1686901 - Crash in [@ nsIFrame::BoxReflow]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/42136a26-873f-4aa2-b178-29ff80210113

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT(!XRE_IsContentProcess()) (Starting XUL BoxReflow w/o BoxMetrics (in content)?)

Top 10 frames of crashing thread:

0 libxul.so nsIFrame::BoxReflow /build/firefox-EC15yc/firefox-85.0~b7+build1/layout/generic/nsIFrame.cpp:10434
1 libxul.so nsIFrame::DoXULLayout /build/firefox-EC15yc/firefox-85.0~b7+build1/layout/generic/nsIFrame.cpp:10357
2 libxul.so nsBoxFrame::LayoutChildAt /build/firefox-EC15yc/firefox-85.0~b7+build1/layout/xul/nsBoxFrame.cpp:1018
3 libxul.so mozilla::ScrollFrameHelper::LayoutScrollbars /build/firefox-EC15yc/firefox-85.0~b7+build1/layout/generic/nsGfxScrollFrame.cpp:6790
4 libxul.so nsHTMLScrollFrame::Reflow /build/firefox-EC15yc/firefox-85.0~b7+build1/layout/generic/nsGfxScrollFrame.cpp:1336
5 libxul.so nsContainerFrame::ReflowChild /build/firefox-EC15yc/firefox-85.0~b7+build1/layout/generic/nsContainerFrame.cpp:1122
6 libxul.so mozilla::ViewportFrame::Reflow /build/firefox-EC15yc/firefox-85.0~b7+build1/layout/generic/ViewportFrame.cpp:337
7 libxul.so mozilla::PresShell::DoReflow /build/firefox-EC15yc/firefox-85.0~b7+build1/layout/base/PresShell.cpp:9668
8 libxul.so mozilla::PresShell::ProcessReflowCommands /build/firefox-EC15yc/firefox-85.0~b7+build1/layout/base/PresShell.cpp:9841
9 libxul.so mozilla::PresShell::DoFlushPendingNotifications /build/firefox-EC15yc/firefox-85.0~b7+build1/layout/base/PresShell.cpp:4247

Volume is low but the vast majority of this crashes have the same MOZ_CRASH() reason so this seems legit.

Comment 1

[Jonathan Kew [:jfkthame]]

Seems to have been going on (at a low volume) for at least 6 months (per crash-stats), on both Windows and Linux, on versions at least as far back as Firefox 78.

We safely crash the content process, but it does look like something's getting quite confused.

Comment 2

[Andrew McCreight [:mccr8]]

It looks like this flared up a bit on Nightly, starting with the 20230227214733 build. There was only a single crash in that build, but there's been a steady trickle of them since that. Here is the set of patches that landed in 20230227214733.

Emilio, could bug 1818927 have caused this to happen more frequently? Thanks.

Comment 3

[Emilio Cobos Álvarez [:emilio]]

Hmm, that seems plausible, though it'd be nice to get a repro :(

I plan to remove all that code in the next coming months anyways tho.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.