1629231 - Crash on gov.uk unless gfx.downloadable_fonts.enabled=false

Status: RESOLVED WORKSFORME

(Core :: Layout: Text and Fonts, defect, P5)

Description

[Jan Beich]

Originally reported in https://lists.freebsd.org/pipermail/freebsd-current/2020-April/075748.html
I've confirmed on:

• Downstream Firefox 75.0 and 68.7esr with bug 847568 on FreeBSD 11.3 i386 and 12.1 amd64
• Unmodified Firefox 77.0 (snapshot) and 68.7esr (snapshot) on FreeBSD 13.0 amd64

$ c++ --version
FreeBSD clang version 10.0.0 ([e-mail]:llvm/llvm-project.git llvmorg-10.0.0-0-gd32170dbd5b)
Target: x86_64-unknown-freebsd13.0
Thread model: posix
InstalledDir: /usr/bin
$ rustc --version
rustc 1.42.0

$ ./mach bootstrap
$ ./mach build
$ ./mach run https://gov.uk/
 0:00.15 objdir/dist/bin/firefox https://gov.uk/ -no-remote -profile objdir/tmp/profile-default

###!!! [Parent][MessageChannel] Error: (msgtype=0x5A0013,name=PHttpChannel::Msg_OnStartRequest) Channel error: cannot send/recv

From https://hg.mozilla.org/mozilla-central/rev/82d84da94d8d snapshot:

Process 26205 stopped
* thread #1, name = 'Web Content', stop reason = signal SIGBUS: hardware error
    frame #0: 0x000000080c72f8cf libxul.so`::hb_ot_layout_table_find_feature_variations(hb_face_t *, hb_tag_t, const int *, unsigned int, unsigned int *) [inlined] get_gsubgpos_table(face=<unavailable>, table_tag=<unavailable>) at hb-ot-layout.cc:0
   1    /*
   2     * Copyright © 1998-2004  David Turner and Werner Lemberg
   3     * Copyright © 2006  Behdad Esfahbod
   4     * Copyright © 2007,2008,2009  Red Hat, Inc.
   5     * Copyright © 2012,2013  Google, Inc.
   6     *
   7     *  This is part of HarfBuzz, a text shaping library.
(lldb) bt
* thread #1, name = 'Web Content', stop reason = signal SIGBUS: hardware error
  * frame #0: 0x000000080c72f8cf libxul.so`::hb_ot_layout_table_find_feature_variations(hb_face_t *, hb_tag_t, const int *, unsigned int, unsigned int *) [inlined] get_gsubgpos_table(face=<unavailable>, table_tag=<unavailable>) at hb-ot-layout.cc:0
    frame #1: 0x000000080c72f8a2 libxul.so`::hb_ot_layout_table_find_feature_variations(face=<unavailable>, table_tag=<unavailable>, coords=0x0000000000000000, num_coords=0, variations_index=0x00007ffffffefef4) at hb-ot-layout.cc:1290
    frame #2: 0x000000080c74a3ea libxul.so`hb_shape_plan_key_t::init(bool, hb_face_t*, hb_segment_properties_t const*, hb_feature_t const*, unsigned int, int const*, unsigned int, char const* const*) at hb-ot-shape.hh:45:7
    frame #3: 0x000000080c74a3d7 libxul.so`hb_shape_plan_key_t::init(this=0x00007ffffffefec8, copy=<unavailable>, face=0x00000008140a94c0, props=<unavailable>, user_features=<unavailable>, num_user_features=<unavailable>, coords=0x0000000000000000, num_coords=0, shaper_list=0x0000000000000000) at hb-shape-plan.cc:83
    frame #4: 0x000000080c74aaa3 libxul.so`::hb_shape_plan_create_cached2(face=<unavailable>, props=<unavailable>, user_features=<unavailable>, num_user_features=<unavailable>, coords=<unavailable>, num_coords=<unavailable>, shaper_list=0x0000000000000000) at hb-shape-plan.cc:471:14
    frame #5: 0x000000080c74ad36 libxul.so`::hb_shape_full(font=0x000000081964bc80, buffer=0x0000000815960d40, features=0x00007ffffffeffe0, num_features=0, shaper_list=<unavailable>) at hb-shape.cc:135:33
    frame #6: 0x000000080a3f9872 libxul.so`gfxHarfBuzzShaper::ShapeText(this=0x0000000815b76d00, aDrawTarget=<unavailable>, aText=u"Accept", aOffset=0, aLength=6, aScript=<unavailable>, aVertical=<unavailable>, aRounding=kRoundX | kRoundY, aShapedText=0x0000000814079980) at gfxHarfBuzzShaper.cpp:1399:3
    frame #7: 0x000000080a3d950a libxul.so`gfxFont::ShapeText(this=0x00000008195b5240, aDrawTarget=<unavailable>, aText=u"Accept", aOffset=0, aLength=6, aScript=<unavailable>, aVertical=<unavailable>, aRounding=kRoundX | kRoundY, aShapedText=0x0000000814079980) at gfxFont.cpp:2839:24
    frame #8: 0x000000080a3d91e9 libxul.so`gfxFont::ShapeText(this=0x00000008195b5240, aDrawTarget=<unavailable>, aText=<unavailable>, aOffset=<unavailable>, aLength=6, aScript=LATIN, aVertical=<unavailable>, aRounding=kRoundX | kRoundY, aShapedText=0x0000000814079980) at gfxFont.cpp:2810:10
    frame #9: 0x000000080a3e5dd3 libxul.so`gfxShapedWord* gfxFont::GetShapedWord<unsigned char>(this=0x00000008195b5240, aDrawTarget=0x0000000801b4be40, aText="Accept all cookiesw\x19\b", aLength=<unavailable>, aHash=<unavailable>, aRunScript=<unavailable>, aVertical=<unavailable>, aAppUnitsPerDevUnit=40, aFlags=TEXT_IS_8BIT, aRounding=kRoundX | kRoundY, aTextPerf=0x0000000000000000) at gfxFont.cpp:2750:24
    frame #10: 0x000000080a3e628b libxul.so`bool gfxFont::SplitAndInitTextRun<unsigned char>(this=<unavailable>, aDrawTarget=<unavailable>, aTextRun=<unavailable>, aString="Accept all cookiesw\x19\b", aRunStart=0, aRunLength=18, aRunScript=LATIN, aOrientation=TEXT_ORIENT_HORIZONTAL) at gfxFont.cpp:3135:27
    frame #11: 0x000000080a41f62e libxul.so`void gfxFontGroup::InitScriptRun<unsigned char>(this=<unavailable>, aDrawTarget=0x0000000801b4be40, aTextRun=<unavailable>, aString="Accept all cookiesw\x19\b", aOffset=0, aLength=18, aRunScript=LATIN, aMFR=0x0000000000000000) at gfxTextRun.cpp:2562:25
    frame #12: 0x000000080a41b1ec libxul.so`void gfxFontGroup::InitTextRun<unsigned char>(this=0x000000081965d400, aDrawTarget=0x0000000801b4be40, aTextRun=0x00000008194f5b80, aString="Accept all cookiesw\x19\b", aLength=<unavailable>, aMFR=0x0000000000000000) at gfxTextRun.cpp:2423:7
    frame #13: 0x000000080a410795 libxul.so`gfxFontGroup::MakeTextRun(this=0x000000081965d400, aString="Accept all cookiesw\x19\b", aLength=18, aParams=0x00007fffffff0b20, aFlags=<unavailable>, aFlags2=<unavailable>, aMFR=0x0000000000000000) at gfxTextRun.cpp:2313:3
    frame #14: 0x000000080beea8ac libxul.so`BuildTextRunsScanner::BuildTextRunForFrames(this=<unavailable>, aTextBuffer=<unavailable>) at nsTextFrame.cpp:2543:28
    frame #15: 0x000000080bee8666 libxul.so`BuildTextRunsScanner::FlushFrames(this=0x00007fffffff4e48, aFlushLineBreaks=true, aSuppressTrailingBreak=false) at nsTextFrame.cpp:1647:17
    frame #16: 0x000000080beed392 libxul.so`nsTextFrame::EnsureTextRun(nsTextFrame::TextRunType, mozilla::gfx::DrawTarget*, nsIFrame*, nsLineList_iterator const*, unsigned int*) [inlined] BuildTextRuns(aDrawTarget=<unavailable>, aForFrame=0x0000000814067e60, aLineContainer=<unavailable>, aForFrameLine=<unavailable>, aWhichTextRun=<unavailable>) at nsTextFrame.cpp:1571:11
    frame #17: 0x000000080beed29e libxul.so`nsTextFrame::EnsureTextRun(this=<unavailable>, aWhichTextRun=<unavailable>, aRefDrawTarget=<unavailable>, aLineContainer=<unavailable>, aLine=<unavailable>, aFlowEndInTextRun=0x00007fffffff548c) at nsTextFrame.cpp:2980
    frame #18: 0x000000080bed4378 libxul.so`nsTextFrame::ReflowText(this=<unavailable>, aLineLayout=0x00007fffffff5950, aAvailableWidth=15569, aDrawTarget=0x0000000801b4be40, aMetrics=0x00007fffffff5720, aStatus=0x00007fffffff57cc) at nsTextFrame.cpp:9159:7
    frame #19: 0x000000080bed2d6a libxul.so`nsLineLayout::ReflowFrame(this=0x00007fffffff5950, aFrame=0x0000000814067e60, aReflowStatus=0x00007fffffff57cc, aMetrics=0x0000000000000000, aPushedFrame=0x00007fffffff57cb) at nsLineLayout.cpp:881:40
    frame #20: 0x000000080be24ba2 libxul.so`nsBlockFrame::ReflowInlineFrame(this=0x0000000814067b70, aState=0x00007fffffff5e30, aLineLayout=0x00007fffffff5950, aLine=nsBlockFrame::LineIterator @ r14, aFrame=0x0000000814067e60, aLineReflowStatus=0x00007fffffff587c) at nsBlockFrame.cpp:4486:15
    frame #21: 0x000000080be24554 libxul.so`nsBlockFrame::DoReflowInlineFrames(this=0x0000000814067b70, aState=<unavailable>, aLineLayout=0x00007fffffff5950, aLine=nsBlockFrame::LineIterator @ r14, aFloatAvailableSpace=0x00007fffffff5930, aAvailableSpaceBSize=0x00007fffffff5928, aFloatStateBeforeLine=0x00007fffffff5910, aKeepReflowGoing=0x00007fffffff5b1f, aLineReflowStatus=0x00007fffffff592c, aAllowPullUp=<unavailable>) at nsBlockFrame.cpp:4288:5
    frame #22: 0x000000080be2252c libxul.so`nsBlockFrame::ReflowInlineFrames(this=0x0000000814067b70, aState=0x00007fffffff5e30, aLine=nsBlockFrame::LineIterator @ 0x00007fffffff5948, aKeepReflowGoing=0x00007fffffff5b1f) at nsBlockFrame.cpp:4173:9
    frame #23: 0x000000080be207df libxul.so`nsBlockFrame::ReflowLine(this=<unavailable>, aState=0x00007fffffff5e30, aLine=nsBlockFrame::LineIterator @ rbx, aKeepReflowGoing=<unavailable>) at nsBlockFrame.cpp:3154:5
    frame #24: 0x000000080be1de85 libxul.so`nsBlockFrame::ReflowDirtyLines(this=<unavailable>, aState=<unavailable>) at nsBlockFrame.cpp:2690:7
    frame #25: 0x000000080be1ba37 libxul.so`nsBlockFrame::Reflow(this=<unavailable>, aPresContext=0x0000000811e33e80, aMetrics=0x00007fffffff6170, aReflowInput=<unavailable>, aStatus=0x00007fffffff6054) at nsBlockFrame.cpp:1402:3
    frame #26: 0x000000080be32ef5 libxul.so`nsContainerFrame::ReflowChild(this=<unavailable>, aKidFrame=0x0000000814067b70, aPresContext=0x0000000811e33e80, aDesiredSize=<unavailable>, aReflowInput=<unavailable>, aWM=<unavailable>, aPos=0x00007fffffff6058, aContainerSize=0x00007fffffff6048, aFlags=Default, aStatus=0x00007fffffff6054, aTracker=0x0000000000000000) at nsContainerFrame.cpp:906:14
    frame #27: 0x000000080bf1b300 libxul.so`nsHTMLButtonControlFrame::ReflowButtonContents(this=0x0000000814067ac0, aPresContext=0x0000000811e33e80, aButtonDesiredSize=0x00007fffffff6460, aButtonReflowInput=0x00007fffffff6358, aFirstKid=<unavailable>) at nsHTMLButtonControlFrame.cpp:238:3
    frame #28: 0x000000080bf1b029 libxul.so`nsHTMLButtonControlFrame::Reflow(this=0x0000000814067ac0, aPresContext=<unavailable>, aDesiredSize=0x00007fffffff6460, aReflowInput=0x00007fffffff6358, aStatus=0x00007fffffff650c) at nsHTMLButtonControlFrame.cpp:184:3
    frame #29: 0x000000080bed2e19 libxul.so`nsLineLayout::ReflowFrame(this=0x00007fffffff6690, aFrame=0x0000000814067ac0, aReflowStatus=0x00007fffffff650c, aMetrics=0x0000000000000000, aPushedFrame=0x00007fffffff650b) at nsLineLayout.cpp:878:13
    frame #30: 0x000000080be24ba2 libxul.so`nsBlockFrame::ReflowInlineFrame(this=0x0000000814067980, aState=0x00007fffffff6b70, aLineLayout=0x00007fffffff6690, aLine=nsBlockFrame::LineIterator @ r14, aFrame=0x0000000814067ac0, aLineReflowStatus=0x00007fffffff65bc) at nsBlockFrame.cpp:4486:15
    frame #31: 0x000000080be24554 libxul.so`nsBlockFrame::DoReflowInlineFrames(this=0x0000000814067980, aState=<unavailable>, aLineLayout=0x00007fffffff6690, aLine=nsBlockFrame::LineIterator @ r14, aFloatAvailableSpace=0x00007fffffff6670, aAvailableSpaceBSize=0x00007fffffff6668, aFloatStateBeforeLine=0x00007fffffff6650, aKeepReflowGoing=0x00007fffffff685f, aLineReflowStatus=0x00007fffffff666c, aAllowPullUp=<unavailable>) at nsBlockFrame.cpp:4288:5
    frame #32: 0x000000080be2252c libxul.so`nsBlockFrame::ReflowInlineFrames(this=0x0000000814067980, aState=0x00007fffffff6b70, aLine=nsBlockFrame::LineIterator @ 0x00007fffffff6688, aKeepReflowGoing=0x00007fffffff685f) at nsBlockFrame.cpp:4173:9
    frame #33: 0x000000080be207df libxul.so`nsBlockFrame::ReflowLine(this=<unavailable>, aState=0x00007fffffff6b70, aLine=nsBlockFrame::LineIterator @ rbx, aKeepReflowGoing=<unavailable>) at nsBlockFrame.cpp:3154:5
    frame #34: 0x000000080be1de85 libxul.so`nsBlockFrame::ReflowDirtyLines(this=<unavailable>, aState=<unavailable>) at nsBlockFrame.cpp:2690:7
    frame #35: 0x000000080be1ba37 libxul.so`nsBlockFrame::Reflow(this=<unavailable>, aPresContext=0x0000000811e33e80, aMetrics=0x00007fffffff6e9c, aReflowInput=<unavailable>, aStatus=0x00007fffffff6fb8) at nsBlockFrame.cpp:1402:3
    frame #36: 0x000000080be23e9f libxul.so`nsBlockReflowContext::ReflowBlock(this=0x00007fffffff6e60, aSpace=<unavailable>, aApplyBStartMargin=<unavailable>, aPrevMargin=<unavailable>, aClearance=<unavailable>, aIsAdjacentWithBStart=<unavailable>, aLine=0x0000000000000000, aFrameRI=0x00007fffffff6d60, aFrameReflowStatus=0x00007fffffff6fb8, aState=0x00007fffffff7a10) at nsBlockReflowContext.cpp:293:11
    frame #37: 0x000000080be28cfa libxul.so`nsBlockFrame::ReflowFloat(this=0x00000008140678c0, aState=0x00007fffffff7a10, aAdjustedAvailableSpace=0x00007fffffff6fe0, aFloat=<unavailable>, aFloatMargin=0x00007fffffff6fd0, aFloatOffsets=0x00007fffffff6fc0, aFloatPushedDown=<unavailable>, aReflowStatus=0x00007fffffff6fb8) at nsBlockFrame.cpp:6608:9
    frame #38: 0x000000080be00688 libxul.so`mozilla::BlockReflowInput::FlowAndPlaceFloat(this=0x00007fffffff7a10, aFloat=0x0000000814067980) at BlockReflowInput.cpp:875:13
    frame #39: 0x000000080bdffe41 libxul.so`mozilla::BlockReflowInput::AddFloat(this=0x00007fffffff7a10, aLineLayout=0x00007fffffff7530, aFloat=0x0000000814067980, aAvailableISize=37799) at BlockReflowInput.cpp:559:14
    frame #40: 0x000000080bed357c libxul.so`nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) [inlined] nsLineLayout::AddFloat(this=<unavailable>, aFloat=0x0000000814067980, aAvailableISize=<unavailable>) at nsLineLayout.h:156:22
    frame #41: 0x000000080bed3570 libxul.so`nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) [inlined] nsLineLayout::TryToPlaceFloat(this=0x00007fffffff7530, aFloat=0x0000000814067980) at nsLineLayout.cpp:1473
    frame #42: 0x000000080bed3545 libxul.so`nsLineLayout::ReflowFrame(this=0x00007fffffff7530, aFrame=0x0000000814067a40, aReflowStatus=0x00007fffffff73ac, aMetrics=0x0000000000000000, aPushedFrame=0x00007fffffff73ab) at nsLineLayout.cpp:922
    frame #43: 0x000000080be24ba2 libxul.so`nsBlockFrame::ReflowInlineFrame(this=0x00000008140678c0, aState=0x00007fffffff7a10, aLineLayout=0x00007fffffff7530, aLine=nsBlockFrame::LineIterator @ r14, aFrame=0x0000000814067a40, aLineReflowStatus=0x00007fffffff745c) at nsBlockFrame.cpp:4486:15
    frame #44: 0x000000080be24554 libxul.so`nsBlockFrame::DoReflowInlineFrames(this=0x00000008140678c0, aState=<unavailable>, aLineLayout=0x00007fffffff7530, aLine=nsBlockFrame::LineIterator @ r14, aFloatAvailableSpace=0x00007fffffff7510, aAvailableSpaceBSize=0x00007fffffff7508, aFloatStateBeforeLine=0x00007fffffff74f0, aKeepReflowGoing=0x00007fffffff76ff, aLineReflowStatus=0x00007fffffff750c, aAllowPullUp=<unavailable>) at nsBlockFrame.cpp:4288:5
    frame #45: 0x000000080be2252c libxul.so`nsBlockFrame::ReflowInlineFrames(this=0x00000008140678c0, aState=0x00007fffffff7a10, aLine=nsBlockFrame::LineIterator @ 0x00007fffffff7528, aKeepReflowGoing=0x00007fffffff76ff) at nsBlockFrame.cpp:4173:9
    frame #46: 0x000000080be207df libxul.so`nsBlockFrame::ReflowLine(this=<unavailable>, aState=0x00007fffffff7a10, aLine=nsBlockFrame::LineIterator @ rbx, aKeepReflowGoing=<unavailable>) at nsBlockFrame.cpp:3154:5
    frame #47: 0x000000080be1de85 libxul.so`nsBlockFrame::ReflowDirtyLines(this=<unavailable>, aState=<unavailable>) at nsBlockFrame.cpp:2690:7
    frame #48: 0x000000080be1ba37 libxul.so`nsBlockFrame::Reflow(this=<unavailable>, aPresContext=0x0000000811e33e80, aMetrics=0x00007fffffff7e3c, aReflowInput=<unavailable>, aStatus=0x00007fffffff7c68) at nsBlockFrame.cpp:1402:3
    frame #49: 0x000000080be23e9f libxul.so`nsBlockReflowContext::ReflowBlock(this=0x00007fffffff7e00, aSpace=<unavailable>, aApplyBStartMargin=<unavailable>, aPrevMargin=<unavailable>, aClearance=<unavailable>, aIsAdjacentWithBStart=<unavailable>, aLine=0x0000000814068650, aFrameRI=0x00007fffffff7cd8, aFrameReflowStatus=0x00007fffffff7c68, aState=0x00007fffffff8290) at nsBlockReflowContext.cpp:293:11
    frame #50: 0x000000080be217df libxul.so`nsBlockFrame::ReflowBlockFrame(this=<unavailable>, aState=<unavailable>, aLine=nsBlockFrame::LineIterator @ 0x00007fffffff7c40, aKeepReflowGoing=0x00007fffffff7f7f) at nsBlockFrame.cpp:3804:11
    frame #51: 0x000000080be2084f libxul.so`nsBlockFrame::ReflowLine(this=<unavailable>, aState=0x00007fffffff8290, aLine=nsBlockFrame::LineIterator @ rbx, aKeepReflowGoing=<unavailable>) at nsBlockFrame.cpp:3151:5
    frame #52: 0x000000080be1de85 libxul.so`nsBlockFrame::ReflowDirtyLines(this=<unavailable>, aState=<unavailable>) at nsBlockFrame.cpp:2690:7
    frame #53: 0x000000080be1ba37 libxul.so`nsBlockFrame::Reflow(this=<unavailable>, aPresContext=0x0000000811e33e80, aMetrics=0x00007fffffff85bc, aReflowInput=<unavailable>, aStatus=0x00007fffffff86d8) at nsBlockFrame.cpp:1402:3
    frame #54: 0x000000080be23e9f libxul.so`nsBlockReflowContext::ReflowBlock(this=0x00007fffffff8580, aSpace=<unavailable>, aApplyBStartMargin=<unavailable>, aPrevMargin=<unavailable>, aClearance=<unavailable>, aIsAdjacentWithBStart=<unavailable>, aLine=0x0000000000000000, aFrameRI=0x00007fffffff8480, aFrameReflowStatus=0x00007fffffff86d8, aState=0x00007fffffff9130) at nsBlockReflowContext.cpp:293:11
    frame #55: 0x000000080be28cfa libxul.so`nsBlockFrame::ReflowFloat(this=0x0000000814067020, aState=0x00007fffffff9130, aAdjustedAvailableSpace=0x00007fffffff8700, aFloat=<unavailable>, aFloatMargin=0x00007fffffff86f0, aFloatOffsets=0x00007fffffff86e0, aFloatPushedDown=<unavailable>, aReflowStatus=0x00007fffffff86d8) at nsBlockFrame.cpp:6608:9
    frame #56: 0x000000080be00688 libxul.so`mozilla::BlockReflowInput::FlowAndPlaceFloat(this=0x00007fffffff9130, aFloat=0x00000008140670e0) at BlockReflowInput.cpp:875:13
    frame #57: 0x000000080bdffe41 libxul.so`mozilla::BlockReflowInput::AddFloat(this=0x00007fffffff9130, aLineLayout=0x00007fffffff8c50, aFloat=0x00000008140670e0, aAvailableISize=59400) at BlockReflowInput.cpp:559:14
    frame #58: 0x000000080bed357c libxul.so`nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) [inlined] nsLineLayout::AddFloat(this=<unavailable>, aFloat=0x00000008140670e0, aAvailableISize=<unavailable>) at nsLineLayout.h:156:22
    frame #59: 0x000000080bed3570 libxul.so`nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) [inlined] nsLineLayout::TryToPlaceFloat(this=0x00007fffffff8c50, aFloat=0x00000008140670e0) at nsLineLayout.cpp:1473
    frame #60: 0x000000080bed3545 libxul.so`nsLineLayout::ReflowFrame(this=0x00007fffffff8c50, aFrame=0x00000008140671a0, aReflowStatus=0x00007fffffff8acc, aMetrics=0x0000000000000000, aPushedFrame=0x00007fffffff8acb) at nsLineLayout.cpp:922
    frame #61: 0x000000080be24ba2 libxul.so`nsBlockFrame::ReflowInlineFrame(this=0x0000000814067020, aState=0x00007fffffff9130, aLineLayout=0x00007fffffff8c50, aLine=nsBlockFrame::LineIterator @ r14, aFrame=0x00000008140671a0, aLineReflowStatus=0x00007fffffff8b7c) at nsBlockFrame.cpp:4486:15
    frame #62: 0x000000080be24554 libxul.so`nsBlockFrame::DoReflowInlineFrames(this=0x0000000814067020, aState=<unavailable>, aLineLayout=0x00007fffffff8c50, aLine=nsBlockFrame::LineIterator @ r14, aFloatAvailableSpace=0x00007fffffff8c30, aAvailableSpaceBSize=0x00007fffffff8c28, aFloatStateBeforeLine=0x00007fffffff8c10, aKeepReflowGoing=0x00007fffffff8e1f, aLineReflowStatus=0x00007fffffff8c2c, aAllowPullUp=<unavailable>) at nsBlockFrame.cpp:4288:5
    frame #63: 0x000000080be2252c libxul.so`nsBlockFrame::ReflowInlineFrames(this=0x0000000814067020, aState=0x00007fffffff9130, aLine=nsBlockFrame::LineIterator @ 0x00007fffffff8c48, aKeepReflowGoing=0x00007fffffff8e1f) at nsBlockFrame.cpp:4173:9
    frame #64: 0x000000080be207df libxul.so`nsBlockFrame::ReflowLine(this=<unavailable>, aState=0x00007fffffff9130, aLine=nsBlockFrame::LineIterator @ rbx, aKeepReflowGoing=<unavailable>) at nsBlockFrame.cpp:3154:5
    frame #65: 0x000000080be1de85 libxul.so`nsBlockFrame::ReflowDirtyLines(this=<unavailable>, aState=<unavailable>) at nsBlockFrame.cpp:2690:7
    frame #66: 0x000000080be1ba37 libxul.so`nsBlockFrame::Reflow(this=<unavailable>, aPresContext=0x0000000811e33e80, aMetrics=0x00007fffffff955c, aReflowInput=<unavailable>, aStatus=0x00007fffffff9388) at nsBlockFrame.cpp:1402:3
    frame #67: 0x000000080be23e9f libxul.so`nsBlockReflowContext::ReflowBlock(this=0x00007fffffff9520, aSpace=<unavailable>, aApplyBStartMargin=<unavailable>, aPrevMargin=<unavailable>, aClearance=<unavailable>, aIsAdjacentWithBStart=<unavailable>, aLine=0x0000000814068990, aFrameRI=0x00007fffffff93f8, aFrameReflowStatus=0x00007fffffff9388, aState=0x00007fffffff99b0) at nsBlockReflowContext.cpp:293:11
    frame #68: 0x000000080be217df libxul.so`nsBlockFrame::ReflowBlockFrame(this=<unavailable>, aState=<unavailable>, aLine=nsBlockFrame::LineIterator @ 0x00007fffffff9360, aKeepReflowGoing=0x00007fffffff969f) at nsBlockFrame.cpp:3804:11
    frame #69: 0x000000080be2084f libxul.so`nsBlockFrame::ReflowLine(this=<unavailable>, aState=0x00007fffffff99b0, aLine=nsBlockFrame::LineIterator @ rbx, aKeepReflowGoing=<unavailable>) at nsBlockFrame.cpp:3151:5
    frame #70: 0x000000080be1de85 libxul.so`nsBlockFrame::ReflowDirtyLines(this=<unavailable>, aState=<unavailable>) at nsBlockFrame.cpp:2690:7
    frame #71: 0x000000080be1ba37 libxul.so`nsBlockFrame::Reflow(this=<unavailable>, aPresContext=0x0000000811e33e80, aMetrics=0x00007fffffff9ddc, aReflowInput=<unavailable>, aStatus=0x00007fffffff9c08) at nsBlockFrame.cpp:1402:3
    frame #72: 0x000000080be23e9f libxul.so`nsBlockReflowContext::ReflowBlock(this=0x00007fffffff9da0, aSpace=<unavailable>, aApplyBStartMargin=<unavailable>, aPrevMargin=<unavailable>, aClearance=<unavailable>, aIsAdjacentWithBStart=<unavailable>, aLine=0x0000000814068c30, aFrameRI=0x00007fffffff9c78, aFrameReflowStatus=0x00007fffffff9c08, aState=0x00007fffffffa230) at nsBlockReflowContext.cpp:293:11
    frame #73: 0x000000080be217df libxul.so`nsBlockFrame::ReflowBlockFrame(this=<unavailable>, aState=<unavailable>, aLine=nsBlockFrame::LineIterator @ 0x00007fffffff9be0, aKeepReflowGoing=0x00007fffffff9f1f) at nsBlockFrame.cpp:3804:11
    frame #74: 0x000000080be2084f libxul.so`nsBlockFrame::ReflowLine(this=<unavailable>, aState=0x00007fffffffa230, aLine=nsBlockFrame::LineIterator @ rbx, aKeepReflowGoing=<unavailable>) at nsBlockFrame.cpp:3151:5
    frame #75: 0x000000080be1de85 libxul.so`nsBlockFrame::ReflowDirtyLines(this=<unavailable>, aState=<unavailable>) at nsBlockFrame.cpp:2690:7
    frame #76: 0x000000080be1ba37 libxul.so`nsBlockFrame::Reflow(this=<unavailable>, aPresContext=0x0000000811e33e80, aMetrics=0x00007fffffffa65c, aReflowInput=<unavailable>, aStatus=0x00007fffffffa488) at nsBlockFrame.cpp:1402:3
    frame #77: 0x000000080be23e9f libxul.so`nsBlockReflowContext::ReflowBlock(this=0x00007fffffffa620, aSpace=<unavailable>, aApplyBStartMargin=<unavailable>, aPrevMargin=<unavailable>, aClearance=<unavailable>, aIsAdjacentWithBStart=<unavailable>, aLine=0x0000000814068e10, aFrameRI=0x00007fffffffa4f8, aFrameReflowStatus=0x00007fffffffa488, aState=0x00007fffffffaab0) at nsBlockReflowContext.cpp:293:11
    frame #78: 0x000000080be217df libxul.so`nsBlockFrame::ReflowBlockFrame(this=<unavailable>, aState=<unavailable>, aLine=nsBlockFrame::LineIterator @ 0x00007fffffffa460, aKeepReflowGoing=0x00007fffffffa79f) at nsBlockFrame.cpp:3804:11
    frame #79: 0x000000080be2084f libxul.so`nsBlockFrame::ReflowLine(this=<unavailable>, aState=0x00007fffffffaab0, aLine=nsBlockFrame::LineIterator @ rbx, aKeepReflowGoing=<unavailable>) at nsBlockFrame.cpp:3151:5
    frame #80: 0x000000080be1de85 libxul.so`nsBlockFrame::ReflowDirtyLines(this=<unavailable>, aState=<unavailable>) at nsBlockFrame.cpp:2690:7
    frame #81: 0x000000080be1ba37 libxul.so`nsBlockFrame::Reflow(this=<unavailable>, aPresContext=0x0000000811e33e80, aMetrics=0x00007fffffffaedc, aReflowInput=<unavailable>, aStatus=0x00007fffffffad08) at nsBlockFrame.cpp:1402:3
    frame #82: 0x000000080be23e9f libxul.so`nsBlockReflowContext::ReflowBlock(this=0x00007fffffffaea0, aSpace=<unavailable>, aApplyBStartMargin=<unavailable>, aPrevMargin=<unavailable>, aClearance=<unavailable>, aIsAdjacentWithBStart=<unavailable>, aLine=0x00000008158bcc00, aFrameRI=0x00007fffffffad78, aFrameReflowStatus=0x00007fffffffad08, aState=0x00007fffffffb330) at nsBlockReflowContext.cpp:293:11
    frame #83: 0x000000080be217df libxul.so`nsBlockFrame::ReflowBlockFrame(this=<unavailable>, aState=<unavailable>, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffface0, aKeepReflowGoing=0x00007fffffffb01f) at nsBlockFrame.cpp:3804:11
    frame #84: 0x000000080be2084f libxul.so`nsBlockFrame::ReflowLine(this=<unavailable>, aState=0x00007fffffffb330, aLine=nsBlockFrame::LineIterator @ rbx, aKeepReflowGoing=<unavailable>) at nsBlockFrame.cpp:3151:5
    frame #85: 0x000000080be1de85 libxul.so`nsBlockFrame::ReflowDirtyLines(this=<unavailable>, aState=<unavailable>) at nsBlockFrame.cpp:2690:7
    frame #86: 0x000000080be1ba37 libxul.so`nsBlockFrame::Reflow(this=<unavailable>, aPresContext=0x0000000811e33e80, aMetrics=0x00007fffffffb6d0, aReflowInput=<unavailable>, aStatus=0x00007fffffffb850) at nsBlockFrame.cpp:1402:3
    frame #87: 0x000000080be32ef5 libxul.so`nsContainerFrame::ReflowChild(this=<unavailable>, aKidFrame=0x00000008158bca80, aPresContext=0x0000000811e33e80, aDesiredSize=<unavailable>, aReflowInput=<unavailable>, aWM=<unavailable>, aPos=0x00007fffffffb568, aContainerSize=0x00007fffffffb570, aFlags=Default, aStatus=0x00007fffffffb850, aTracker=0x0000000000000000) at nsContainerFrame.cpp:906:14
    frame #88: 0x000000080be32972 libxul.so`nsCanvasFrame::Reflow(this=0x00000008158bc0c0, aPresContext=0x0000000811e33e80, aDesiredSize=<unavailable>, aReflowInput=<unavailable>, aStatus=<unavailable>) at nsCanvasFrame.cpp:750:5
    frame #89: 0x000000080be32ef5 libxul.so`nsContainerFrame::ReflowChild(this=<unavailable>, aKidFrame=0x00000008158bc0c0, aPresContext=0x0000000811e33e80, aDesiredSize=<unavailable>, aReflowInput=<unavailable>, aWM=<unavailable>, aPos=0x00007fffffffb980, aContainerSize=0x00007fffffffb848, aFlags=NoMoveFrame, aStatus=0x00007fffffffb850, aTracker=0x0000000000000000) at nsContainerFrame.cpp:906:14
    frame #90: 0x000000080be7a3f7 libxul.so`nsHTMLScrollFrame::ReflowScrolledFrame(this=0x00000008158bc198, aState=0x00007fffffffbb20, aAssumeHScroll=false, aAssumeVScroll=true, aMetrics=0x00007fffffffba00) at nsGfxScrollFrame.cpp:654:3
    frame #91: 0x000000080be7a847 libxul.so`nsHTMLScrollFrame::ReflowContents(this=0x00000008158bc198, aState=0x00007fffffffbb20, aDesiredSize=<unavailable>) at nsGfxScrollFrame.cpp:768:3
    frame #92: 0x000000080be7bfef libxul.so`nsHTMLScrollFrame::Reflow(this=0x00000008158bc198, aPresContext=0x0000000811e33e80, aDesiredSize=0x00007fffffffbd90, aReflowInput=0x00007fffffffbc90, aStatus=0x00007fffffffbe90) at nsGfxScrollFrame.cpp:1155:3
    frame #93: 0x000000080be15dca libxul.so`nsContainerFrame::ReflowChild(this=<unavailable>, aKidFrame=0x00000008158bc198, aPresContext=0x0000000811e33e80, aDesiredSize=0x00007fffffffbd90, aReflowInput=<unavailable>, aX=<unavailable>, aY=0, aFlags=Default, aStatus=0x00007fffffffbe90, aTracker=0x0000000000000000) at nsContainerFrame.cpp:946:14
    frame #94: 0x000000080be15ab0 libxul.so`mozilla::ViewportFrame::Reflow(this=0x00000008158bc020, aPresContext=0x0000000811e33e80, aDesiredSize=0x00007fffffffbf00, aReflowInput=0x00007fffffffbf50, aStatus=0x00007fffffffbe90) at ViewportFrame.cpp:299:7
    frame #95: 0x000000080bd75ab5 libxul.so`mozilla::PresShell::DoReflow(this=0x0000000813fff400, target=0x00000008158bc020, aInterruptible=false, aOverflowTracker=0x00007fffffffc0b0) at PresShell.cpp:9363:11
    frame #96: 0x000000080bd7c759 libxul.so`mozilla::PresShell::ProcessReflowCommands(this=<unavailable>, aInterruptible=true) at PresShell.cpp:9536:24
    frame #97: 0x000000080bd7c1b0 libxul.so`mozilla::PresShell::DoFlushPendingNotifications(this=0x0000000813fff400, aFlush=(mFlushType = InterruptibleLayout, mFlushAnimations = false)) at PresShell.cpp:4221:11
    frame #98: 0x000000080bd56f41 libxul.so`nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) [inlined] mozilla::PresShell::FlushPendingNotifications(this=<unavailable>, aType=<unavailable>) at PresShell.h:1453:5
    frame #99: 0x000000080bd56f31 libxul.so`nsRefreshDriver::Tick(this=<unavailable>, aId=<unavailable>, aNowTime=TimeStamp @ 0x00007fffffffc228) at nsRefreshDriver.cpp:2071
    frame #100: 0x000000080bd5c580 libxul.so`mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) [inlined] mozilla::RefreshDriverTimer::TickDriver(driver=<unavailable>, aId=(mId = 3648), now=TimeStamp @ 0x00007fffffffc440) at nsRefreshDriver.cpp:374:13
    frame #101: 0x000000080bd5c574 libxul.so`mozilla::RefreshDriverTimer::TickRefreshDrivers(this=<unavailable>, aId=(mId = 3648), aNow=TimeStamp @ 0x00007fffffffc440, aDrivers=<unavailable>) at nsRefreshDriver.cpp:351
    frame #102: 0x000000080bd5c38d libxul.so`mozilla::RefreshDriverTimer::Tick(this=0x0000000813e85100, aId=(mId = 3648), now=TimeStamp @ r14) at nsRefreshDriver.cpp:368:5
    frame #103: 0x000000080bd5bef5 libxul.so`mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) [inlined] mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(this=0x0000000813e85100, aId=<unavailable>, aTimeStamp=TimeStamp @ r13) at nsRefreshDriver.cpp:828:5
    frame #104: 0x000000080bd5beea libxul.so`mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(this=0x0000000811e2bc00, aId=<unavailable>, aVsyncTimestamp=TimeStamp @ r13) at nsRefreshDriver.cpp:746
    frame #105: 0x000000080bd5bb25 libxul.so`mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(this=0x0000000811e2bc00, aVsync=0x00007fffffffc570) at nsRefreshDriver.cpp:645:9
    frame #106: 0x000000080bff1f59 libxul.so`mozilla::layout::VsyncChild::RecvNotify(this=0x0000000813e5ab00, aVsync=0x00007fffffffc570) at VsyncChild.cpp:55:16
    frame #107: 0x0000000809cf76b6 libxul.so`mozilla::layout::PVsyncChild::OnMessageReceived(this=0x0000000813e5ab00, msg__=0x00000008106395b8) at PVsyncChild.cpp:187:54
    frame #108: 0x0000000809bd0edb libxul.so`mozilla::ipc::PBackgroundChild::OnMessageReceived(this=0x0000000813ee1400, msg__=0x00000008106395b8) at PBackgroundChild.cpp:5970:32
    frame #109: 0x0000000809a283c7 libxul.so`mozilla::ipc::MessageChannel::DispatchAsyncMessage(this=0x0000000813ee14d0, aProxy=0x0000000811d6a320, aMsg=0x00000008106395b8) at MessageChannel.cpp:2187:25
    frame #110: 0x0000000809a27067 libxul.so`mozilla::ipc::MessageChannel::DispatchMessage(this=0x0000000813ee14d0, aMsg=0x00000008106395b8) at MessageChannel.cpp:2111:9
    frame #111: 0x0000000809a27c9e libxul.so`mozilla::ipc::MessageChannel::MessageTask::Run(this=0x0000000810639560) at MessageChannel.cpp:1990:13
    frame #112: 0x0000000809388df5 libxul.so`nsThread::ProcessNextEvent(this=0x0000000801b1f300, aMayWait=<unavailable>, aResult=0x00007fffffffd617) at nsThread.cpp:1200:14
    frame #113: 0x000000080938b3ab libxul.so`NS_ProcessNextEvent(aThread=<unavailable>, aMayWait=true) at nsThreadUtils.cpp:481:10
    frame #114: 0x0000000809a2abef libxul.so`mozilla::ipc::MessagePump::Run(this=0x0000000801a19d20, aDelegate=0x00007fffffffd758) at MessagePump.cpp:109:5
    frame #115: 0x00000008099b3348 libxul.so`MessageLoop::Run() [inlined] MessageLoop::RunInternal(this=<unavailable>) at message_loop.cc:315:10
    frame #116: 0x00000008099b333c libxul.so`MessageLoop::Run() [inlined] MessageLoop::RunHandler(this=<unavailable>) at message_loop.cc:308
    frame #117: 0x00000008099b333c libxul.so`MessageLoop::Run(this=<unavailable>) at message_loop.cc:290
    frame #118: 0x000000080bbaad19 libxul.so`nsBaseAppShell::Run(this=0x0000000813fa9700) at nsBaseAppShell.cpp:137:27
    frame #119: 0x000000080d10c727 libxul.so`XRE_RunAppShell() at nsEmbedFunctions.cpp:909:20
    frame #120: 0x00000008099b3348 libxul.so`MessageLoop::Run() [inlined] MessageLoop::RunInternal(this=<unavailable>) at message_loop.cc:315:10
    frame #121: 0x00000008099b333c libxul.so`MessageLoop::Run() [inlined] MessageLoop::RunHandler(this=<unavailable>) at message_loop.cc:308
    frame #122: 0x00000008099b333c libxul.so`MessageLoop::Run(this=<unavailable>) at message_loop.cc:290
    frame #123: 0x000000080d10c41f libxul.so`XRE_InitChildProcess(aArgc=<unavailable>, aArgv=0x00007fffffffddd0, aChildData=<unavailable>) at nsEmbedFunctions.cpp:740:34
    frame #124: 0x000000000103067a firefox`main [inlined] content_process_main(bootstrap=0x0000000801a33770, argc=14, argv=0x00007fffffffddd0) at plugin-container.cpp:56:28
    frame #125: 0x0000000001030653 firefox`main(argc=<unavailable>, argv=0x00007fffffffddd0, envp=0x00007fffffffde50) at nsBrowserApp.cpp:303
    frame #126: 0x00000000010300e5 firefox`_start(ap=<unavailable>, cleanup=<unavailable>) at crt1.c:76:7

From https://hg.mozilla.org/releases/mozilla-esr68/rev/d26ebb37a67b snapshot:

Thread 1 "Web Content" received signal SIGSEGV, Segmentation fault.
0x000000080755cc05 in gfxTextRun::AccumulateMetricsForRun (this=0x8144d67e0, aFont=0x8140f7b80, aRange=...,
    aBoundingBoxType=gfxFont::LOOSE_INK_EXTENTS, aRefDrawTarget=<optimized out>, aProvider=<optimized out>,
    aSpacingRange=..., aOrientation=<optimized out>, aMetrics=<optimized out>)
    at gfx/thebes/gfxTextRun.cpp:715
715       Metrics metrics = aFont->Measure(
(gdb) bt
#0  0x000000080755cc05 in gfxTextRun::AccumulateMetricsForRun(gfxFont*, gfxTextRun::Range, gfxFont::BoundingBoxType, mozilla::gfx::DrawTarget*, gfxTextRun::PropertyProvider*, gfxTextRun::Range, mozilla::gfx::ShapedTextFlags, gfxFont::RunMetrics*) const
    (this=0x8144d67e0, aFont=0x8140f7b80, aRange=..., aBoundingBoxType=gfxFont::LOOSE_INK_EXTENTS, aRefDrawTarget=<optimized out>, aProvider=<optimized out>, aSpacingRange=..., aOrientation=<optimized out>, aMetrics=<optimized out>)
    at gfx/thebes/gfxTextRun.cpp:715
#1  0x000000080755c52c in gfxTextRun::MeasureText(gfxTextRun::Range, gfxFont::BoundingBoxType, mozilla::gfx::DrawTarget*, gfxTextRun::PropertyProvider*) const
    (this=<optimized out>, aRange=..., aBoundingBoxType=<optimized out>, aRefDrawTarget=<optimized out>, aProvider=<optimized out>) at gfx/thebes/gfxTextRun.cpp:780
#2  0x000000080755dc9c in gfxTextRun::BreakAndMeasureText(unsigned int, unsigned int, bool, double, gfxTextRun::PropertyProvider*, gfxTextRun::SuppressBreak, double*, bool, gfxFont::RunMetrics*, gfxFont::BoundingBoxType, mozilla::gfx::DrawTarget*, bool*, unsigned int*, bool, gfxBreakPriority*)
    (this=0x8144d67e0, aStart=<optimized out>, aMaxLength=<optimized out>, aLineBreakBefore=<optimized out>, aWidth=38399, aProvider=<optimized out>, aSuppressBreak=<optimized out>, aTrimWhitespace=0x7fffffff75b8, aWhitespaceCanHang=<optimized out>, aMetrics=0x7fffffff75e0, aBoundingBoxType=gfxFont::LOOSE_INK_EXTENTS, aRefDrawTarget=0x80da518a0, aUsedHyphenation=0x7fffffff75c3, aLastBreak=0x7fffffff75c4, aCanWordWrap=<optimized out>, aBreakPriority=0x7fffffff75b4)
    at gfx/thebes/gfxTextRun.cpp:1098
#3  0x0000000808c9a499 in nsTextFrame::ReflowText(nsLineLayout&, int, mozilla::gfx::DrawTarget*, mozilla::ReflowOutput&, nsReflowStatus&)
    (this=0x813abeb00, aLineLayout=..., aAvailableWidth=<optimized out>, aDrawTarget=<optimized out>, aMetrics=..., aStatus=...) at layout/generic/nsTextFrame.cpp:8963
#4  0x0000000808c5c522 in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&)
    (this=0x7fffffff7b00, aFrame=<optimized out>, aReflowStatus=..., aMetrics=<optimized out>, aPushedFrame=<optimized out>) at layout/generic/nsLineLayout.cpp:880
#5  0x0000000808bddafe in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)
    (this=0x813abea48, aState=..., aLineLayout=..., aLine=..., aFrame=0x813abeb00, aLineReflowStatus=0x7fffffff7a2c)
    at layout/generic/nsBlockFrame.cpp:4333
#6  0x0000000808bdd4a6 in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)
    (this=<optimized out>, aState=..., aLineLayout=..., aLine=..., aFloatAvailableSpace=..., aAvailableSpaceBSize=<optimized out>, aFloatStateBeforeLine=<optimized out>, aKeepReflowGoing=<optimized out>, aLineReflowStatus=<optimized out>, aAllowPullUp=<optimized out>) at layout/generic/nsBlockFrame.cpp:4135
#7  0x0000000808bdb2f7 in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)
    (this=<optimized out>, aState=..., aLine=..., aKeepReflowGoing=<optimized out>)
    at layout/generic/nsBlockFrame.cpp:4020
#8  0x0000000808bd96df in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)
    (this=0x7fffffff4ee8, aState=..., aLine=..., aKeepReflowGoing=0x0)
    at layout/generic/nsBlockFrame.cpp:3052
#9  0x0000000808bd70e6 in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) (this=<optimized out>, aState=...)
    at layout/generic/nsBlockFrame.cpp:2594
#10 0x0000000808bd4b20 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=<optimized out>, aPresContext=<optimized out>, aMetrics=..., aReflowInput=..., aStatus=...)
    at layout/generic/nsBlockFrame.cpp:1334
#11 0x0000000808bdcd9f in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)
    (this=0x7fffffff8420, aSpace=..., aApplyBStartMargin=<optimized out>, aPrevMargin=..., aClearance=<optimized out>, aIsAdjacentWithBStart=<optimized out>, aLine=0x813abf7c0, aFrameRI=..., aFrameReflowStatus=..., aState=...)
    at layout/generic/nsBlockReflowContext.cpp:297
#12 0x0000000808bda4c1 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)
    (this=<optimized out>, aState=..., aLine=..., aKeepReflowGoing=0x7fffffff855f)
    at layout/generic/nsBlockFrame.cpp:3657
#13 0x0000000808bd977a in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)
    (this=0x7fffffff4ee8, aState=..., aLine=..., aKeepReflowGoing=0x0)
    at layout/generic/nsBlockFrame.cpp:3049
#14 0x0000000808bd70e6 in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) (this=<optimized out>, aState=...)
    at layout/generic/nsBlockFrame.cpp:2594
#15 0x0000000808bd4b20 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=<optimized out>, aPresContext=<optimized out>, aMetrics=..., aReflowInput=..., aStatus=...)
    at layout/generic/nsBlockFrame.cpp:1334
#16 0x0000000808bdcd9f in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)
    (this=0x7fffffff8b90, aSpace=..., aApplyBStartMargin=<optimized out>, aPrevMargin=..., aClearance=<optimized out>, aIsAdjacentWithBStart=<optimized out>, aLine=0x0, aFrameRI=..., aFrameReflowStatus=..., aState=...)
    at layout/generic/nsBlockReflowContext.cpp:297
#17 0x0000000808be1806 in nsBlockFrame::ReflowFloat(mozilla::BlockReflowInput&, mozilla::LogicalRect const&, nsIFrame*, mozilla::LogicalMargin&, mozilla::LogicalMargin&, bool, nsReflowStatus&)
    (this=<optimized out>, aState=..., aAdjustedAvailableSpace=..., aFloat=0x813abe918, aFloatMargin=..., aFloatOffsets=..., aFloatPushedDown=<optimized out>, aReflowStatus=...) at layout/generic/nsBlockFrame.cpp:6402
#18 0x0000000808bbb0b8 in mozilla::BlockReflowInput::FlowAndPlaceFloat(nsIFrame*)
    (this=0x7fffffff9670, aFloat=0x813abe918) at layout/generic/BlockReflowInput.cpp:918
#19 0x0000000808bba8e4 in mozilla::BlockReflowInput::AddFloat(nsLineLayout*, nsIFrame*, int)
    (this=0x7fffffff9670, aLineLayout=0x7fffffff9260, aFloat=0x813abe918, aAvailableISize=57600)
    at layout/generic/BlockReflowInput.cpp:602
#20 0x0000000808c5cd1c in nsLineLayout::AddFloat(nsIFrame*, int)
    (this=0x8140f7b80, aFloat=0x813abe918, aAvailableISize=0) at layout/generic/nsLineLayout.h:156
#21 0x0000000808c5cd1c in nsLineLayout::TryToPlaceFloat(nsIFrame*) (this=0x7fffffff9260, aFloat=0x813abe918)
    at layout/generic/nsLineLayout.cpp:1472
#22 0x0000000808c5cd1c in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&)
    (this=0x7fffffff9260, aFrame=0x813abe9d0, aReflowStatus=..., aMetrics=<optimized out>, aPushedFrame=<optimized out>)
    at layout/generic/nsLineLayout.cpp:921
#23 0x0000000808bddafe in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)
    (this=0x813abe860, aState=..., aLineLayout=..., aLine=..., aFrame=0x813abe9d0, aLineReflowStatus=0x7fffffff918c)
    at layout/generic/nsBlockFrame.cpp:4333
#24 0x0000000808bdd4a6 in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)
    (this=<optimized out>, aState=..., aLineLayout=..., aLine=..., aFloatAvailableSpace=..., aAvailableSpaceBSize=<optimized out>, aFloatStateBeforeLine=<optimized out>, aKeepReflowGoing=<optimized out>, aLineReflowStatus=<optimized out>, aAllowPullUp=<optimized out>) at layout/generic/nsBlockFrame.cpp:4135
#25 0x0000000808bdb2f7 in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)
    (this=<optimized out>, aState=..., aLine=..., aKeepReflowGoing=<optimized out>)
    at layout/generic/nsBlockFrame.cpp:4020
#26 0x0000000808bd96df in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)
    (this=0x7fffffff4ee8, aState=..., aLine=..., aKeepReflowGoing=0x0)
    at layout/generic/nsBlockFrame.cpp:3052
#27 0x0000000808bd70e6 in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) (this=<optimized out>, aState=...)
    at layout/generic/nsBlockFrame.cpp:2594
#28 0x0000000808bd4b20 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=<optimized out>, aPresContext=<optimized out>, aMetrics=..., aReflowInput=..., aStatus=...)
    at layout/generic/nsBlockFrame.cpp:1334
#29 0x0000000808bdcd9f in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)
sAdjacentWithBStart=<optimized out>, aLine=0x813ac0600, aFrameRI=..., aFrameReflowStatus=..., aState=...)
    at layout/generic/nsBlockReflowContext.cpp:297
#30 0x0000000808bda4c1 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)
    (this=<optimized out>, aState=..., aLine=..., aKeepReflowGoing=0x7fffffff9cbf)
    at layout/generic/nsBlockFrame.cpp:3657
#31 0x0000000808bd977a in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)
    (this=0x7fffffff4ee8, aState=..., aLine=..., aKeepReflowGoing=0x0)
    at layout/generic/nsBlockFrame.cpp:3049
#32 0x0000000808bd70e6 in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) (this=<optimized out>, aState=...)
    at layout/generic/nsBlockFrame.cpp:2594
#33 0x0000000808bd4b20 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=<optimized out>, aPresContext=<optimized out>, aMetrics=..., aReflowInput=..., aStatus=...)
    at layout/generic/nsBlockFrame.cpp:1334
#34 0x0000000808bdcd9f in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)
    (this=0x7fffffffa400, aSpace=..., aApplyBStartMargin=<optimized out>, aPrevMargin=..., aClearance=<optimized out>, aIsAdjacentWithBStart=<optimized out>, aLine=0x813ac0998, aFrameRI=..., aFrameReflowStatus=..., aState=...)
    at layout/generic/nsBlockReflowContext.cpp:297
#35 0x0000000808bda4c1 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)
    (this=<optimized out>, aState=..., aLine=..., aKeepReflowGoing=0x7fffffffa53f)
    at layout/generic/nsBlockFrame.cpp:3657
#36 0x0000000808bd977a in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)
    (this=0x7fffffff4ee8, aState=..., aLine=..., aKeepReflowGoing=0x0)
    at layout/generic/nsBlockFrame.cpp:3049
#37 0x0000000808bd70e6 in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) (this=<optimized out>, aState=...)
    at layout/generic/nsBlockFrame.cpp:2594
#38 0x0000000808bd4b20 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=<optimized out>, aPresContext=<optimized out>, aMetrics=..., aReflowInput=..., aStatus=...)
    at layout/generic/nsBlockFrame.cpp:1334
#39 0x0000000808bdcd9f in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)
    (this=0x7fffffffac80, aSpace=..., aApplyBStartMargin=<optimized out>, aPrevMargin=..., aClearance=<optimized out>, aIsAdjacentWithBStart=<optimized out>, aLine=0x813ac0a88, aFrameRI=..., aFrameReflowStatus=..., aState=...)
    at layout/generic/nsBlockReflowContext.cpp:297
#40 0x0000000808bda4c1 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)
    (this=<optimized out>, aState=..., aLine=..., aKeepReflowGoing=0x7fffffffadbf)
    at layout/generic/nsBlockFrame.cpp:3657
#41 0x0000000808bd977a in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)
    (this=0x7fffffff4ee8, aState=..., aLine=..., aKeepReflowGoing=0x0)
    at layout/generic/nsBlockFrame.cpp:3049
#42 0x0000000808bd70e6 in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) (this=<optimized out>, aState=...)
    at layout/generic/nsBlockFrame.cpp:2594
#43 0x0000000808bd4b20 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=<optimized out>, aPresContext=<optimized out>, aMetrics=..., aReflowInput=..., aStatus=...)
    at layout/generic/nsBlockFrame.cpp:1334
#44 0x0000000808bdcd9f in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)
    (this=0x7fffffffb500, aSpace=..., aApplyBStartMargin=<optimized out>, aPrevMargin=..., aClearance=<optimized out>, aIsAdjacentWithBStart=<optimized out>, aLine=0x810e8aed8, aFrameRI=..., aFrameReflowStatus=..., aState=...)
    at layout/generic/nsBlockReflowContext.cpp:297
#45 0x0000000808bda4c1 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)
    (this=<optimized out>, aState=..., aLine=..., aKeepReflowGoing=0x7fffffffb63f)
    at layout/generic/nsBlockFrame.cpp:3657
#46 0x0000000808bd977a in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)
    (this=0x7fffffff4ee8, aState=..., aLine=..., aKeepReflowGoing=0x0)
    at layout/generic/nsBlockFrame.cpp:3049
#47 0x0000000808bd70e6 in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) (this=<optimized out>, aState=...)
    at layout/generic/nsBlockFrame.cpp:2594
#48 0x0000000808bd4b20 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=<optimized out>, aPresContext=<optimized out>, aMetrics=..., aReflowInput=..., aStatus=...)
    at layout/generic/nsBlockFrame.cpp:1334
#49 0x0000000808bdcd9f in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)
    (this=0x7fffffffbd80, aSpace=..., aApplyBStartMargin=<optimized out>, aPrevMargin=..., aClearance=<optimized out>, aIsAdjacentWithBStart=<optimized out>, aLine=0x8111ccb98, aFrameRI=..., aFrameReflowStatus=..., aState=...)
    at layout/generic/nsBlockReflowContext.cpp:297
#50 0x0000000808bda4c1 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)
    (this=<optimized out>, aState=..., aLine=..., aKeepReflowGoing=0x7fffffffbebf)
    at layout/generic/nsBlockFrame.cpp:3657
#51 0x0000000808bd977a in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)
    (this=0x7fffffff4ee8, aState=..., aLine=..., aKeepReflowGoing=0x0)
    at layout/generic/nsBlockFrame.cpp:3049
#52 0x0000000808bd70e6 in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) (this=<optimized out>, aState=...)
    at layout/generic/nsBlockFrame.cpp:2594
#53 0x0000000808bd4b20 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=<optimized out>, aPresContext=<optimized out>, aMetrics=..., aReflowInput=..., aStatus=...)
    at layout/generic/nsBlockFrame.cpp:1334
#54 0x0000000808beabff in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*)
    (this=<optimized out>, aKidFrame=0x8111cca28, aPresContext=0x81445b500, aDesiredSize=..., aReflowInput=..., aWM=..., aPos=..., aContainerSize=..., aFlags=0, aStatus=..., aTracker=0x0)
    at layout/generic/nsContainerFrame.cpp:893
#55 0x0000000808bea519 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=0x8111cc0b8, aPresContext=<optimized out>, aDesiredSize=..., aReflowInput=..., aStatus=...)
    at layout/generic/nsCanvasFrame.cpp:730
#56 0x0000000808beabff in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*)
    (this=<optimized out>, aKidFrame=0x8111cc0b8, aPresContext=0x81445b500, aDesiredSize=..., aReflowInput=..., aWM=..., aPos=..., aContainerSize=..., aFlags=3, aStatus=..., aTracker=0x0)
    at layout/generic/nsContainerFrame.cpp:893
#57 0x0000000808c2bd66 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*)
    (this=0x8111cc188, aState=<optimized out>, aAssumeHScroll=<optimized out>, aAssumeVScroll=<optimized out>, aMetrics=0x7fffffffc8b0) at layout/generic/nsGfxScrollFrame.cpp:562
#58 0x0000000808c2c03c in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&)
    (this=0x8111cc188, aState=0x7fffffffca00, aDesiredSize=...)
    at layout/generic/nsGfxScrollFrame.cpp:675
#59 0x0000000808c2d6fb in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=0x8111cc188, aPresContext=0x81445b500, aDesiredSize=..., aReflowInput=..., aStatus=...)
    at layout/generic/nsGfxScrollFrame.cpp:1076
#60 0x0000000808bcf719 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*)
ized out>, aY=0, aFlags=0, aStatus=..., aTracker=0x0) at layout/generic/nsContainerFrame.cpp:932
#61 0x0000000808bcf2ac in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=0x8111cc020, aPresContext=<optimized out>, aDesiredSize=..., aReflowInput=..., aStatus=...)
    at layout/generic/ViewportFrame.cpp:297
#62 0x0000000808b3c117 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*)
    (this=0x813c9c000, target=0x8111cc020, aInterruptible=false, aOverflowTracker=0x7fffffffcf50)
    at layout/base/PresShell.cpp:9246
#63 0x0000000808b42392 in mozilla::PresShell::ProcessReflowCommands(bool) (this=0x7fffffff4ee8, aInterruptible=false)
    at layout/base/PresShell.cpp:9416
#64 0x0000000808b41fc2 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)
    (this=0x813c9c000, aFlush=...) at layout/base/PresShell.cpp:4227
#65 0x0000000807702e6c in mozilla::PresShell::FlushPendingNotifications(mozilla::ChangesToFlush)
    (this=0x813c9c000, aType=...)
    at obj-x86_64-unknown-freebsd13.0/dist/include/mozilla/PresShell.h:1453
#66 0x0000000807702e6c in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush)
    (this=0x801b18c00, aFlush=...) at dom/base/Document.cpp:7379
#67 0x00000008071b06a1 in nsDocLoader::DocLoaderIsEmpty(bool) (this=0x8141b9b00, aFlushLayout=true)
    at uriloader/base/nsDocLoader.cpp:660
#68 0x00000008071b12c3 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult)
    (this=0x8141b9b00, aRequest=0x80e29a868, aStatus=<optimized out>)
    at uriloader/base/nsDocLoader.cpp:599
#69 0x00000008071b16da in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult) ()
    at obj-x86_64-unknown-freebsd13.0/dist/bin/libxul.so
#70 0x00000008069d936d in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult)
    (this=0x80b369380, request=0x80e29a868, ctxt=<optimized out>, aStatus=nsresult::NS_OK)
    at netwerk/base/nsLoadGroup.cpp:568
#71 0x0000000806c71608 in mozilla::net::HttpChannelChild::DoOnStopRequest(nsIRequest*, nsresult, nsISupports*)
    (this=0x80e29a800, aRequest=0x80e29a868, aChannelStatus=nsresult::NS_OK, aContext=<optimized out>)
    at netwerk/protocol/http/HttpChannelChild.cpp:1282
#72 0x0000000806c74cac in mozilla::net::HttpChannelChild::OnStopRequest(nsresult const&, mozilla::net::ResourceTimingStruct const&, mozilla::net::nsHttpHeaderArray const&)
    (this=0x80e29a800, channelStatus=@0x80b36c510: nsresult::NS_OK, timing=..., aResponseTrailers=...)
    at netwerk/protocol/http/HttpChannelChild.cpp:1142
#73 0x0000000806d2605a in mozilla::net::ChannelEventQueue::FlushQueue() (this=0x8144578c0)
    at netwerk/ipc/ChannelEventQueue.cpp:90
#74 0x0000000806d2c74b in mozilla::net::ChannelEventQueue::MaybeFlushQueue() (this=0x8144578c0)
    at obj-x86_64-unknown-freebsd13.0/dist/include/mozilla/net/ChannelEventQueue.h:314
#75 0x0000000806d2c74b in mozilla::net::ChannelEventQueue::CompleteResume() (this=0x8144578c0)
    at obj-x86_64-unknown-freebsd13.0/dist/include/mozilla/net/ChannelEventQueue.h:293
#76 0x0000000806d2c74b in mozilla::net::ChannelEventQueue::ResumeInternal()::CompleteResumeRunnable::Run()
    (this=<optimized out>) at netwerk/ipc/ChannelEventQueue.cpp:148
#77 0x0000000806937dbd in mozilla::SchedulerGroup::Runnable::Run() (this=0x81300a570)
    at xpcom/threads/SchedulerGroup.cpp:295
#78 0x0000000806945bca in nsThread::ProcessNextEvent(bool, bool*)
    (this=0x801a6e080, aMayWait=<optimized out>, aResult=0x7fffffffd55f)
    at xpcom/threads/nsThread.cpp:1175
#79 0x0000000806947789 in NS_ProcessNextEvent(nsIThread*, bool) (aThread=0x7fffffff4ee8, aMayWait=false)
    at xpcom/threads/nsThreadUtils.cpp:486
#80 0x0000000806dde80a in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)
    (this=0x801a19d20, aDelegate=0x7fffffffd690) at ipc/glue/MessagePump.cpp:88
#81 0x0000000806da9a57 in MessageLoop::RunInternal() (this=0x8140f7b80)
    at ipc/chromium/src/base/message_loop.cc:315
#82 0x0000000806da9a57 in MessageLoop::RunHandler() (this=0x8140f7b80)
    at ipc/chromium/src/base/message_loop.cc:308
#83 0x0000000806da9a57 in MessageLoop::Run() (this=0x8140f7b80)
    at ipc/chromium/src/base/message_loop.cc:290
#84 0x00000008089acb36 in nsBaseAppShell::Run() (this=0x801bf8ca0) at widget/nsBaseAppShell.cpp:137
#85 0x0000000809a5f6a7 in XRE_RunAppShell() () at toolkit/xre/nsEmbedFunctions.cpp:926
#86 0x0000000806da9a57 in MessageLoop::RunInternal() (this=0x8140f7b80)
    at ipc/chromium/src/base/message_loop.cc:315
#87 0x0000000806da9a57 in MessageLoop::RunHandler() (this=0x8140f7b80)
    at ipc/chromium/src/base/message_loop.cc:308
#88 0x0000000806da9a57 in MessageLoop::Run() (this=0x8140f7b80)
    at ipc/chromium/src/base/message_loop.cc:290
#89 0x0000000809a5f55b in XRE_InitChildProcess(int, char**, XREChildData const*)
    (aArgc=<optimized out>, aArgv=<optimized out>, aChildData=<optimized out>)
    at toolkit/xre/nsEmbedFunctions.cpp:764
#90 0x000000000102e482 in content_process_main(mozilla::Bootstrap*, int, char**)
    (bootstrap=0x801a33770, argc=14, argv=0x7fffffffdcf8)
    at browser/app/../../ipc/contentproc/plugin-container.cpp:56
#91 0x000000000102e482 in main(int, char**, char**) (argc=<optimized out>, argv=0x7fffffffdcf8, envp=0x7fffffffdd78)
    at browser/app/nsBrowserApp.cpp:268

Comment 1

[Jessie [:jbonisteel] pls NI]

Lee - can you take a look at this? Appears to be impacting a govt website, so should be treated with high priority (https://www.reddit.com/r/firefox/comments/fz3bnd/1629231_firefox_and_cliqz_tabs_crashing_at_govuk/)

Comment 2

[Jessie [:jbonisteel] pls NI]

Can you attach the contents of about:support as a text file please?

Comment 3

[Jan Beich]

Attachment: about:support (text) from Nightly

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

https://crash-stats.mozilla.org/ doesn't show any text-related crashes with URLs containing gov.uk, so this seems likely to be specific to FreeBSD in some way.

Comment 5

[Jonathan Kew [:jfkthame]]

I suspect freebsd may be configured to treat unaligned accesses a bus error, while other platforms are allowing it (at some perf cost, probably).

Jan, is there any chance you can reproduce this with a non-optimized debug build and get a more precise location for the error? It's probably coming from somewhere deep within layers of harfbuzz header files...

Comment 6

[Jan Beich]

EDIT: Nevermind. I get the idea of trying to get rid of -O or disable inlining under gfx/harfbuzz in a whatever way.

Do you mean --enable-debug? Default local build doesn't contain --enable-optimize or --enable-release (unlike taskcluster builds which pass a lot of additional flags). Also, --enable-debug isn't well supported on FreeBSD due to lack of testing and some runtime checks not ported.

Comment 7

[Jonathan Kew [:jfkthame]]

Building with --enable-debug might be helpful if it works, but if it's broken then I guess we're out of luck.

But in any case, I suspect an explicit --disable-optimize may be helpful in getting more detail, as I think the default is to build with optimization if nothing is specified in the mozconfig. Thanks!

Comment 8

[Graham Perrin]

(In reply to David Baron :dbaron: 🏴󠁵󠁳󠁣󠁡󠁿 ⌚UTC-8 from comment #4)

… likely to be specific to FreeBSD in some way.

Thanks, https://new.reddit.com/r/firefox/comments/fz3bnd/-/ invites users to make the issue reproducible on other platforms.

So far, no-one has done so. For what it's worth, I can not reproduce the issue on Windows 10 (in a VirtualBox guest) and https://www.reddit.com/r/firefox/comments/fz3bnd/-/fn3osfq/?context=1 I can't reproduce the issue on Linux (in the same guest).

The Reddit post includes screenshots of how texts typically appear wrong when crashing does not occur.

Cliqz browser on the same system (FreeBSD-CURRENT) crashes tabs, and has problems with the texts, in much the same way.

Comment 9

[Jan Beich]

--enable-debug + --disable-optimize still crashes but (like ESR68 in comment 0) not in harfbuzz.

Process 98709 stopped
* thread #1, name = 'Web Content', stop reason = signal SIGSEGV: invalid address (fault address: 0x68)
    frame #0: 0x000000080ecb3b09 libxul.so`gfxFont::GetMetrics(this=0x00000008215bf600, aOrientation=eHorizontal) at gfxFont.h:1554:14
   1551
   1552   const Metrics& GetMetrics(Orientation aOrientation) {
   1553     if (aOrientation == nsFontMetrics::eHorizontal) {
-> 1554       return GetHorizontalMetrics();
   1555     }
   1556     if (!mVerticalMetrics) {
   1557       mVerticalMetrics = CreateVerticalMetrics();
(lldb) bt
* thread #1, name = 'Web Content', stop reason = signal SIGSEGV: invalid address (fault address: 0x68)
  * frame #0: 0x000000080ecb3b09 libxul.so`gfxFont::GetMetrics(this=0x00000008215bf600, aOrientation=eHorizontal) at gfxFont.h:1554:14
    frame #1: 0x000000080ec958f4 libxul.so`GetMetrics(aFontMetrics=0x000000082540c6c0, aOrientation=eHorizontal) at nsFontMetrics.cpp:154:67
    frame #2: 0x000000080ec9515b libxul.so`GetMetrics(aFontMetrics=0x000000082540c6c0) at nsFontMetrics.cpp:159:10
    frame #3: 0x000000080ec9573c libxul.so`nsFontMetrics::MaxAscent(this=0x000000082540c6c0) at nsFontMetrics.cpp:233:10
    frame #4: 0x000000081339d670 libxul.so`nsLayoutUtils::GetCenteredFontBaseline(aFontMetrics=0x000000082540c6c0, aLineHeight=1440, aIsInverted=false) at nsLayoutUtils.cpp:6279:64
    frame #5: 0x00000008135ff735 libxul.so`nsLineLayout::VerticalAlignFrames(this=0x00007ffffffdc918, psd=0x0000000827330820) at nsLineLayout.cpp:2286:31
    frame #6: 0x0000000813600977 libxul.so`nsLineLayout::VerticalAlignLine(this=0x00007ffffffdc918) at nsLineLayout.cpp:1508:3
    frame #7: 0x0000000813466345 libxul.so`nsBlockFrame::PlaceLine(this=0x0000000821400370, aState=0x00007ffffffdd900, aLineLayout=0x00007ffffffdc918, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffdc4a8, aFloatStateBeforeLine=0x00007ffffffdc8d0, aFlowArea=0x00007ffffffdc8f0, aAvailableSpaceBSize=0x00007ffffffdc8e8, aKeepReflowGoing=0x00007ffffffdcfe7) at nsBlockFrame.cpp:4822:15
    frame #8: 0x00000008134656ce libxul.so`nsBlockFrame::DoReflowInlineFrames(this=0x0000000821400370, aState=0x00007ffffffdd900, aLineLayout=0x00007ffffffdc918, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffdc800, aFloatAvailableSpace=0x00007ffffffdc8f0, aAvailableSpaceBSize=0x00007ffffffdc8e8, aFloatStateBeforeLine=0x00007ffffffdc8d0, aKeepReflowGoing=0x00007ffffffdcfe7, aLineReflowStatus=0x00007ffffffdc8ec, aAllowPullUp=true) at nsBlockFrame.cpp:4415:12
    frame #9: 0x0000000813460ed9 libxul.so`nsBlockFrame::ReflowInlineFrames(this=0x0000000821400370, aState=0x00007ffffffdd900, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffdc908, aKeepReflowGoing=0x00007ffffffdcfe7) at nsBlockFrame.cpp:4173:9
    frame #10: 0x000000081345c5fd libxul.so`nsBlockFrame::ReflowLine(this=0x0000000821400370, aState=0x00007ffffffdd900, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffdcaf8, aKeepReflowGoing=0x00007ffffffdcfe7) at nsBlockFrame.cpp:3154:5
    frame #11: 0x0000000813456870 libxul.so`nsBlockFrame::ReflowDirtyLines(this=0x0000000821400370, aState=0x00007ffffffdd900) at nsBlockFrame.cpp:2690:7
    frame #12: 0x00000008134521f4 libxul.so`nsBlockFrame::Reflow(this=0x0000000821400370, aPresContext=0x000000081e19d000, aMetrics=0x00007ffffffddfa8, aReflowInput=0x00007ffffffddea0, aStatus=0x00007ffffffde4b0) at nsBlockFrame.cpp:1402:3
    frame #13: 0x000000081347f460 libxul.so`nsContainerFrame::ReflowChild(this=0x00000008214002b0, aKidFrame=0x0000000821400370, aPresContext=0x000000081e19d000, aDesiredSize=0x00007ffffffddfa8, aReflowInput=0x00007ffffffddea0, aWM=0x00007ffffffdde58, aPos=0x00007ffffffddd40, aContainerSize=0x00007ffffffddd50, aFlags=Default, aStatus=0x00007ffffffde4b0, aTracker=0x0000000000000000) at nsContainerFrame.cpp:906:14
    frame #14: 0x00000008136b9f30 libxul.so`nsTableCellFrame::Reflow(this=0x00000008214002b0, aPresContext=0x000000081e19d000, aDesiredSize=0x00007ffffffde7e8, aReflowInput=0x00007ffffffde5c0, aStatus=0x00007ffffffde4b0) at nsTableCellFrame.cpp:889:3
    frame #15: 0x000000081347f460 libxul.so`nsContainerFrame::ReflowChild(this=0x00000008214001f0, aKidFrame=0x00000008214002b0, aPresContext=0x000000081e19d000, aDesiredSize=0x00007ffffffde7e8, aReflowInput=0x00007ffffffde5c0, aWM=0x00007ffffffde500, aPos=0x00007ffffffde510, aContainerSize=0x00007ffffffde5a8, aFlags=Default, aStatus=0x00007ffffffde4b0, aTracker=0x0000000000000000) at nsContainerFrame.cpp:906:14
    frame #16: 0x00000008136e17ad libxul.so`nsTableRowFrame::ReflowChildren(this=0x00000008214001f0, aPresContext=0x000000081e19d000, aDesiredSize=0x00007ffffffdedd0, aReflowInput=0x00007ffffffdecd0, aTableFrame=0x0000000821400020, aStatus=0x00007ffffffe09d0) at nsTableRowFrame.cpp:815:9
    frame #17: 0x00000008136e2cce libxul.so`nsTableRowFrame::Reflow(this=0x00000008214001f0, aPresContext=0x000000081e19d000, aDesiredSize=0x00007ffffffdedd0, aReflowInput=0x00007ffffffdecd0, aStatus=0x00007ffffffe09d0) at nsTableRowFrame.cpp:1017:3
    frame #18: 0x000000081347f460 libxul.so`nsContainerFrame::ReflowChild(this=0x0000000821400148, aKidFrame=0x00000008214001f0, aPresContext=0x000000081e19d000, aDesiredSize=0x00007ffffffdedd0, aReflowInput=0x00007ffffffdecd0, aWM=0x00007ffffffdecb8, aPos=0x00007ffffffdec38, aContainerSize=0x00007ffffffdeca8, aFlags=Default, aStatus=0x00007ffffffe09d0, aTracker=0x0000000000000000) at nsContainerFrame.cpp:906:14
    frame #19: 0x00000008136e6349 libxul.so`nsTableRowGroupFrame::ReflowChildren(this=0x0000000821400148, aPresContext=0x000000081e19d000, aDesiredSize=0x00007ffffffdf458, aReflowInput=0x00007ffffffdeee0, aStatus=0x00007ffffffe09d0, aPageBreakBeforeEnd=0x00007ffffffdeedf) at nsTableRowGroupFrame.cpp:408:7
    frame #20: 0x00000008136eaa1d libxul.so`nsTableRowGroupFrame::Reflow(this=0x0000000821400148, aPresContext=0x000000081e19d000, aDesiredSize=0x00007ffffffdf458, aReflowInput=0x00007ffffffdf358, aStatus=0x00007ffffffe09d0) at nsTableRowGroupFrame.cpp:1389:3
    frame #21: 0x000000081347f460 libxul.so`nsContainerFrame::ReflowChild(this=0x0000000821400020, aKidFrame=0x0000000821400148, aPresContext=0x000000081e19d000, aDesiredSize=0x00007ffffffdf458, aReflowInput=0x00007ffffffdf358, aWM=0x00007ffffffdf340, aPos=0x00007ffffffdf298, aContainerSize=0x00007ffffffdf338, aFlags=Default, aStatus=0x00007ffffffe09d0, aTracker=0x0000000000000000) at nsContainerFrame.cpp:906:14
    frame #22: 0x00000008136cbddb libxul.so`nsTableFrame::ReflowChildren(this=0x0000000821400020, aReflowInput=0x00007ffffffdf5a8, aStatus=0x00007ffffffe09d0, aLastChildReflowed=0x00007ffffffdf820, aOverflowAreas=0x00007ffffffe02d4) at nsTableFrame.cpp:2969:7
    frame #23: 0x00000008136c9f9d libxul.so`nsTableFrame::ReflowTable(this=0x0000000821400020, aDesiredSize=0x00007ffffffe02b8, aReflowInput=0x00007ffffffe00a8, aAvailBSize=1073741823, aLastChildReflowed=0x00007ffffffdf820, aStatus=0x00007ffffffe09d0) at nsTableFrame.cpp:2033:3
    frame #24: 0x00000008136c93fd libxul.so`nsTableFrame::Reflow(this=0x0000000821400020, aPresContext=0x000000081e19d000, aDesiredSize=0x00007ffffffe02b8, aReflowInput=0x00007ffffffe00a8, aStatus=0x00007ffffffe09d0) at nsTableFrame.cpp:1819:5
    frame #25: 0x000000081347f460 libxul.so`nsContainerFrame::ReflowChild(this=0x000000082155de70, aKidFrame=0x0000000821400020, aPresContext=0x000000081e19d000, aDesiredSize=0x00007ffffffe02b8, aReflowInput=0x00007ffffffe00a8, aWM=0x00007ffffffdfa38, aPos=0x00007ffffffdfa28, aContainerSize=0x00007ffffffdfa40, aFlags=11, aStatus=0x00007ffffffe09d0, aTracker=0x0000000000000000) at nsContainerFrame.cpp:906:14
    frame #26: 0x00000008136f17ac libxul.so`nsTableWrapperFrame::OuterDoReflowChild(this=0x000000082155de70, aPresContext=0x000000081e19d000, aChildFrame=0x0000000821400020, aChildRI=0x00007ffffffe00a8, aMetrics=0x00007ffffffe02b8, aStatus=0x00007ffffffe09d0) at nsTableWrapperFrame.cpp:784:3
    frame #27: 0x00000008136f2ad1 libxul.so`nsTableWrapperFrame::Reflow(this=0x000000082155de70, aPresContext=0x000000081e19d000, aDesiredSize=0x00007ffffffe0df8, aOuterRI=0x00007ffffffe0b80, aStatus=0x00007ffffffe09d0) at nsTableWrapperFrame.cpp:938:3
    frame #28: 0x0000000813463be0 libxul.so`nsBlockReflowContext::ReflowBlock(this=0x00007ffffffe0db8, aSpace=0x00007ffffffe0ad8, aApplyBStartMargin=false, aPrevMargin=0x00007ffffffe1e10, aClearance=0, aIsAdjacentWithBStart=true, aLine=0x0000000821401018, aFrameRI=0x00007ffffffe0b80, aFrameReflowStatus=0x00007ffffffe09d0, aState=0x00007ffffffe1d40) at nsBlockReflowContext.cpp:293:11
    frame #29: 0x000000081345f885 libxul.so`nsBlockFrame::ReflowBlockFrame(this=0x000000082155db80, aState=0x00007ffffffe1d40, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffe0b60, aKeepReflowGoing=0x00007ffffffe1427) at nsBlockFrame.cpp:3804:11
    frame #30: 0x000000081345c5b3 libxul.so`nsBlockFrame::ReflowLine(this=0x000000082155db80, aState=0x00007ffffffe1d40, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffe0f38, aKeepReflowGoing=0x00007ffffffe1427) at nsBlockFrame.cpp:3151:5
    frame #31: 0x0000000813456870 libxul.so`nsBlockFrame::ReflowDirtyLines(this=0x000000082155db80, aState=0x00007ffffffe1d40) at nsBlockFrame.cpp:2690:7
    frame #32: 0x00000008134521f4 libxul.so`nsBlockFrame::Reflow(this=0x000000082155db80, aPresContext=0x000000081e19d000, aMetrics=0x00007ffffffe28f8, aReflowInput=0x00007ffffffe2680, aStatus=0x00007ffffffe24d0) at nsBlockFrame.cpp:1402:3
    frame #33: 0x0000000813463be0 libxul.so`nsBlockReflowContext::ReflowBlock(this=0x00007ffffffe28b8, aSpace=0x00007ffffffe25d8, aApplyBStartMargin=false, aPrevMargin=0x00007ffffffe3910, aClearance=0, aIsAdjacentWithBStart=true, aLine=0x0000000821401068, aFrameRI=0x00007ffffffe2680, aFrameReflowStatus=0x00007ffffffe24d0, aState=0x00007ffffffe3840) at nsBlockReflowContext.cpp:293:11
    frame #34: 0x000000081345f885 libxul.so`nsBlockFrame::ReflowBlockFrame(this=0x000000082155dac0, aState=0x00007ffffffe3840, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffe2660, aKeepReflowGoing=0x00007ffffffe2f27) at nsBlockFrame.cpp:3804:11
    frame #35: 0x000000081345c5b3 libxul.so`nsBlockFrame::ReflowLine(this=0x000000082155dac0, aState=0x00007ffffffe3840, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffe2a38, aKeepReflowGoing=0x00007ffffffe2f27) at nsBlockFrame.cpp:3151:5
    frame #36: 0x0000000813456870 libxul.so`nsBlockFrame::ReflowDirtyLines(this=0x000000082155dac0, aState=0x00007ffffffe3840) at nsBlockFrame.cpp:2690:7
    frame #37: 0x00000008134521f4 libxul.so`nsBlockFrame::Reflow(this=0x000000082155dac0, aPresContext=0x000000081e19d000, aMetrics=0x00007ffffffe43f8, aReflowInput=0x00007ffffffe4180, aStatus=0x00007ffffffe3fd0) at nsBlockFrame.cpp:1402:3
    frame #38: 0x0000000813463be0 libxul.so`nsBlockReflowContext::ReflowBlock(this=0x00007ffffffe43b8, aSpace=0x00007ffffffe40d8, aApplyBStartMargin=true, aPrevMargin=0x00007ffffffe5410, aClearance=0, aIsAdjacentWithBStart=false, aLine=0x00000008214011a8, aFrameRI=0x00007ffffffe4180, aFrameReflowStatus=0x00007ffffffe3fd0, aState=0x00007ffffffe5340) at nsBlockReflowContext.cpp:293:11
    frame #39: 0x000000081345f885 libxul.so`nsBlockFrame::ReflowBlockFrame(this=0x000000082155d470, aState=0x00007ffffffe5340, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffe4160, aKeepReflowGoing=0x00007ffffffe4a27) at nsBlockFrame.cpp:3804:11
    frame #40: 0x000000081345c5b3 libxul.so`nsBlockFrame::ReflowLine(this=0x000000082155d470, aState=0x00007ffffffe5340, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffe4538, aKeepReflowGoing=0x00007ffffffe4a27) at nsBlockFrame.cpp:3151:5
    frame #41: 0x0000000813456870 libxul.so`nsBlockFrame::ReflowDirtyLines(this=0x000000082155d470, aState=0x00007ffffffe5340) at nsBlockFrame.cpp:2690:7
    frame #42: 0x00000008134521f4 libxul.so`nsBlockFrame::Reflow(this=0x000000082155d470, aPresContext=0x000000081e19d000, aMetrics=0x00007ffffffe5a10, aReflowInput=0x00007ffffffe58d0, aStatus=0x00007ffffffe5ec0) at nsBlockFrame.cpp:1402:3
    frame #43: 0x0000000813463be0 libxul.so`nsBlockReflowContext::ReflowBlock(this=0x00007ffffffe59d0, aSpace=0x00007ffffffe5f18, aApplyBStartMargin=true, aPrevMargin=0x00007ffffffe5850, aClearance=0, aIsAdjacentWithBStart=true, aLine=0x0000000000000000, aFrameRI=0x00007ffffffe58d0, aFrameReflowStatus=0x00007ffffffe5ec0, aState=0x00007ffffffe7b50) at nsBlockReflowContext.cpp:293:11
    frame #44: 0x000000081346e6e1 libxul.so`nsBlockFrame::ReflowFloat(this=0x000000082155d3b0, aState=0x00007ffffffe7b50, aAdjustedAvailableSpace=0x00007ffffffe5f18, aFloat=0x000000082155d470, aFloatMargin=0x00007ffffffe5ef0, aFloatOffsets=0x00007ffffffe5ed0, aFloatPushedDown=false, aReflowStatus=0x00007ffffffe5ec0) at nsBlockFrame.cpp:6608:9
    frame #45: 0x000000081341860a libxul.so`mozilla::BlockReflowInput::FlowAndPlaceFloat(this=0x00007ffffffe7b50, aFloat=0x000000082155d470) at BlockReflowInput.cpp:875:13
    frame #46: 0x00000008134174a4 libxul.so`mozilla::BlockReflowInput::AddFloat(this=0x00007ffffffe7b50, aLineLayout=0x00007ffffffe6b68, aFloat=0x000000082155d470, aAvailableISize=59400) at BlockReflowInput.cpp:559:14
    frame #47: 0x000000081364b543 libxul.so`nsLineLayout::AddFloat(this=0x00007ffffffe6b68, aFloat=0x000000082155d470, aAvailableISize=59400) at nsLineLayout.h:156:22
    frame #48: 0x00000008135fd14e libxul.so`nsLineLayout::TryToPlaceFloat(this=0x00007ffffffe6b68, aFloat=0x000000082155d470) at nsLineLayout.cpp:1473:36
    frame #49: 0x00000008135f9333 libxul.so`nsLineLayout::ReflowFrame(this=0x00007ffffffe6b68, aFrame=0x000000082155d530, aReflowStatus=0x00007ffffffe67a0, aMetrics=0x0000000000000000, aPushedFrame=0x00007ffffffe679f) at nsLineLayout.cpp:922:25
    frame #50: 0x0000000813465b35 libxul.so`nsBlockFrame::ReflowInlineFrame(this=0x000000082155d3b0, aState=0x00007ffffffe7b50, aLineLayout=0x00007ffffffe6b68, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffe67a8, aFrame=0x000000082155d530, aLineReflowStatus=0x00007ffffffe69ec) at nsBlockFrame.cpp:4486:15
    frame #51: 0x0000000813464fb2 libxul.so`nsBlockFrame::DoReflowInlineFrames(this=0x000000082155d3b0, aState=0x00007ffffffe7b50, aLineLayout=0x00007ffffffe6b68, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffe6a50, aFloatAvailableSpace=0x00007ffffffe6b40, aAvailableSpaceBSize=0x00007ffffffe6b38, aFloatStateBeforeLine=0x00007ffffffe6b20, aKeepReflowGoing=0x00007ffffffe7237, aLineReflowStatus=0x00007ffffffe6b3c, aAllowPullUp=true) at nsBlockFrame.cpp:4288:5
    frame #52: 0x0000000813460ed9 libxul.so`nsBlockFrame::ReflowInlineFrames(this=0x000000082155d3b0, aState=0x00007ffffffe7b50, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffe6b58, aKeepReflowGoing=0x00007ffffffe7237) at nsBlockFrame.cpp:4173:9
    frame #53: 0x000000081345c5fd libxul.so`nsBlockFrame::ReflowLine(this=0x000000082155d3b0, aState=0x00007ffffffe7b50, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffe6d48, aKeepReflowGoing=0x00007ffffffe7237) at nsBlockFrame.cpp:3154:5
    frame #54: 0x0000000813456870 libxul.so`nsBlockFrame::ReflowDirtyLines(this=0x000000082155d3b0, aState=0x00007ffffffe7b50) at nsBlockFrame.cpp:2690:7
    frame #55: 0x00000008134521f4 libxul.so`nsBlockFrame::Reflow(this=0x000000082155d3b0, aPresContext=0x000000081e19d000, aMetrics=0x00007ffffffe8708, aReflowInput=0x00007ffffffe8490, aStatus=0x00007ffffffe82e0) at nsBlockFrame.cpp:1402:3
    frame #56: 0x0000000813463be0 libxul.so`nsBlockReflowContext::ReflowBlock(this=0x00007ffffffe86c8, aSpace=0x00007ffffffe83e8, aApplyBStartMargin=false, aPrevMargin=0x00007ffffffe9720, aClearance=0, aIsAdjacentWithBStart=true, aLine=0x0000000821603b60, aFrameRI=0x00007ffffffe8490, aFrameReflowStatus=0x00007ffffffe82e0, aState=0x00007ffffffe9650) at nsBlockReflowContext.cpp:293:11
    frame #57: 0x000000081345f885 libxul.so`nsBlockFrame::ReflowBlockFrame(this=0x000000082155d2f0, aState=0x00007ffffffe9650, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffe8470, aKeepReflowGoing=0x00007ffffffe8d37) at nsBlockFrame.cpp:3804:11
    frame #58: 0x000000081345c5b3 libxul.so`nsBlockFrame::ReflowLine(this=0x000000082155d2f0, aState=0x00007ffffffe9650, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffe8848, aKeepReflowGoing=0x00007ffffffe8d37) at nsBlockFrame.cpp:3151:5
    frame #59: 0x0000000813456870 libxul.so`nsBlockFrame::ReflowDirtyLines(this=0x000000082155d2f0, aState=0x00007ffffffe9650) at nsBlockFrame.cpp:2690:7
    frame #60: 0x00000008134521f4 libxul.so`nsBlockFrame::Reflow(this=0x000000082155d2f0, aPresContext=0x000000081e19d000, aMetrics=0x00007ffffffea208, aReflowInput=0x00007ffffffe9f90, aStatus=0x00007ffffffe9de0) at nsBlockFrame.cpp:1402:3
    frame #61: 0x0000000813463be0 libxul.so`nsBlockReflowContext::ReflowBlock(this=0x00007ffffffea1c8, aSpace=0x00007ffffffe9ee8, aApplyBStartMargin=true, aPrevMargin=0x00007ffffffeb220, aClearance=0, aIsAdjacentWithBStart=true, aLine=0x0000000821603bb0, aFrameRI=0x00007ffffffe9f90, aFrameReflowStatus=0x00007ffffffe9de0, aState=0x00007ffffffeb150) at nsBlockReflowContext.cpp:293:11
    frame #62: 0x000000081345f885 libxul.so`nsBlockFrame::ReflowBlockFrame(this=0x000000082155d230, aState=0x00007ffffffeb150, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffe9f70, aKeepReflowGoing=0x00007ffffffea837) at nsBlockFrame.cpp:3804:11
    frame #63: 0x000000081345c5b3 libxul.so`nsBlockFrame::ReflowLine(this=0x000000082155d230, aState=0x00007ffffffeb150, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffea348, aKeepReflowGoing=0x00007ffffffea837) at nsBlockFrame.cpp:3151:5
    frame #64: 0x0000000813456870 libxul.so`nsBlockFrame::ReflowDirtyLines(this=0x000000082155d230, aState=0x00007ffffffeb150) at nsBlockFrame.cpp:2690:7
    frame #65: 0x00000008134521f4 libxul.so`nsBlockFrame::Reflow(this=0x000000082155d230, aPresContext=0x000000081e19d000, aMetrics=0x00007ffffffeb838, aReflowInput=0x00007ffffffeb640, aStatus=0x00007ffffffeb548) at nsBlockFrame.cpp:1402:3
    frame #66: 0x000000081347f460 libxul.so`nsContainerFrame::ReflowChild(this=0x000000082155cfe0, aKidFrame=0x000000082155d230, aPresContext=0x000000081e19d000, aDesiredSize=0x00007ffffffeb838, aReflowInput=0x00007ffffffeb640, aWM=0x00007ffffffeb618, aPos=0x00007ffffffeb530, aContainerSize=0x00007ffffffeb540, aFlags=NoMoveFrame, aStatus=0x00007ffffffeb548, aTracker=0x0000000000000000) at nsContainerFrame.cpp:906:14
    frame #67: 0x000000081352a80f libxul.so`nsHTMLScrollFrame::ReflowScrolledFrame(this=0x000000082155cfe0, aState=0x00007ffffffeba48, aAssumeHScroll=false, aAssumeVScroll=false, aMetrics=0x00007ffffffeb838) at nsGfxScrollFrame.cpp:654:3
    frame #68: 0x000000081352b325 libxul.so`nsHTMLScrollFrame::ReflowContents(this=0x000000082155cfe0, aState=0x00007ffffffeba48, aDesiredSize=0x00007ffffffec548) at nsGfxScrollFrame.cpp:768:3
    frame #69: 0x000000081352d5b7 libxul.so`nsHTMLScrollFrame::Reflow(this=0x000000082155cfe0, aPresContext=0x000000081e19d000, aDesiredSize=0x00007ffffffec548, aReflowInput=0x00007ffffffec2d0, aStatus=0x00007ffffffec120) at nsGfxScrollFrame.cpp:1155:3
    frame #70: 0x0000000813463be0 libxul.so`nsBlockReflowContext::ReflowBlock(this=0x00007ffffffec508, aSpace=0x00007ffffffec228, aApplyBStartMargin=false, aPrevMargin=0x00007ffffffed560, aClearance=0, aIsAdjacentWithBStart=true, aLine=0x000000082163ad40, aFrameRI=0x00007ffffffec2d0, aFrameReflowStatus=0x00007ffffffec120, aState=0x00007ffffffed490) at nsBlockReflowContext.cpp:293:11
    frame #71: 0x000000081345f885 libxul.so`nsBlockFrame::ReflowBlockFrame(this=0x000000082155cf20, aState=0x00007ffffffed490, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffec2b0, aKeepReflowGoing=0x00007ffffffecb77) at nsBlockFrame.cpp:3804:11
    frame #72: 0x000000081345c5b3 libxul.so`nsBlockFrame::ReflowLine(this=0x000000082155cf20, aState=0x00007ffffffed490, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffec688, aKeepReflowGoing=0x00007ffffffecb77) at nsBlockFrame.cpp:3151:5
    frame #73: 0x0000000813456870 libxul.so`nsBlockFrame::ReflowDirtyLines(this=0x000000082155cf20, aState=0x00007ffffffed490) at nsBlockFrame.cpp:2690:7
    frame #74: 0x00000008134521f4 libxul.so`nsBlockFrame::Reflow(this=0x000000082155cf20, aPresContext=0x000000081e19d000, aMetrics=0x00007ffffffee048, aReflowInput=0x00007ffffffeddd0, aStatus=0x00007ffffffedc20) at nsBlockFrame.cpp:1402:3
    frame #75: 0x0000000813463be0 libxul.so`nsBlockReflowContext::ReflowBlock(this=0x00007ffffffee008, aSpace=0x00007ffffffedd28, aApplyBStartMargin=false, aPrevMargin=0x00007ffffffef060, aClearance=0, aIsAdjacentWithBStart=true, aLine=0x0000000825667660, aFrameRI=0x00007ffffffeddd0, aFrameReflowStatus=0x00007ffffffedc20, aState=0x00007ffffffeef90) at nsBlockReflowContext.cpp:293:11
    frame #76: 0x000000081345f885 libxul.so`nsBlockFrame::ReflowBlockFrame(this=0x000000082155ce60, aState=0x00007ffffffeef90, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffeddb0, aKeepReflowGoing=0x00007ffffffee677) at nsBlockFrame.cpp:3804:11
    frame #77: 0x000000081345c5b3 libxul.so`nsBlockFrame::ReflowLine(this=0x000000082155ce60, aState=0x00007ffffffeef90, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffee188, aKeepReflowGoing=0x00007ffffffee677) at nsBlockFrame.cpp:3151:5
    frame #78: 0x0000000813456870 libxul.so`nsBlockFrame::ReflowDirtyLines(this=0x000000082155ce60, aState=0x00007ffffffeef90) at nsBlockFrame.cpp:2690:7
    frame #79: 0x00000008134521f4 libxul.so`nsBlockFrame::Reflow(this=0x000000082155ce60, aPresContext=0x000000081e19d000, aMetrics=0x00007ffffffefb48, aReflowInput=0x00007ffffffef8d0, aStatus=0x00007ffffffef720) at nsBlockFrame.cpp:1402:3
    frame #80: 0x0000000813463be0 libxul.so`nsBlockReflowContext::ReflowBlock(this=0x00007ffffffefb08, aSpace=0x00007ffffffef828, aApplyBStartMargin=true, aPrevMargin=0x00007fffffff0b60, aClearance=0, aIsAdjacentWithBStart=false, aLine=0x0000000825674930, aFrameRI=0x00007ffffffef8d0, aFrameReflowStatus=0x00007ffffffef720, aState=0x00007fffffff0a90) at nsBlockReflowContext.cpp:293:11
    frame #81: 0x000000081345f885 libxul.so`nsBlockFrame::ReflowBlockFrame(this=0x0000000821470b40, aState=0x00007fffffff0a90, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffef8b0, aKeepReflowGoing=0x00007fffffff0177) at nsBlockFrame.cpp:3804:11
    frame #82: 0x000000081345c5b3 libxul.so`nsBlockFrame::ReflowLine(this=0x0000000821470b40, aState=0x00007fffffff0a90, aLine=nsBlockFrame::LineIterator @ 0x00007ffffffefc88, aKeepReflowGoing=0x00007fffffff0177) at nsBlockFrame.cpp:3151:5
    frame #83: 0x0000000813456870 libxul.so`nsBlockFrame::ReflowDirtyLines(this=0x0000000821470b40, aState=0x00007fffffff0a90) at nsBlockFrame.cpp:2690:7
    frame #84: 0x00000008134521f4 libxul.so`nsBlockFrame::Reflow(this=0x0000000821470b40, aPresContext=0x000000081e19d000, aMetrics=0x00007fffffff1648, aReflowInput=0x00007fffffff13d0, aStatus=0x00007fffffff1220) at nsBlockFrame.cpp:1402:3
    frame #85: 0x0000000813463be0 libxul.so`nsBlockReflowContext::ReflowBlock(this=0x00007fffffff1608, aSpace=0x00007fffffff1328, aApplyBStartMargin=true, aPrevMargin=0x00007fffffff2660, aClearance=0, aIsAdjacentWithBStart=true, aLine=0x0000000821470c00, aFrameRI=0x00007fffffff13d0, aFrameReflowStatus=0x00007fffffff1220, aState=0x00007fffffff2590) at nsBlockReflowContext.cpp:293:11
    frame #86: 0x000000081345f885 libxul.so`nsBlockFrame::ReflowBlockFrame(this=0x0000000821470a80, aState=0x00007fffffff2590, aLine=nsBlockFrame::LineIterator @ 0x00007fffffff13b0, aKeepReflowGoing=0x00007fffffff1c77) at nsBlockFrame.cpp:3804:11
    frame #87: 0x000000081345c5b3 libxul.so`nsBlockFrame::ReflowLine(this=0x0000000821470a80, aState=0x00007fffffff2590, aLine=nsBlockFrame::LineIterator @ 0x00007fffffff1788, aKeepReflowGoing=0x00007fffffff1c77) at nsBlockFrame.cpp:3151:5
    frame #88: 0x0000000813456870 libxul.so`nsBlockFrame::ReflowDirtyLines(this=0x0000000821470a80, aState=0x00007fffffff2590) at nsBlockFrame.cpp:2690:7
    frame #89: 0x00000008134521f4 libxul.so`nsBlockFrame::Reflow(this=0x0000000821470a80, aPresContext=0x000000081e19d000, aMetrics=0x00007fffffff2da8, aReflowInput=0x00007fffffff2c30, aStatus=0x00007fffffff30c8) at nsBlockFrame.cpp:1402:3
    frame #90: 0x000000081347f460 libxul.so`nsContainerFrame::ReflowChild(this=0x00000008214700c0, aKidFrame=0x0000000821470a80, aPresContext=0x000000081e19d000, aDesiredSize=0x00007fffffff2da8, aReflowInput=0x00007fffffff2c30, aWM=0x00007fffffff2a80, aPos=0x00007fffffff2a50, aContainerSize=0x00007fffffff2a78, aFlags=Default, aStatus=0x00007fffffff30c8, aTracker=0x0000000000000000) at nsContainerFrame.cpp:906:14
    frame #91: 0x000000081347e582 libxul.so`nsCanvasFrame::Reflow(this=0x00000008214700c0, aPresContext=0x000000081e19d000, aDesiredSize=0x00007fffffff33b8, aReflowInput=0x00007fffffff31c0, aStatus=0x00007fffffff30c8) at nsCanvasFrame.cpp:750:5
    frame #92: 0x000000081347f460 libxul.so`nsContainerFrame::ReflowChild(this=0x0000000821470198, aKidFrame=0x00000008214700c0, aPresContext=0x000000081e19d000, aDesiredSize=0x00007fffffff33b8, aReflowInput=0x00007fffffff31c0, aWM=0x00007fffffff3198, aPos=0x00007fffffff30b0, aContainerSize=0x00007fffffff30c0, aFlags=NoMoveFrame, aStatus=0x00007fffffff30c8, aTracker=0x0000000000000000) at nsContainerFrame.cpp:906:14
    frame #93: 0x000000081352a80f libxul.so`nsHTMLScrollFrame::ReflowScrolledFrame(this=0x0000000821470198, aState=0x00007fffffff35c8, aAssumeHScroll=false, aAssumeVScroll=true, aMetrics=0x00007fffffff33b8) at nsGfxScrollFrame.cpp:654:3
    frame #94: 0x000000081352b325 libxul.so`nsHTMLScrollFrame::ReflowContents(this=0x0000000821470198, aState=0x00007fffffff35c8, aDesiredSize=0x00007fffffff3b60) at nsGfxScrollFrame.cpp:768:3
    frame #95: 0x000000081352d5b7 libxul.so`nsHTMLScrollFrame::Reflow(this=0x0000000821470198, aPresContext=0x000000081e19d000, aDesiredSize=0x00007fffffff3b60, aReflowInput=0x00007fffffff3a60, aStatus=0x00007fffffff3dd0) at nsGfxScrollFrame.cpp:1155:3
    frame #96: 0x000000081344775a libxul.so`nsContainerFrame::ReflowChild(this=0x0000000821470020, aKidFrame=0x0000000821470198, aPresContext=0x000000081e19d000, aDesiredSize=0x00007fffffff3b60, aReflowInput=0x00007fffffff3a60, aX=0, aY=0, aFlags=Default, aStatus=0x00007fffffff3dd0, aTracker=0x0000000000000000) at nsContainerFrame.cpp:946:14
    frame #97: 0x0000000813446ff9 libxul.so`mozilla::ViewportFrame::Reflow(this=0x0000000821470020, aPresContext=0x000000081e19d000, aDesiredSize=0x00007fffffff40c8, aReflowInput=0x00007fffffff3fa8, aStatus=0x00007fffffff3dd0) at ViewportFrame.cpp:299:7
    frame #98: 0x00000008132d012b libxul.so`mozilla::PresShell::DoReflow(this=0x000000081fbf6800, target=0x0000000821470020, aInterruptible=true, aOverflowTracker=0x00007fffffff41d0) at PresShell.cpp:9363:11
    frame #99: 0x00000008132da5bb libxul.so`mozilla::PresShell::ProcessReflowCommands(this=0x000000081fbf6800, aInterruptible=true) at PresShell.cpp:9536:24
    frame #100: 0x00000008132d9f32 libxul.so`mozilla::PresShell::DoFlushPendingNotifications(this=0x000000081fbf6800, aFlush=(mFlushType = InterruptibleLayout, mFlushAnimations = true)) at PresShell.cpp:4221:11
    frame #101: 0x000000080f6195b4 libxul.so`mozilla::PresShell::FlushPendingNotifications(this=0x000000081fbf6800, aType=(mFlushType = InterruptibleLayout, mFlushAnimations = true)) at PresShell.h:1453:5
    frame #102: 0x00000008132d934f libxul.so`mozilla::PresShell::DoFlushPendingNotifications(this=0x000000081fbf6800, aType=InterruptibleLayout) at PresShell.cpp:3999:3
    frame #103: 0x000000080f97474e libxul.so`mozilla::PresShell::FlushPendingNotifications(this=0x000000081fbf6800, aType=InterruptibleLayout) at PresShell.h:1444:5
    frame #104: 0x000000081158d3e1 libxul.so`mozilla::EventStateManager::FlushLayout(this=0x000000081ca17800, aPresContext=0x000000081e19d000) at EventStateManager.cpp:5627:16
    frame #105: 0x0000000811589f51 libxul.so`mozilla::EventStateManager::PreHandleEvent(this=0x000000081ca17800, aPresContext=0x000000081e19d000, aEvent=0x00007fffffff4e30, aTargetFrame=0x00000008255fc2f0, aTargetContent=0x00000008214adf20, aStatus=0x00007fffffff4c84, aOverrideClickTarget=0x0000000000000000) at EventStateManager.cpp:688:7
    frame #106: 0x00000008132ed93d libxul.so`mozilla::PresShell::EventHandler::DispatchEvent(this=0x00007fffffff4ac0, aEventStateManager=0x000000081ca17800, aEvent=0x00007fffffff4e30, aTouchIsNew=false, aEventStatus=0x00007fffffff4c84, aOverrideClickTarget=0x0000000000000000) at PresShell.cpp:7919:39
    frame #107: 0x00000008132e89d8 libxul.so`mozilla::PresShell::EventHandler::HandleEventWithCurrentEventInfo(this=0x00007fffffff4ac0, aEvent=0x00007fffffff4e30, aEventStatus=0x00007fffffff4c84, aIsHandlingNativeEvent=true, aOverrideClickTarget=0x0000000000000000) at PresShell.cpp:7888:17
    frame #108: 0x00000008132e8583 libxul.so`mozilla::PresShell::EventHandler::HandleEventUsingCoordinates(this=0x00007fffffff4ba0, aFrameForPresShell=0x0000000821470020, aGUIEvent=0x00007fffffff4e30, aEventStatus=0x00007fffffff4c84, aDontRetargetEvents=false) at PresShell.cpp:6831:30
    frame #109: 0x00000008132e6e9a libxul.so`mozilla::PresShell::EventHandler::HandleEvent(this=0x00007fffffff4ba0, aFrameForPresShell=0x0000000821470020, aGUIEvent=0x00007fffffff4e30, aDontRetargetEvents=false, aEventStatus=0x00007fffffff4c84) at PresShell.cpp:6636:12
    frame #110: 0x00000008132e61e1 libxul.so`mozilla::PresShell::HandleEvent(this=0x000000081fbf6800, aFrameForPresShell=0x0000000821470020, aGUIEvent=0x00007fffffff4e30, aDontRetargetEvents=false, aEventStatus=0x00007fffffff4c84) at PresShell.cpp:6561:23
    frame #111: 0x0000000812e5e2c8 libxul.so`nsViewManager::DispatchEvent(this=0x0000000821748e80, aEvent=0x00007fffffff4e30, aView=0x0000000821699080, aStatus=0x00007fffffff4c84) at nsViewManager.cpp:750:18
    frame #112: 0x0000000812e5e00e libxul.so`nsView::HandleEvent(this=0x0000000821699080, aEvent=0x00007fffffff4e30, aUseAttachedEvents=false) at nsView.cpp:1133:9
    frame #113: 0x0000000812eb1624 libxul.so`mozilla::widget::PuppetWidget::DispatchEvent(this=0x000000081e285e00, aEvent=0x00007fffffff4e30, aStatus=0x00007fffffff4d44) at PuppetWidget.cpp:381:37
    frame #114: 0x000000080f03809d libxul.so`mozilla::layers::APZCCallbackHelper::DispatchWidgetEvent(aEvent=0x00007fffffff4e30) at APZCCallbackHelper.cpp:540:21
    frame #115: 0x000000081271de25 libxul.so`mozilla::dom::BrowserChild::DispatchWidgetEventViaAPZ(this=0x000000081fa8c900, aEvent=0x00007fffffff4e30) at BrowserChild.cpp:1737:10
    frame #116: 0x000000081271cc5f libxul.so`mozilla::dom::BrowserChild::HandleRealMouseButtonEvent(this=0x000000081fa8c900, aEvent=0x00007fffffff7d88, aGuid=0x00007fffffff63f8, aInputBlockId=0x00007fffffff63f0) at BrowserChild.cpp:1676:3
    frame #117: 0x000000081271dc7c libxul.so`mozilla::dom::BrowserChild::RecvRealMouseButtonEvent(this=0x000000081fa8c900, aEvent=0x00007fffffff7d88, aGuid=0x00007fffffff63f8, aInputBlockId=0x00007fffffff63f0) at BrowserChild.cpp:1649:3
    frame #118: 0x000000081271dd32 libxul.so`mozilla::dom::BrowserChild::RecvSynthMouseMoveEvent(this=0x000000081fa8c900, aEvent=0x00007fffffff7d88, aGuid=0x00007fffffff63f8, aInputBlockId=0x00007fffffff63f0) at BrowserChild.cpp:1614:8
    frame #119: 0x000000080e3367f5 libxul.so`mozilla::dom::PBrowserChild::OnMessageReceived(this=0x000000081fa8c938, msg__=0x000000081ca70160) at PBrowserChild.cpp:5044:56
    frame #120: 0x000000080dbd02b7 libxul.so`mozilla::dom::PContentChild::OnMessageReceived(this=0x0000000801a5ac20, msg__=0x000000081ca70160) at PContentChild.cpp:8409:32
    frame #121: 0x00000008126de74c libxul.so`mozilla::dom::ContentChild::OnMessageReceived(this=0x0000000801a5ac20, aMsg=0x000000081ca70160) at ContentChild.cpp:3612:25
    frame #122: 0x000000080d99858a libxul.so`mozilla::ipc::MessageChannel::DispatchAsyncMessage(this=0x0000000801a5ad10, aProxy=0x0000000801af6fc0, aMsg=0x000000081ca70160) at MessageChannel.cpp:2187:25
    frame #123: 0x000000080d996a7d libxul.so`mozilla::ipc::MessageChannel::DispatchMessage(this=0x0000000801a5ad10, aMsg=0x000000081ca70160) at MessageChannel.cpp:2111:9
    frame #124: 0x000000080d99742d libxul.so`mozilla::ipc::MessageChannel::RunMessage(this=0x0000000801a5ad10, aTask=0x000000081ca70100) at MessageChannel.cpp:1959:3
    frame #125: 0x000000080d9979df libxul.so`mozilla::ipc::MessageChannel::MessageTask::Run(this=0x000000081ca70100) at MessageChannel.cpp:1990:13
    frame #126: 0x000000080cadfaab libxul.so`nsThread::ProcessNextEvent(this=0x0000000801a43b00, aMayWait=false, aResult=0x00007fffffffd5f7) at nsThread.cpp:1200:14
    frame #127: 0x000000080cae5018 libxul.so`NS_ProcessNextEvent(aThread=0x0000000801a43b00, aMayWait=false) at nsThreadUtils.cpp:481:10
    frame #128: 0x000000080d99bc89 libxul.so`mozilla::ipc::MessagePump::Run(this=0x0000000801a19d20, aDelegate=0x00007fffffffd9d0) at MessagePump.cpp:87:21
    frame #129: 0x000000080d99c9d8 libxul.so`mozilla::ipc::MessagePumpForChildProcess::Run(this=0x0000000801a19d20, aDelegate=0x00007fffffffd9d0) at MessagePump.cpp:270:30
    frame #130: 0x000000080d888b48 libxul.so`MessageLoop::RunInternal(this=0x00007fffffffd9d0) at message_loop.cc:315:10
    frame #131: 0x000000080d888ac5 libxul.so`MessageLoop::RunHandler(this=0x00007fffffffd9d0) at message_loop.cc:308:3
    frame #132: 0x000000080d888a78 libxul.so`MessageLoop::Run(this=0x00007fffffffd9d0) at message_loop.cc:290:3
    frame #133: 0x0000000812ee05a1 libxul.so`nsBaseAppShell::Run(this=0x0000000801b98870) at nsBaseAppShell.cpp:137:27
    frame #134: 0x0000000815fc0318 libxul.so`XRE_RunAppShell() at nsEmbedFunctions.cpp:909:20
    frame #135: 0x000000080d99c821 libxul.so`mozilla::ipc::MessagePumpForChildProcess::Run(this=0x0000000801a19d20, aDelegate=0x00007fffffffd9d0) at MessagePump.cpp:237:9
    frame #136: 0x000000080d888b48 libxul.so`MessageLoop::RunInternal(this=0x00007fffffffd9d0) at message_loop.cc:315:10
    frame #137: 0x000000080d888ac5 libxul.so`MessageLoop::RunHandler(this=0x00007fffffffd9d0) at message_loop.cc:308:3
    frame #138: 0x000000080d888a78 libxul.so`MessageLoop::Run(this=0x00007fffffffd9d0) at message_loop.cc:290:3
    frame #139: 0x0000000815fbfae5 libxul.so`XRE_InitChildProcess(aArgc=13, aArgv=0x00007fffffffdce8, aChildData=0x00007fffffffdc10) at nsEmbedFunctions.cpp:740:34
    frame #140: 0x0000000815fcdcc7 libxul.so`mozilla::BootstrapImpl::XRE_InitChildProcess(this=0x0000000801a33770, argc=14, argv=0x00007fffffffdce8, aChildData=0x00007fffffffdc10) at Bootstrap.cpp:67:12
    frame #141: 0x000000000103c569 firefox`content_process_main(bootstrap=0x0000000801a33770, argc=14, argv=0x00007fffffffdce8) at plugin-container.cpp:56:28
    frame #142: 0x000000000103c779 firefox`main(argc=15, argv=0x00007fffffffdce8, envp=0x00007fffffffdd68) at nsBrowserApp.cpp:303:18
    frame #143: 0x000000000103c2b5 firefox`_start(ap=<unavailable>, cleanup=<unavailable>) at crt1.c:76:7

Comment 10

[Jan Beich]

Anything else? I can't use ASan due to bug 1629324.

Comment 11

[Graham Perrin]

Attachment: bt and bt all – 75.0 (20200407031222), safe mode

grahamperrin@momh167-gjp4-8570p:~ % date ; uptime ; uname -v
Sun 12 Apr 2020 01:25:58 BST
 1:25a.m.  up 1 day,  2:44, 5 users, load averages: 0.36, 0.72, 1.78
FreeBSD 13.0-CURRENT #52 r359750: Fri Apr 10 03:33:09 BST 2020     root@momh167-gjp4-8570p:/usr/obj/usr/src/amd64.amd64/sys/GENERIC-NODEBUG 
grahamperrin@momh167-gjp4-8570p:~ % pkg query '%o %v %R' cliqz firefox
www/cliqz 1.34.0_1 FreeBSD
www/firefox 75.0_1,1 FreeBSD
grahamperrin@momh167-gjp4-8570p:~ % rm firefox.core 
grahamperrin@momh167-gjp4-8570p:~ % firefox --safe-mode -P clean
<jemalloc>: jemalloc_rtree.c:205: Failed assertion: "!dependent || leaf != NULL"
Redirecting call to abort() to mozalloc_abort


###!!! [Parent][MessageChannel] Error: (msgtype=0x370131,name=PContent::Msg_DetachBrowsingContext) Channel error: cannot send/recv

grahamperrin@momh167-gjp4-8570p:~ % lldb --core firefox.core /usr/local/bin/firefox

(lldb) target create "/usr/local/bin/firefox" --core "firefox.core"
Core file '/home/grahamperrin/firefox.core' (x86_64) was loaded.
bt
(lldb) bt
* thread #1, name = 'Web Content', stop reason = signal SIGSEGV
  * frame #0: 0x0000000001030753 firefox`mozalloc_abort + 51
    frame #1: 0x0000000001030780 firefox`abort + 16
    frame #2: 0x0000000801319080 libc.so.7`__je_rtree_leaf_elm_lookup_hard(tsdn=<unavailable>, rtree=<unavailable>, rtree_ctx=0x000000080109b0b8, key=6510615555426900570, dependent=<unavailable>, init_missing=<unavailable>) at jemalloc_rtree.c:0
    frame #3: 0x0000000801363a08 libc.so.7`rtree_read [inlined] rtree_leaf_elm_lookup(tsdn=<unavailable>, rtree=<unavailable>, rtree_ctx=<unavailable>, key=<unavailable>, dependent=true, init_missing=false) at rtree.h:381:9
    frame #4: 0x0000000801363921 libc.so.7`rtree_read(tsdn=<unavailable>, rtree=<unavailable>, rtree_ctx=<unavailable>, key=<unavailable>, dependent=true) at rtree.h:406
    frame #5: 0x000000080135cf09 libc.so.7`ifree [inlined] rtree_szind_slab_read(tsdn=<unavailable>, rtree=<unavailable>, rtree_ctx=<unavailable>, key=6510615555426900570, dependent=true, r_szind=<unavailable>, r_slab=<unavailable>) at rtree.h:458:26
    frame #6: 0x000000080135cef9 libc.so.7`ifree(tsd=0x000000080109b090, ptr=0x5a5a5a5a5a5a5a5a, tcache=0x000000080109b250, slow_path=true) at jemalloc_jemalloc.c:2210
    frame #7: 0x000000080135cc3d libc.so.7`__free(ptr=0x5a5a5a5a5a5a5a5a) at jemalloc_jemalloc.c:0
    frame #8: 0x0000000805df9c29 libxul.so`mozilla::net::PHttpChannelChild::OnMessageReceived(IPC::Message const&) + 7481
    frame #9: 0x0000000805d705c2 libxul.so`mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) + 290
    frame #10: 0x0000000805c910a7 libxul.so`mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) + 103
    frame #11: 0x0000000805c8ff84 libxul.so`mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) + 340
    frame #12: 0x0000000805c90bfe libxul.so`mozilla::ipc::MessageChannel::MessageTask::Run() + 78
    frame #13: 0x000000080580c898 libxul.so`mozilla::SchedulerGroup::Runnable::Run() + 40
    frame #14: 0x000000080581bf18 libxul.so`nsThread::ProcessNextEvent(bool, bool*) + 840
    frame #15: 0x000000080581f2cb libxul.so`NS_ProcessNextEvent(nsIThread*, bool) + 75
    frame #16: 0x0000000805c93b7b libxul.so`mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) + 123
    frame #17: 0x0000000805c4e418 libxul.so`MessageLoop::Run() + 88
    frame #18: 0x0000000807eeae19 libxul.so`nsBaseAppShell::Run() + 41
    frame #19: 0x0000000808f66527 libxul.so`XRE_RunAppShell() + 71
    frame #20: 0x0000000805c4e418 libxul.so`MessageLoop::Run() + 88
    frame #21: 0x0000000808f6620a libxul.so`XRE_InitChildProcess(int, char**, XREChildData const*) + 730
    frame #22: 0x000000000102f6d7 firefox`main + 791
    frame #23: 0x000000000102f0e2 firefox`_start(ap=<unavailable>, cleanup=<unavailable>) at crt1.c:76:7

Comment 12

[Graham Perrin]

Attachment: about:support – 75.0 (20200407031222), safe mode

Comment 13

[Jonathan Kew [:jfkthame]]

(In reply to Jan Beich from comment #9)

--enable-debug + --disable-optimize still crashes but (like ESR68 in comment 0) not in harfbuzz.

This looks like we're getting a null gfxFont pointer, but it's not immediately obvious to me how we get that... gfxFontGroup::GetFirstValidFont() tries pretty hard to make sure it's returning something valid. I'll try to dig through this some more...

(In reply to Graham Perrin from comment #11)

grahamperrin@momh167-gjp4-8570p:~ % firefox --safe-mode -P clean
<jemalloc>: jemalloc_rtree.c:205: Failed assertion: "!dependent || leaf != NULL"

This is crashing immediately on startup, right -- without even trying to load a page? Seems like this may be unrelated to Jan's crash which (as I understand it) is specific to the gov.uk site, perhaps related to the particular webfont they're using.

Jan, can you load other sites successfully with this same browser? If you set gfx.downloadable_fonts.enabled to false, can you load gov.uk without crashing?

Comment 14

[Jan Beich]

(In reply to Jonathan Kew (:jfkthame) from comment #13)

Jan, can you load other sites successfully with this same browser?

Yes and no. GitHub and YouTube work fine but sometimes the whole browser crashes (not just content process). I suspect --enable-debug causes such crashes because regular Nightly builds are stable.

gfx.downloadable_fonts.enabled to false, can you load gov.uk without crashing?

Yes. Ignoring --enable-debug + --disable-optimize which still crashes all other Firefox builds/versions no longer crash.

Comment 15

[Graham Perrin]

Confirmed, gfx.downloadable_fonts.enabled false does seem to be a reliable workaround to the crashing (and font shaping/layout issues) at https://www.gov.uk/coronavirus and other government pages.

Over the past four days I have seen no other site affected. I'm happy to leave the preference true, if identifying other affected sites might help.

(In reply to Jonathan Kew (:jfkthame) from comment #13)

… This is crashing immediately on startup, right -- without even trying to load a page? …

Not immediately, but intentionally very soon after startup. For the given .core file I chose to use a refreshed profile in safe mode and visit or reload government pages as quickly as possible after startup, without opening a new tab.

If my backtrace above is confusingly different from Jan's: sorry. The standard port www/firefox, with which I found the bug, benefits from various configure flags and patches; significantly different from the upstream build system.

If you like – if this (in isolation) will not add confusion – I can add about:buildconfig information.

Comment 16

[Graham Perrin]

Also crashing (a handful of examples):

• https://archive.vn/EVaWl – 2020-03-27 capture of https://www.gov.uk/coronavirus
• https://www.gov.uk/government/publications/covid-19-track-coronavirus-cases
• https://www.gov.uk/government/publications/coronavirus-covid-19-personal-protective-equipment-ppe-plan

Not crashing, touch wood, in my Firefox (or Cliqz) on FreeBSD-CURRENT at:

• https://coronavirus.data.gov.uk/ or 2020-04-15 capture thereof at https://archive.vn/Pi9a9

Comment 17

[Graham Perrin]

Similarly crashing:

• https://issuu.com/medical-forum-magazine/docs/medical_forum_magazine_april__2020_public_edition

With gfx.downloadable_fonts.enabled false the page will load. If reverted to true, then 'leafing' through the publication will crash the tab.

Firefox 75.0_2,1 build 20200421052914 from the FreeBSD ports repo.

Generally

Whilst I'd like to leave gfx.downloadable_fonts.enabled false as a workaround, sites such as this (Bugzilla@Mozilla) appear to require downloadable fonts :-(

Comment 18

[Phil Armstrong]

Can also confirm on Linux (Debian unstable: Firefox version 75). Firefox instantly crashes on visiting https://hmrc.gov.uk/

Flipping gfx.downloadable_fonts.enabled to false prevents the crash.

Comment 19

[Jonathan Kew [:jfkthame]]

(In reply to Phil Armstrong from comment #18)

Can also confirm on Linux (Debian unstable: Firefox version 75). Firefox instantly crashes on visiting https://hmrc.gov.uk/

Flipping gfx.downloadable_fonts.enabled to false prevents the crash.

Does this generate a Firefox crash report we could examine? Please see about:crashes for crash report IDs.

Comment 20

[Phil Armstrong]

Running the latest nightly ASAN build as of today (2020-05-07), this also crashes on https://hmrc.gov.uk/ but I don’t see any ASAN errors in the output as a result.

Does this generate a Firefox crash report we could examine? Please see about:crashes for crash report IDs.

The standard firefox 75 build claimed to have been submitting crash reports. But I’ve just gone in & manually submitted the last few from about:crashes as well. See ids: 186108a7-ee1b-5076-2dbe-3c20fffa5d22 and 1a414540-6535-07d0-d9ff-fa7c06eee932

Comment 21

[Phil Armstrong]

Sorry, that should be Report-ID: bp-d855206e-bea9-461e-a125-336050200507 and bp-4c51fdf6-2054-46e6-ac47-a058a0200507 (I think)

Comment 22

[Phil Armstrong]

And I’ve already upgraded to firefox 76 apparently. Don’t know how I missed that. So this affects both current release version 76 & the current nightly on Linux.

Comment 23

[Edward Betts]

Another crash report: bp-0f86e23f-ecfe-4f4b-8003-d78820200507

Comment 24

[Jonathan Kew [:jfkthame]]

(In reply to Phil Armstrong from comment #21)

Sorry, that should be Report-ID: bp-d855206e-bea9-461e-a125-336050200507 and bp-4c51fdf6-2054-46e6-ac47-a058a0200507 (I think)

Aha - these crashes, at least, look like they are actually examples of bug 1633467, which is the result of a bug in the version of fontconfig currently present in debian bullseye/sid; see also https://gitlab.freedesktop.org/fontconfig/fontconfig/-/issues/237 and https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=959800.

Jan (or Graham), can you find out exactly what libfontconfig is present on your FreeBSD systems that crash? I wonder if they have the same bug, but it's just manifesting a bit differently (which wouldn't be surprising for a double-free memory management error).

Comment 25

[Jonathan Kew [:jfkthame]]

I don't know anything about how the FreeBSD world manages packages etc, but if https://svnweb.freebsd.org/ports/head/x11-fonts/fontconfig/files/patch-2.13.92.diff?revision=530516&view=markup reflects what you're using, then it looks like it does include the bad commit (https://cgit.freedesktop.org/fontconfig/commit/?id=61573ad5f7c4dd0860d613d99d0086433240eb75) from upstream, and that's probably responsible for these crashes.

Comment 26

[Jan Beich]

I confirm, Firefox doesn't crash after downgrading fontconfig package from 2.13.92_1,1 to 2.13.1_1,1.

Comment 27

[Graham Perrin]

Thanks Jonathan, Jan and all.

root@momh167-gjp4-8570p:~ # date ; uname -v
Fri May  8 01:40:45 BST 2020
FreeBSD 13.0-CURRENT #55 r360732: Thu May  7 09:31:34 BST 2020     root@momh167-gjp4-8570p:/usr/obj/usr/src/amd64.amd64/sys/GENERIC-NODEBUG 
root@momh167-gjp4-8570p:~ # pkg query '%o %v %R' firefox fontconfig
www/firefox 76.0_2,1 FreeBSD
x11-fonts/fontconfig 2.13.92_1,1 FreeBSD
root@momh167-gjp4-8570p:~ # 

Comment 28

[Graham Perrin]

Fix confirmed on FreeBSD; 245915 – x11-fonts/fontconfig: webfonts on many sites crash www/firefox

Comment 29

[Jonathan Kew [:jfkthame]]

Awesome, thanks for confirming this. (Now if Debian would do something similar for bullseye/sid......)

Comment 30

[Jonathan Kew [:jfkthame]]

I think we can close this, as FreeBSD has updated libfontconfig to fix the bug there.

(Bug 1633467 remains open for the crashes on Debian for now.)