1669165 - Crash in [@ mozilla::dom::MutationObservers::NotifyAnimationMutated]

Status: RESOLVED DUPLICATE of bug 1783021

(Core :: DOM: Animation, defect)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/53f2feba-4ef1-44fc-9cd6-648470201005

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll static mozilla::dom::MutationObservers::NotifyAnimationMutated dom/base/MutationObservers.cpp:242
1 xul.dll mozilla::dom::Animation::UpdateRelevance dom/animation/Animation.cpp
2 xul.dll mozilla::dom::Animation::Cancel dom/animation/Animation.cpp:556
3 xul.dll static mozilla::AnimationCollection<mozilla::dom::CSSAnimation>::PropertyDtor layout/style/AnimationCollection.cpp:33
4 xul.dll nsPropertyTable::RemoveProperty dom/base/nsPropertyTable.cpp:204
5 xul.dll mozilla::dom::Element::UnbindFromTree dom/base/Element.cpp:1762
6 xul.dll nsGenericHTMLElement::UnbindFromTree dom/html/nsGenericHTMLElement.cpp:475
7 xul.dll nsINode::RemoveChild dom/base/nsINode.cpp:783
8 xul.dll mozilla::dom::Node_Binding::removeChild dom/bindings/NodeBinding.cpp:1129
9 xul.dll mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3227

This is a really odd bug. It's a segfault happening on all platforms, what's strange is that the crash address is the same everywhere. It's 0x100020800058 on Windows/Linux and 0x20800058.

It looks like it's a value being generated, maybe some kind of index lookup? Unfortunately I'm not familiar with the affected code.

It doesn't seem to be a new bug, we have crash reports going back all the way to Firefox 72.

Comment 1

[Hiroyuki Ikezoe (:hiro)]

I believe this will be solved by bug 1783021.