Closed Bug 1553824 Opened 3 years ago Closed 3 years ago

Crash in [@ InvalidArrayIndex_CRASH | nsGridContainerFrame::GridReflowInput::PercentageBasisFor]

Categories

(Core :: Layout: Grid, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla69
Tracking Status
firefox-esr60 --- unaffected
firefox67 --- unaffected
firefox68 --- unaffected
firefox69 --- fixed

People

(Reporter: marcia, Assigned: MatsPalmgren_bugz)

References

(Regression)

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(2 files)

This bug is for crash report bp-f3d7ef5c-b5b3-45a2-ae02-e15fd0190523.

Mac nightly regression which started in 20190522152821: https://bit.ly/30wVXj8

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b74e5737da64a7af28ab4f81f996950917aa71c5&tochange=aaae630f30291056f4f40bbd9e12a917309e401e

Looks as if Bug 1465296 might be involved. ni on :mats

Top 10 frames of crashing thread:

0 XUL InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:27
1 XUL nsGridContainerFrame::GridReflowInput::PercentageBasisFor const layout/generic/nsGridContainerFrame.cpp
2 XUL nsGridContainerFrame::Tracks::ResolveIntrinsicSize layout/generic/nsGridContainerFrame.cpp:4645
3 XUL nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis layout/generic/nsGridContainerFrame.cpp:3081
4 XUL nsGridContainerFrame::Reflow layout/generic/nsGridContainerFrame.cpp:7070
5 XUL nsBlockReflowContext::ReflowBlock layout/generic/nsBlockReflowContext.cpp:297
6 XUL nsBlockFrame::ReflowLine layout/generic/nsBlockFrame.cpp:3049
7 XUL nsBlockFrame::Reflow layout/generic/nsBlockFrame.cpp:1334
8 XUL nsBlockReflowContext::ReflowBlock layout/generic/nsBlockReflowContext.cpp:297
9 XUL nsBlockFrame::ReflowLine layout/generic/nsBlockFrame.cpp:3049

https://codepen.io/rachelandrew/pen/arOabY is the only URL showing so far.

I'll take a look...

Assignee: nobody → mats
Component: Layout → Layout: Grid

I can't reproduce the crash by simply loading the codepen URL above, but if
I tweak the style of the parent grid then it crashes.

Keywords: testcase
OS: macOS → All
Hardware: Unspecified → All
Pushed by mpalmgren@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f12c5ebd0bfc
[css-grid-2] Invalidate any stored used track sizes on subgrids too.  r=dholbert
See Also: → 1554109

In case someone still needs a way to reproduce, there's one in bug 1554109.
Let's wait for the patch here to land in m-c and test again that other bug though, the signature is the same, so it'll likely get fixed too.

Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla69
Has Regression Range: --- → yes
You need to log in before you can comment on or make changes to this bug.