1553824 - Crash in [@ InvalidArrayIndex_CRASH | nsGridContainerFrame::GridReflowInput::PercentageBasisFor]

Status: RESOLVED FIXED

(Core :: Layout: Grid, defect)

Description

[Marcia Knous [:marcia]]

This bug is for crash report bp-f3d7ef5c-b5b3-45a2-ae02-e15fd0190523.

Mac nightly regression which started in 20190522152821: https://bit.ly/30wVXj8

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b74e5737da64a7af28ab4f81f996950917aa71c5&tochange=aaae630f30291056f4f40bbd9e12a917309e401e

Looks as if Bug 1465296 might be involved. ni on :mats

Top 10 frames of crashing thread:

0 XUL InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:27
1 XUL nsGridContainerFrame::GridReflowInput::PercentageBasisFor const layout/generic/nsGridContainerFrame.cpp
2 XUL nsGridContainerFrame::Tracks::ResolveIntrinsicSize layout/generic/nsGridContainerFrame.cpp:4645
3 XUL nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis layout/generic/nsGridContainerFrame.cpp:3081
4 XUL nsGridContainerFrame::Reflow layout/generic/nsGridContainerFrame.cpp:7070
5 XUL nsBlockReflowContext::ReflowBlock layout/generic/nsBlockReflowContext.cpp:297
6 XUL nsBlockFrame::ReflowLine layout/generic/nsBlockFrame.cpp:3049
7 XUL nsBlockFrame::Reflow layout/generic/nsBlockFrame.cpp:1334
8 XUL nsBlockReflowContext::ReflowBlock layout/generic/nsBlockReflowContext.cpp:297
9 XUL nsBlockFrame::ReflowLine layout/generic/nsBlockFrame.cpp:3049

Comment 1

[Marcia Knous [:marcia]]

https://codepen.io/rachelandrew/pen/arOabY is the only URL showing so far.

Comment 2

[Mats Palmgren (inactive)]

I'll take a look...

Comment 3

[Mats Palmgren (inactive)]

Attachment: Testcase #1 (tab will CRASH)

I can't reproduce the crash by simply loading the codepen URL above, but if
I tweak the style of the parent grid then it crashes.

Comment 4

[Mats Palmgren (inactive)]

Attachment: Bug 1553824 - [css-grid-2] Invalidate any stored used track sizes on subgrids too. r=dholbert

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f12c5ebd0bfc
[css-grid-2] Invalidate any stored used track sizes on subgrids too.  r=dholbert

Comment 6

[Patrick Brosset <:pbro>]

In case someone still needs a way to reproduce, there's one in bug 1554109.
Let's wait for the patch here to land in m-c and test again that other bug though, the signature is the same, so it'll likely get fixed too.

Comment 7

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/f12c5ebd0bfc