This bug was filed from the Socorro interface and is
report bp-1e8857c1-bd62-4cc8-81f6-65df40190111.

Top 10 frames of crashing thread:

0 xul.dll mozilla::layout::ScrollAnchorContainer::ExamineResult mozilla::layout::ScrollAnchorContainer::ExamineAnchorCandidate layout/generic/ScrollAnchorContainer.cpp:349
1 xul.dll class nsIFrame* mozilla::layout::ScrollAnchorContainer::FindAnchorInList layout/generic/ScrollAnchorContainer.cpp:483
2 xul.dll class nsIFrame* mozilla::layout::ScrollAnchorContainer::FindAnchorIn layout/generic/ScrollAnchorContainer.cpp:441
3 xul.dll mozilla::layout::ScrollAnchorContainer::SelectAnchor layout/generic/ScrollAnchorContainer.cpp:145
4 xul.dll mozilla::PresShell::FlushDirtyScrollAnchorContainers layout/base/PresShell.cpp:2577
5 xul.dll void mozilla::RestyleManager::DoProcessPendingRestyles layout/base/RestyleManager.cpp:2975
6 xul.dll mozilla::PresShell::DoFlushPendingNotifications layout/base/PresShell.cpp:4124
7 xul.dll nsViewManager::CallWillPaintOnObservers view/nsViewManager.cpp:1062
8 xul.dll void nsRefreshDriver::Tick layout/base/nsRefreshDriver.cpp:1961
9 xul.dll void mozilla::RefreshDriverTimer::TickRefreshDrivers layout/base/nsRefreshDriver.cpp:305

There are 14 crashes (from 7 installations) in nightly 66 with buildid 20190111093148. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1305957.

[1] https://hg.mozilla.org/mozilla-central/rev?node=b6c42df7ce09

Flags: needinfo?(rhunt)

Missing a null check.

Flags: needinfo?(rhunt)
Assignee: nobody → rhunt
Pushed by rhunt@eqrion.net:
https://hg.mozilla.org/integration/mozilla-inbound/rev/717a8fb8b842
Consistently check if a frame has content in ScrollAnchorContainer. r=emilio

https://hg.mozilla.org/mozilla-central/rev/717a8fb8b842

Status: NEW → RESOLVED
Closed: 5 years ago
status-firefox66: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla66
You need to log in before you can comment on or make changes to this bug.