1718286 - Crash in [@ nsTArray_Impl<T>::Clear | mozilla::dom::ResizeObserver::GatherActiveObservations]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

29 content crashes from 12 installations, all with Firefox 91.0a1 20210625093436 on Windows.

It's a regression from bug 1717620. Emilio, shall it get backed out?

Crash report: https://crash-stats.mozilla.org/report/index/dd2fac1b-c2c1-4a5a-a25b-c95670210625

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll nsTArray_Impl<RefPtr<mozilla::dom::ResizeObservation>, nsTArrayInfallibleAllocator>::Clear xpcom/ds/nsTArray.h:1936
1 xul.dll mozilla::dom::ResizeObserver::GatherActiveObservations dom/base/ResizeObserver.cpp:253
2 xul.dll mozilla::dom::ResizeObserverController::Notify dom/base/ResizeObserverController.cpp:104
3 xul.dll nsRefreshDriver::Tick layout/base/nsRefreshDriver.cpp:2243
4 xul.dll mozilla::RefreshDriverTimer::TickRefreshDrivers layout/base/nsRefreshDriver.cpp:326
5 xul.dll mozilla::RefreshDriverTimer::Tick layout/base/nsRefreshDriver.cpp:342
6 xul.dll mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver layout/base/nsRefreshDriver.cpp:704
7 xul.dll mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync layout/base/nsRefreshDriver.cpp:617
8 xul.dll mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync layout/base/nsRefreshDriver.cpp:538
9 xul.dll mozilla::dom::VsyncChild::RecvNotify dom/ipc/VsyncChild.cpp:68

Comment 1

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

See e.g. bp-283ae5fd-fb40-43e7-8789-48e610210625 for [@ mozilla::dom::ResizeObserver::GatherActiveObservations].

Comment 2

[Emilio Cobos Álvarez (:emilio)]

Is there any chance fuzzers have seen this? If this is very frequent please back out otherwise I'd rather try to repro it.

Comment 3

[Marian-Vasile Laza]

The regressor was backed out from central: https://hg.mozilla.org/mozilla-central/rev/634121e78fb63a84a8cc721db053a4ca1135b2c9

Comment 5

[Jason Kratzer [:jkratzer]]

(In reply to Emilio Cobos Álvarez (:emilio) from comment #2)

Is there any chance fuzzers have seen this? If this is very frequent please back out otherwise I'd rather try to repro it.

:emilio, no unfortunately not.

Comment 6

[Daniel Veditz [:dveditz]]

Carrying over the sec keywords from bug 1719126 for tracking purposes. No need for an advisory in a nightly-only bug though.