Crash in mozilla::layout::ScrollAnchorContainer::ExamineAnchorCandidate

RESOLVED FIXED in Firefox 66

Status

()

defect
--
critical
RESOLVED FIXED
5 months ago
5 months ago

People

(Reporter: calixte, Assigned: rhunt)

Tracking

(Blocks 1 bug, {crash, regression})

Trunk
mozilla66
Unspecified
Windows 10
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox-esr60 unaffected, firefox64 unaffected, firefox65 unaffected, firefox66 fixed)

Details

(crash signature)

Attachments

(1 attachment)

Reporter

Description

5 months ago

This bug was filed from the Socorro interface and is
report bp-1e8857c1-bd62-4cc8-81f6-65df40190111.

Top 10 frames of crashing thread:

0 xul.dll mozilla::layout::ScrollAnchorContainer::ExamineResult mozilla::layout::ScrollAnchorContainer::ExamineAnchorCandidate layout/generic/ScrollAnchorContainer.cpp:349
1 xul.dll class nsIFrame* mozilla::layout::ScrollAnchorContainer::FindAnchorInList layout/generic/ScrollAnchorContainer.cpp:483
2 xul.dll class nsIFrame* mozilla::layout::ScrollAnchorContainer::FindAnchorIn layout/generic/ScrollAnchorContainer.cpp:441
3 xul.dll mozilla::layout::ScrollAnchorContainer::SelectAnchor layout/generic/ScrollAnchorContainer.cpp:145
4 xul.dll mozilla::PresShell::FlushDirtyScrollAnchorContainers layout/base/PresShell.cpp:2577
5 xul.dll void mozilla::RestyleManager::DoProcessPendingRestyles layout/base/RestyleManager.cpp:2975
6 xul.dll mozilla::PresShell::DoFlushPendingNotifications layout/base/PresShell.cpp:4124
7 xul.dll nsViewManager::CallWillPaintOnObservers view/nsViewManager.cpp:1062
8 xul.dll void nsRefreshDriver::Tick layout/base/nsRefreshDriver.cpp:1961
9 xul.dll void mozilla::RefreshDriverTimer::TickRefreshDrivers layout/base/nsRefreshDriver.cpp:305

There are 14 crashes (from 7 installations) in nightly 66 with buildid 20190111093148. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1305957.

[1] https://hg.mozilla.org/mozilla-central/rev?node=b6c42df7ce09

Flags: needinfo?(rhunt)
Assignee

Comment 2

5 months ago

Missing a null check.

Flags: needinfo?(rhunt)
Assignee

Updated

5 months ago
Assignee: nobody → rhunt

Comment 3

5 months ago
Pushed by rhunt@eqrion.net:
https://hg.mozilla.org/integration/mozilla-inbound/rev/717a8fb8b842
Consistently check if a frame has content in ScrollAnchorContainer. r=emilio

Comment 4

5 months ago
bugherder
Status: NEW → RESOLVED
Closed: 5 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla66
You need to log in before you can comment on or make changes to this bug.