Closed Bug 1556441 Opened 6 months ago Closed 5 months ago

[tantalus][pi-interop] AddressSanitizer: access-violation on unknown address 0x00000000001c

Categories

(Core :: Web Painting, defect, P2)

68 Branch
x86_64
Windows 10
defect

Tracking

()

RESOLVED FIXED
mozilla69
Tracking Status
firefox-esr60 --- unaffected
firefox67 --- wontfix
firefox68 --- wontfix
firefox69 --- fixed

People

(Reporter: kimberlythegeek, Assigned: mattwoodrow)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: regression)

Attachments

(1 file, 1 obsolete file)

=================================================================
==7564==ERROR: AddressSanitizer: access-violation on unknown address 0x00000000001c (pc 0x7ffed0e6c808 bp 0x0039cc1ee1a0 sp 0x0039cc1ee0d0 T0)
==7564==The signal is caused by a READ memory access.
==7564==Hint: address points to the zero page.
==7564==WARNING: Failed to use and restart external symbolizer!
    #0 0x7ffed0e6c807 in mozilla::BackgroundClipRenderingObserver::GetReferencedElementWithoutObserving z:/build/build/src/layout/svg/SVGObserverUtils.cpp:473
    #1 0x7ffed0e08693 in mozilla::SVGRenderingObserver::StopObserving z:/build/build/src/layout/svg/SVGObserverUtils.cpp:107
    #2 0x7ffed0e6c78d in mozilla::BackgroundClipRenderingObserver::~BackgroundClipRenderingObserver z:/build/build/src/layout/svg/SVGObserverUtils.cpp:470
    #3 0x7ffed0e0a207 in mozilla::BackgroundClipRenderingObserver::Release z:/build/build/src/layout/svg/SVGObserverUtils.cpp:482
    #4 0x7ffed0705a53 in mozilla::FrameProperties::DeleteAll z:/build/build/src/layout/base/FrameProperties.h:270
    #5 0x7ffed09fcda1 in nsFrame::DestroyFrom z:/build/build/src/layout/generic/nsFrame.cpp:846
    #6 0x7ffed0b8a4a7 in nsLineBox::DeleteLineList z:/build/build/src/layout/generic/nsLineBox.cpp:372
    #7 0x7ffed08fb7ce in nsBlockFrame::DestroyFrom z:/build/build/src/layout/generic/nsBlockFrame.cpp:327
    #8 0x7ffed0b8a4a7 in nsLineBox::DeleteLineList z:/build/build/src/layout/generic/nsLineBox.cpp:372
    #9 0x7ffed08fb7ce in nsBlockFrame::DestroyFrom z:/build/build/src/layout/generic/nsBlockFrame.cpp:327
    #10 0x7ffed0a7acfc in nsFrameList::DestroyFramesFrom z:/build/build/src/layout/generic/nsFrameList.cpp:51
    #11 0x7ffed08fc2a1 in nsContainerFrame::DestroyFrom z:/build/build/src/layout/generic/nsContainerFrame.cpp:214
    #12 0x7ffed0b8a4a7 in nsLineBox::DeleteLineList z:/build/build/src/layout/generic/nsLineBox.cpp:372
    #13 0x7ffed08fb7ce in nsBlockFrame::DestroyFrom z:/build/build/src/layout/generic/nsBlockFrame.cpp:327
    #14 0x7ffed0b8a4a7 in nsLineBox::DeleteLineList z:/build/build/src/layout/generic/nsLineBox.cpp:372
    #15 0x7ffed08fb7ce in nsBlockFrame::DestroyFrom z:/build/build/src/layout/generic/nsBlockFrame.cpp:327
    #16 0x7ffed0b8a4a7 in nsLineBox::DeleteLineList z:/build/build/src/layout/generic/nsLineBox.cpp:372
    #17 0x7ffed08fb7ce in nsBlockFrame::DestroyFrom z:/build/build/src/layout/generic/nsBlockFrame.cpp:327
    #18 0x7ffed0a7acfc in nsFrameList::DestroyFramesFrom z:/build/build/src/layout/generic/nsFrameList.cpp:51
    #19 0x7ffed08fc2a1 in nsContainerFrame::DestroyFrom z:/build/build/src/layout/generic/nsContainerFrame.cpp:214
    #20 0x7ffed0b8a4a7 in nsLineBox::DeleteLineList z:/build/build/src/layout/generic/nsLineBox.cpp:372
    #21 0x7ffed08fb7ce in nsBlockFrame::DestroyFrom z:/build/build/src/layout/generic/nsBlockFrame.cpp:327
    #22 0x7ffed0b8a4a7 in nsLineBox::DeleteLineList z:/build/build/src/layout/generic/nsLineBox.cpp:372
    #23 0x7ffed08fb7ce in nsBlockFrame::DestroyFrom z:/build/build/src/layout/generic/nsBlockFrame.cpp:327
    #24 0x7ffed0b8a4a7 in nsLineBox::DeleteLineList z:/build/build/src/layout/generic/nsLineBox.cpp:372
    #25 0x7ffed08fb7ce in nsBlockFrame::DestroyFrom z:/build/build/src/layout/generic/nsBlockFrame.cpp:327
    #26 0x7ffed0b8a4a7 in nsLineBox::DeleteLineList z:/build/build/src/layout/generic/nsLineBox.cpp:372
    #27 0x7ffed08fb7ce in nsBlockFrame::DestroyFrom z:/build/build/src/layout/generic/nsBlockFrame.cpp:327
    #28 0x7ffed0b8a4a7 in nsLineBox::DeleteLineList z:/build/build/src/layout/generic/nsLineBox.cpp:372
    #29 0x7ffed08fb7ce in nsBlockFrame::DestroyFrom z:/build/build/src/layout/generic/nsBlockFrame.cpp:327
    #30 0x7ffed0b8a4a7 in nsLineBox::DeleteLineList z:/build/build/src/layout/generic/nsLineBox.cpp:372
    #31 0x7ffed08fb7ce in nsBlockFrame::DestroyFrom z:/build/build/src/layout/generic/nsBlockFrame.cpp:327
    #32 0x7ffed0b8a4a7 in nsLineBox::DeleteLineList z:/build/build/src/layout/generic/nsLineBox.cpp:372
    #33 0x7ffed08fb7ce in nsBlockFrame::DestroyFrom z:/build/build/src/layout/generic/nsBlockFrame.cpp:327
    #34 0x7ffed0b8a4a7 in nsLineBox::DeleteLineList z:/build/build/src/layout/generic/nsLineBox.cpp:372
    #35 0x7ffed08fb7ce in nsBlockFrame::DestroyFrom z:/build/build/src/layout/generic/nsBlockFrame.cpp:327
    #36 0x7ffed0b8a4a7 in nsLineBox::DeleteLineList z:/build/build/src/layout/generic/nsLineBox.cpp:372
    #37 0x7ffed08fb7ce in nsBlockFrame::DestroyFrom z:/build/build/src/layout/generic/nsBlockFrame.cpp:327
    #38 0x7ffed0a7acfc in nsFrameList::DestroyFramesFrom z:/build/build/src/layout/generic/nsFrameList.cpp:51
    #39 0x7ffed08fc2a1 in nsContainerFrame::DestroyFrom z:/build/build/src/layout/generic/nsContainerFrame.cpp:214
    #40 0x7ffed0975a03 in nsCanvasFrame::DestroyFrom z:/build/build/src/layout/generic/nsCanvasFrame.cpp:216
    #41 0x7ffed0a7acfc in nsFrameList::DestroyFramesFrom z:/build/build/src/layout/generic/nsFrameList.cpp:51
    #42 0x7ffed08fc2a1 in nsContainerFrame::DestroyFrom z:/build/build/src/layout/generic/nsContainerFrame.cpp:214
    #43 0x7ffed0a7acfc in nsFrameList::DestroyFramesFrom z:/build/build/src/layout/generic/nsFrameList.cpp:51
    #44 0x7ffed08fc2a1 in nsContainerFrame::DestroyFrom z:/build/build/src/layout/generic/nsContainerFrame.cpp:214
    #45 0x7ffed07ba9b6 in nsIFrame::Destroy z:/build/build/src/layout/generic/nsIFrame.h:651
    #46 0x7ffed0779add in nsFrameManager::Destroy z:/build/build/src/layout/base/nsFrameManager.cpp:53
    #47 0x7ffed066f9bc in mozilla::PresShell::Destroy z:/build/build/src/layout/base/PresShell.cpp:1338
    #48 0x7ffed07a6b6d in nsDocumentViewer::DestroyPresShell z:/build/build/src/layout/base/nsDocumentViewer.cpp:4164
    #49 0x7ffed079673b in nsDocumentViewer::Destroy z:/build/build/src/layout/base/nsDocumentViewer.cpp:1808
    #50 0x7ffed32935ff in nsDocShell::Destroy z:/build/build/src/docshell/base/nsDocShell.cpp:5015
    #51 0x7ffed3925059 in nsWebBrowser::SetDocShell z:/build/build/src/toolkit/components/browser/nsWebBrowser.cpp:1238
    #52 0x7ffed3922ed3 in nsWebBrowser::InternalDestroy z:/build/build/src/toolkit/components/browser/nsWebBrowser.cpp:192
    #53 0x7ffed392d08c in nsWebBrowser::Destroy z:/build/build/src/toolkit/components/browser/nsWebBrowser.cpp:909
    #54 0x7ffecf4bd358 in mozilla::dom::BrowserChild::DestroyWindow z:/build/build/src/dom/ipc/BrowserChild.cpp:981
    #55 0x7ffecf4d679e in mozilla::dom::BrowserChild::RecvDestroy z:/build/build/src/dom/ipc/BrowserChild.cpp:2359
    #56 0x7ffec88d8674 in mozilla::dom::PBrowserChild::OnMessageReceived z:/build/build/src/obj-firefox/ipc/ipdl/PBrowserChild.cpp:5227
    #57 0x7ffec7fe40bc in mozilla::dom::PContentChild::OnMessageReceived z:/build/build/src/obj-firefox/ipc/ipdl/PContentChild.cpp:6482
    #58 0x7ffec7d7accd in mozilla::ipc::MessageChannel::DispatchAsyncMessage z:/build/build/src/ipc/glue/MessageChannel.cpp:2151
    #59 0x7ffec7d77eb1 in mozilla::ipc::MessageChannel::DispatchMessage z:/build/build/src/ipc/glue/MessageChannel.cpp:2078
    #60 0x7ffec7d7961f in mozilla::ipc::MessageChannel::RunMessage z:/build/build/src/ipc/glue/MessageChannel.cpp:1937
    #61 0x7ffec7d79b0d in mozilla::ipc::MessageChannel::MessageTask::Run z:/build/build/src/ipc/glue/MessageChannel.cpp:1968
    #62 0x7ffec6976aaa in mozilla::SchedulerGroup::Runnable::Run z:/build/build/src/xpcom/threads/SchedulerGroup.cpp:295
    #63 0x7ffec69b7c8d in nsThread::ProcessNextEvent z:/build/build/src/xpcom/threads/nsThread.cpp:1180
    #64 0x7ffec69c07ce in NS_ProcessNextEvent z:/build/build/src/xpcom/threads/nsThreadUtils.cpp:486
    #65 0x7ffec7d82d11 in mozilla::ipc::MessagePump::Run z:/build/build/src/ipc/glue/MessagePump.cpp:88
    #66 0x7ffec7cb346f in MessageLoop::RunInternal z:/build/build/src/ipc/chromium/src/base/message_loop.cc:315
    #67 0x7ffec7cb31c9 in MessageLoop::RunHandler z:/build/build/src/ipc/chromium/src/base/message_loop.cc:308
    #68 0x7ffec7cb2e65 in MessageLoop::Run z:/build/build/src/ipc/chromium/src/base/message_loop.cc:290
    #69 0x7ffecff682ba in nsBaseAppShell::Run z:/build/build/src/widget/nsBaseAppShell.cpp:137
    #70 0x7ffed00f4a62 in nsAppShell::Run z:/build/build/src/widget/windows/nsAppShell.cpp:412
    #71 0x7ffed40b47f6 in XRE_RunAppShell z:/build/build/src/toolkit/xre/nsEmbedFunctions.cpp:919
    #72 0x7ffec7d83d76 in mozilla::ipc::MessagePumpForChildProcess::Run z:/build/build/src/ipc/glue/MessagePump.cpp:238
    #73 0x7ffec7cb346f in MessageLoop::RunInternal z:/build/build/src/ipc/chromium/src/base/message_loop.cc:315
    #74 0x7ffec7cb31c9 in MessageLoop::RunHandler z:/build/build/src/ipc/chromium/src/base/message_loop.cc:308
    #75 0x7ffec7cb2e65 in MessageLoop::Run z:/build/build/src/ipc/chromium/src/base/message_loop.cc:290
    #76 0x7ffed40b3020 in XRE_InitChildProcess z:/build/build/src/toolkit/xre/nsEmbedFunctions.cpp:757
    #77 0x7ff7382e2643 in Ordinal0+0x2643 (C:/mozilla/builds/nightly-asan/mozilla/firefox-debug/dist/bin/firefox.exe+0x140002643)
    #78 0x7ff7382e1ae7 in Ordinal0+0x1ae7 (C:/mozilla/builds/nightly-asan/mozilla/firefox-debug/dist/bin/firefox.exe+0x140001ae7)
    #79 0x7ff7382e14fc in Ordinal0+0x14fc (C:/mozilla/builds/nightly-asan/mozilla/firefox-debug/dist/bin/firefox.exe+0x1400014fc)
    #80 0x7ff73842b237 in TargetNtUnmapViewOfSection+0x25b17 (C:/mozilla/builds/nightly-asan/mozilla/firefox-debug/dist/bin/firefox.exe+0x14014b237)
    #81 0x7fff17167973 in BaseThreadInitThunk+0x13 (C:/WINDOWS/System32/KERNEL32.DLL+0x180017973)
    #82 0x7fff19e8a270 in RtlUserThreadStart+0x20 (C:/WINDOWS/SYSTEM32/ntdll.dll+0x18006a270)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: access-violation z:/build/build/src/layout/svg/SVGObserverUtils.cpp:473 in mozilla::BackgroundClipRenderingObserver::GetReferencedElementWithoutObserving
==7564==ABORTING
JavaScript error: resource:///modules/sessionstore/SessionStore.jsm, line 1641: TypeError: subject.QueryInterface is not a function
A content process crashed and MOZ_CRASHREPORTER_SHUTDOWN is set, shutting down
[Parent 9528, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
[Child 8072, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
[Parent 9528, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
[Parent 9528, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 341
nsStringStats
 => mAllocCount:           8062
 => mReallocCount:            0
 => mFreeCount:            8062
 => mShareCount:           5206
 => mAdoptCount:            358
 => mAdoptFreeCount:        358
 => Process ID: 8072, Thread ID: 4632
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: NS_ENSURE_TRUE(gDbBackgroundThread) failed: file z:/build/build/src/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp, line 2111
JavaScript error: resource://gre/modules/UrlClassifierListManager.jsm, line 329: NS_ERROR_NOT_INITIALIZED: Component returned failure code: 0xc1f30001 (NS_ERROR_NOT_INITIALIZED) [nsIUrlClassifierDBService.getTables]
JavaScript error: resource://gre/modules/UrlClassifierListManager.jsm, line 329: NS_ERROR_NOT_INITIALIZED: Component returned failure code: 0xc1f30001 (NS_ERROR_NOT_INITIALIZED) [nsIUrlClassifierDBService.getTables]
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: cannot post event if not initialized: file z:/build/build/src/netwerk/protocol/http/nsHttpConnectionMgr.cpp, line 278
[Parent 9528, Main Thread] WARNING: cannot post event if not initialized: file z:/build/build/src/netwerk/protocol/http/nsHttpConnectionMgr.cpp, line 278
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: cannot post event if not initialized: file z:/build/build/src/netwerk/protocol/http/nsHttpConnectionMgr.cpp, line 278
[Parent 9528, Main Thread] WARNING: cannot post event if not initialized: file z:/build/build/src/netwerk/protocol/http/nsHttpConnectionMgr.cpp, line 278
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: cannot post event if not initialized: file z:/build/build/src/netwerk/protocol/http/nsHttpConnectionMgr.cpp, line 278
[Parent 9528, Main Thread] WARNING: cannot post event if not initialized: file z:/build/build/src/netwerk/protocol/http/nsHttpConnectionMgr.cpp, line 278
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: Setting user pref after profile shutdown.: file z:/build/build/src/modules/libpref/Preferences.cpp, line 2890
[Parent 9528, Main Thread] WARNING: No DBState! Profile already closed?: file z:/build/build/src/netwerk/cookie/nsCookieService.cpp, line 4504
[Parent 9528, Main Thread] WARNING: NS_ENSURE_TRUE(mDB) failed: file z:/build/build/src/netwerk/cache/nsDiskCacheDeviceSQL.cpp, line 1285
JavaScript error: resource:///modules/Discovery.jsm, line 105: NS_ERROR_NOT_AVAILABLE: Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsICookieManager.cookieExists]
--DOMWINDOW == 9 (0000120660058E80) [pid = 9528] [serial = 1] [outer = 0000000000000000] [url = chrome://gfxsanity/content/sanityparent.html]
--DOMWINDOW == 8 (0000120E6042B580) [pid = 9528] [serial = 4] [outer = 0000000000000000] [url = about:blank]
--DOMWINDOW == 7 (000012066028BE00) [pid = 9528] [serial = 6] [outer = 0000000000000000] [url = chrome://extensions/content/dummy.xul]
--DOMWINDOW == 6 (0000120E60207D80) [pid = 9528] [serial = 2] [outer = 0000000000000000] [url = about:blank]
--DOMWINDOW == 5 (0000120E6068EE80) [pid = 9528] [serial = 8] [outer = 0000000000000000] [url = chrome://extensions/content/dummy.xul]
--DOMWINDOW == 4 (000012066056A400) [pid = 9528] [serial = 10] [outer = 0000000000000000] [url = resource://gre-resources/hiddenWindow.html]
--DOMWINDOW == 3 (00001206600F4D80) [pid = 9528] [serial = 3] [outer = 0000000000000000] [url = chrome://browser/content/browser.xul]
--DOMWINDOW == 2 (00001206601D7E00) [pid = 9528] [serial = 5] [outer = 0000000000000000] [url = about:blank]
--DOMWINDOW == 1 (0000120E608A4A80) [pid = 9528] [serial = 9] [outer = 0000000000000000] [url = about:blank]
--DOMWINDOW == 0 (0000120E60A95D80) [pid = 9528] [serial = 12] [outer = 0000000000000000] [url = resource://gre-resources/hiddenWindow.html]
nsStringStats
 => mAllocCount:         436468
 => mReallocCount:            0
 => mFreeCount:          436468
 => mShareCount:         363572
 => mAdoptCount:           3697
 => mAdoptFreeCount:       3789
 => Process ID: 9528, Thread ID: 8836

This error was detected by the Tantalus reboot of Bughunter. This error occurred 67 times on 5 different Windows 10 64-bit configurations. 200 URLs were tested on each configuration

  • 1 error on the default (aka no third party software) config
  • 1 error on the worker with Avira antivirus installed
  • 49 errors on the Kaspersky configuration
  • 1 error with 360 Total Security
  • 15 errors with NVDA screen reader

Marking as confidential bug to avoid potentially leaking sensitive information.
Google doc with detailed info on each occurance of this error (ldap access required) :
https://docs.google.com/spreadsheets/d/1D7_hXa3R_rwWWW_-Y9k0gH6nK6EZKNEp1wUNjHk_tpM/edit#gid=759695177&fvid=997331451

Blocks: 1552501

Regression from bug 1525372?

Component: General → Web Painting
Product: Firefox → Core

Is there any reason this bug is Mozilla-confidential?

Flags: needinfo?(ksereduck)
Regressed by: 1525372

(In reply to Emilio Cobos Álvarez (:emilio) from comment #2)

Is there any reason this bug is Mozilla-confidential?

(In reply to Kimberly Sereduck :kimberlythegeek from comment #0)

Marking as confidential bug to avoid potentially leaking sensitive information.

Flags: needinfo?(ksereduck)
Assignee: nobody → matt.woodrow
Priority: -- → P2

Is it not an invariant that frames are always destroyed before their elements? If that is indeed supposed to hold, do you have any idea how we end up crashing here?

Flags: needinfo?(matt.woodrow)

Maybe background propagation is propagating background-clip to the viewport, which has no content node? In that case the patch won't help.

Doesn't seem to be the case: data:text/html,<body style="background: green; background-clip: text; color: transparent">Foo.

Oh, so pseudos: https://searchfox.org/mozilla-central/rev/227f5329f75bd8b16c6b146a7414598a420260cb/layout/generic/nsFrame.cpp#841

It should be trivial to find a crasher then.

Maybe not as trivial, from a quick try... But I think pseudos is the most reasonable option :)

I'm also unclear, on reflection, how introducing BackgroundClipRenderingObserver even fixed bug 1525372. It essentially just makes nsFrame::DidReflow call InvalidateFrame() on itself and its continuations (at the point when INVALIDATE_REFLOW is passed). But aren't we going to invalidate for that reflow anyway...?

(In reply to Jonathan Watt [:jwatt] from comment #9)

I'm also unclear, on reflection, how introducing BackgroundClipRenderingObserver even fixed bug 1525372. It essentially just makes nsFrame::DidReflow call InvalidateFrame() on itself and its continuations (at the point when INVALIDATE_REFLOW is passed). But aren't we going to invalidate for that reflow anyway...?

The issue here is that the background is painted by an ancestor of the frame, which may not need invalidation otherwise.

FWIW a more robust way of fixing this crash may simply be to remove the StopObserving() call from the BackgroundClipRenderingObserver dtor. We know that in the case of this class the observed and observer frame are the same frame, and that if we're being destroyed it's because our frame is going away. So there's no need to call StopObserving().

(In reply to Emilio Cobos Álvarez (:emilio) from comment #10)

The issue here is that the background is painted by an ancestor of the frame, which may not need invalidation otherwise.

So nsDisplayBackgroundImage and/or nsDisplayBackgroundColor may be created for an ancestor of the frame with background-clip:text?

(In reply to Emilio Cobos Álvarez (:emilio) from comment #8)

Maybe not as trivial, from a quick try... But I think pseudos is the most reasonable option :)

The pseudo path you linked was indeed what I believe the problem to be, but I don't have a testcase either.

(In reply to Jonathan Watt [:jwatt] from comment #12)

(In reply to Emilio Cobos Álvarez (:emilio) from comment #10)

The issue here is that the background is painted by an ancestor of the frame, which may not need invalidation otherwise.

So nsDisplayBackgroundImage and/or nsDisplayBackgroundColor may be created for an ancestor of the frame with background-clip:text?

No, but the 'contents' of that display item (the clipping path) is computed using the style/position of descendants (ideally text descendants, but currently can be any descendants). We need to invalidate the frame with background-clip:text if its children change.

Flags: needinfo?(matt.woodrow)

(In reply to Jonathan Watt [:jwatt] from comment #11)

FWIW a more robust way of fixing this crash may simply be to remove the StopObserving() call from the BackgroundClipRenderingObserver dtor. We know that in the case of this class the observed and observer frame are the same frame, and that if we're being destroyed it's because our frame is going away. So there's no need to call StopObserving().

As discussed at the All Hands, I'd prefer to do this since then there's no need to have the extra member or have AddRef/Release.

Flags: needinfo?(matt.woodrow)

This is just a nullptr crash, no need to be confidential.

Group: mozilla-employee-confidential
Flags: needinfo?(matt.woodrow)
Attachment #9070150 - Attachment is obsolete: true
Pushed by mwoodrow@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/d2d42067781b
Don't call StopObservering when destroying a BackgroundClipRenderingObserver since we know the frame is going away anyway. r=jwatt

Backed out for failures on SVGObserverUtils.cpp and nsISupportsImpl.h

backout: https://hg.mozilla.org/integration/autoland/rev/c905c2290c3bb5c52a1a5b19118d0a044bfc9b4c

push: https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=d2d42067781b566820701a07797f2772ad560439&group_state=expanded&selectedJob=253652114

failure log: * https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=253652130&repo=autoland&lineNumber=22352
* https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=253652114&repo=autoland&lineNumber=22455

[task 2019-06-27T04:45:38.744Z] 04:45:38 ERROR - /builds/worker/workspace/build/src/layout/svg/SVGObserverUtils.cpp:563:1: error: static_assert failed due to requirement '!mozilla::IsDestructible<mozilla::BackgroundClipRenderingObserver>::value' "Reference-counted class BackgroundClipRenderingObserver should not have a public destructor. Make this class's destructor non-public"
[task 2019-06-27T04:45:38.747Z] 04:45:38 INFO - NS_IMPL_ISUPPORTS(BackgroundClipRenderingObserver, nsIMutationObserver)
[task 2019-06-27T04:45:38.747Z] 04:45:38 INFO - ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[task 2019-06-27T04:45:38.747Z] 04:45:38 INFO - /builds/worker/workspace/build/src/obj-firefox/dist/include/nsISupportsImpl.h:1199:3: note: expanded from macro 'NS_IMPL_ISUPPORTS'
[task 2019-06-27T04:45:38.747Z] 04:45:38 INFO - NS_IMPL_ADDREF(aClass)
[task 2019-06-27T04:45:38.747Z] 04:45:38 INFO - ^~~~~~~~~~~~~~~~~~~~~~
[task 2019-06-27T04:45:38.747Z] 04:45:38 INFO - /builds/worker/workspace/build/src/obj-firefox/dist/include/nsISupportsImpl.h:684:32: note: expanded from macro 'NS_IMPL_ADDREF'
[task 2019-06-27T04:45:38.747Z] 04:45:38 INFO - #define NS_IMPL_ADDREF(_class) NS_IMPL_NAMED_ADDREF(_class, #_class)
[task 2019-06-27T04:45:38.747Z] 04:45:38 INFO - ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[task 2019-06-27T04:45:38.747Z] 04:45:38 INFO - /builds/worker/workspace/build/src/obj-firefox/dist/include/nsISupportsImpl.h:671:5: note: expanded from macro 'NS_IMPL_NAMED_ADDREF'
[task 2019-06-27T04:45:38.747Z] 04:45:38 INFO - MOZ_ASSERT_TYPE_OK_FOR_REFCOUNTING(_class)
[task 2019-06-27T04:45:38.747Z] 04:45:38 INFO - ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[task 2019-06-27T04:45:38.747Z] 04:45:38 INFO - /builds/worker/workspace/build/src/obj-firefox/dist/include/nsISupportsImpl.h:32:3: note: expanded from macro 'MOZ_ASSERT_TYPE_OK_FOR_REFCOUNTING'
[task 2019-06-27T04:45:38.747Z] 04:45:38 INFO - static_assert(!mozilla::IsDestructible<X>::value,
[task 2019-06-27T04:45:38.747Z] 04:45:38 INFO - ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[task 2019-06-27T04:45:38.747Z] 04:45:38 INFO - 1 error generated.
[task 2019-06-27T04:45:38.747Z] 04:45:38 INFO - /builds/worker/workspace/build/src/config/rules.mk:801: recipe for target 'Unified_cpp_layout_svg0.o' failed
[task 2019-06-27T04:45:38.747Z] 04:45:38 ERROR - make[4]: *** [Unified_cpp_layout_svg0.o] Error 1

[task 2019-06-27T04:45:34.573Z] 04:45:34 ERROR - /builds/worker/workspace/build/src/obj-firefox/dist/include/nsISupportsImpl.h:32:3: error: static assertion failed: Reference-counted class BackgroundClipRenderingObserver should not have a public destructor. Make this class's destructor non-public
[task 2019-06-27T04:45:34.573Z] 04:45:34 INFO - static_assert(!mozilla::IsDestructible<X>::value,
[task 2019-06-27T04:45:34.573Z] 04:45:34 INFO - ^
[task 2019-06-27T04:45:34.573Z] 04:45:34 INFO - /builds/worker/workspace/build/src/obj-firefox/dist/include/nsISupportsImpl.h:671:5: note: in expansion of macro 'MOZ_ASSERT_TYPE_OK_FOR_REFCOUNTING'
[task 2019-06-27T04:45:34.573Z] 04:45:34 INFO - MOZ_ASSERT_TYPE_OK_FOR_REFCOUNTING(_class)
[task 2019-06-27T04:45:34.573Z] 04:45:34 INFO - ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[task 2019-06-27T04:45:34.573Z] 04:45:34 INFO - /builds/worker/workspace/build/src/obj-firefox/dist/include/nsISupportsImpl.h:684:32: note: in expansion of macro 'NS_IMPL_NAMED_ADDREF'
[task 2019-06-27T04:45:34.573Z] 04:45:34 INFO - #define NS_IMPL_ADDREF(_class) NS_IMPL_NAMED_ADDREF(_class, #_class)
[task 2019-06-27T04:45:34.573Z] 04:45:34 INFO - ^~~~~~~~~~~~~~~~~~~~
[task 2019-06-27T04:45:34.573Z] 04:45:34 INFO - /builds/worker/workspace/build/src/obj-firefox/dist/include/nsISupportsImpl.h:1199:3: note: in expansion of macro 'NS_IMPL_ADDREF'
[task 2019-06-27T04:45:34.573Z] 04:45:34 INFO - NS_IMPL_ADDREF(aClass)
[task 2019-06-27T04:45:34.573Z] 04:45:34 INFO - ^~~~~~~~~~~~~~
[task 2019-06-27T04:45:34.573Z] 04:45:34 INFO - /builds/worker/workspace/build/src/layout/svg/SVGObserverUtils.cpp:563:1: note: in expansion of macro 'NS_IMPL_ISUPPORTS'
[task 2019-06-27T04:45:34.573Z] 04:45:34 INFO - NS_IMPL_ISUPPORTS(BackgroundClipRenderingObserver, nsIMutationObserver)
[task 2019-06-27T04:45:34.573Z] 04:45:34 INFO - ^
[task 2019-06-27T04:45:34.573Z] 04:45:34 INFO - /builds/worker/workspace/build/src/config/rules.mk:801: recipe for target 'Unified_cpp_layout_svg0.o' failed
[task 2019-06-27T04:45:34.573Z] 04:45:34 ERROR - make[4]: *** [Unified_cpp_layout_svg0.o] Error 1

Flags: needinfo?(matt.woodrow)
Pushed by mwoodrow@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/ae0ec3d4ed20
Don't call StopObservering when destroying a BackgroundClipRenderingObserver since we know the frame is going away anyway. r=jwatt
Flags: needinfo?(matt.woodrow)
Status: NEW → RESOLVED
Closed: 5 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla69
You need to log in before you can comment on or make changes to this bug.