Open Bug 1698923 Opened 4 years ago Updated 4 years ago

Crash in [@ nsDisplayItem::~nsDisplayItem]

Categories

(Core :: Web Painting, defect, P3)

Product:
Core
Component:
Web Painting
Platform:
x86
Windows 7
Type:
defect

Tracking

()

People

(Reporter: MatsPalmgren_bugz, Unassigned)

Details

(Keywords: crash, testcase-wanted)

Crash Data

Crash report: https://crash-stats.mozilla.org/report/index/244f24d4-c13d-4fe6-8514-b29320210315

Reason: EXCEPTION_ACCESS_VIOLATION_WRITE

Top 10 frames of crashing thread:

0 xul.dll nsDisplayItem::~nsDisplayItem layout/painting/nsDisplayList.h:2509
1 xul.dll nsDisplayContainer::~nsDisplayContainer layout/painting/nsDisplayList.h:3949
2 xul.dll nsDisplayList::DeleteAll layout/painting/nsDisplayList.cpp:2635
3 xul.dll RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:798
4 xul.dll RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:815
5 xul.dll RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:815
6 xul.dll RetainedDisplayListBuilder::AttemptPartialUpdate layout/painting/RetainedDisplayListBuilder.cpp:1471
7 xul.dll static nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:3336
8 xul.dll mozilla::PresShell::Paint layout/base/PresShell.cpp:6396
9 xul.dll nsViewManager::ProcessPendingUpdatesPaint view/nsViewManager.cpp:459

It appears we have a fairly high number of crashes with this signature (>100 in past week).

Similar stack from https://crash-stats.mozilla.org/report/index/ef2c6494-e493-43cf-bb68-9942a0210316

0 xul.dll nsDisplayItem::~nsDisplayItem layout/painting/nsDisplayList.h:2535
1 xul.dll nsDisplayBorder::~nsDisplayBorder layout/painting/nsDisplayList.h:7286
2 xul.dll RetainedDisplayList::DeleteAll layout/painting/nsDisplayList.h:3948
3 xul.dll RetainedDisplayList::DeleteAll layout/painting/nsDisplayList.h:3948
4 xul.dll RetainedDisplayList::DeleteAll layout/painting/nsDisplayList.h:3948
5 xul.dll RetainedDisplayList::DeleteAll layout/painting/nsDisplayList.h:3948
6 xul.dll RetainedDisplayListBuilder::AttemptPartialUpdate layout/painting/RetainedDisplayListBuilder.cpp:1437
7 xul.dll static nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:3328
8 xul.dll mozilla::PresShell::Paint layout/base/PresShell.cpp:6393
9 xul.dll nsViewManager::ProcessPendingUpdatesPaint view/nsViewManager.cpp:460

Based on the crash reports, this happens often when we attempt a partial display list build but decide not to do it1. We then crash when destroying the display list from the previous paint.

Severity: -- → S3
Keywords: testcase-wanted
Priority: -- → P3
You need to log in before you can comment on or make changes to this bug.