Crash in [@ InvalidArrayIndex_CRASH | nsGridContainerFrame::GridReflowInput::PercentageBasisFor]

RESOLVED FIXED in Firefox 69

Status

()

defect
--
critical
RESOLVED FIXED
Last month
14 days ago

People

(Reporter: marcia, Assigned: mats)

Tracking

(Regression, {crash, regression, testcase})

Trunk
mozilla69
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox-esr60 unaffected, firefox67 unaffected, firefox68 unaffected, firefox69 fixed)

Details

(crash signature)

Attachments

(2 attachments)

This bug is for crash report bp-f3d7ef5c-b5b3-45a2-ae02-e15fd0190523.

Mac nightly regression which started in 20190522152821: https://bit.ly/30wVXj8

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b74e5737da64a7af28ab4f81f996950917aa71c5&tochange=aaae630f30291056f4f40bbd9e12a917309e401e

Looks as if Bug 1465296 might be involved. ni on :mats

Top 10 frames of crashing thread:

0 XUL InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:27
1 XUL nsGridContainerFrame::GridReflowInput::PercentageBasisFor const layout/generic/nsGridContainerFrame.cpp
2 XUL nsGridContainerFrame::Tracks::ResolveIntrinsicSize layout/generic/nsGridContainerFrame.cpp:4645
3 XUL nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis layout/generic/nsGridContainerFrame.cpp:3081
4 XUL nsGridContainerFrame::Reflow layout/generic/nsGridContainerFrame.cpp:7070
5 XUL nsBlockReflowContext::ReflowBlock layout/generic/nsBlockReflowContext.cpp:297
6 XUL nsBlockFrame::ReflowLine layout/generic/nsBlockFrame.cpp:3049
7 XUL nsBlockFrame::Reflow layout/generic/nsBlockFrame.cpp:1334
8 XUL nsBlockReflowContext::ReflowBlock layout/generic/nsBlockReflowContext.cpp:297
9 XUL nsBlockFrame::ReflowLine layout/generic/nsBlockFrame.cpp:3049

Assignee

Comment 2

Last month

I'll take a look...

Assignee: nobody → mats
Component: Layout → Layout: Grid
Assignee

Comment 3

Last month

I can't reproduce the crash by simply loading the codepen URL above, but if
I tweak the style of the parent grid then it crashes.

Assignee

Updated

Last month
Keywords: testcase
OS: macOS → All
Hardware: Unspecified → All

Comment 5

Last month
Pushed by mpalmgren@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f12c5ebd0bfc
[css-grid-2] Invalidate any stored used track sizes on subgrids too.  r=dholbert

In case someone still needs a way to reproduce, there's one in bug 1554109.
Let's wait for the patch here to land in m-c and test again that other bug though, the signature is the same, so it'll likely get fixed too.

Status: NEW → RESOLVED
Closed: Last month
Resolution: --- → FIXED
Target Milestone: --- → mozilla69
You need to log in before you can comment on or make changes to this bug.