1747962 - Double-free crash in [@ je_free | std::deque<T>::pop_back]

Status: RESOLVED WORKSFORME

(Core :: Graphics: WebRender, defect)

Description

[Randell Jesup [:jesup] (needinfo me)]

Double-free in code called from webrender, called from mozilla::layers::ClipManager::PopOverrideForASR(mozilla::ActiveScrolledRoot const*)

Crash report: https://crash-stats.mozilla.org/report/index/33ed70f1-cb2d-49c4-838e-809ee0211227

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)

Top 10 frames of crashing thread:

0 mozglue.dll je_free memory/build/malloc_decls.h:54
1 xul.dll std::deque<std::unordered_map<const mozilla::DisplayItemClipChain*, AutoTArray<mozilla::wr::WrClipId, 4>, std::hash<const mozilla::DisplayItemClipChain*>, std::equal_to<const mozilla::DisplayItemClipChain*>, std::allocator<std::pair<const mozilla::DisplayItemClipChain*const, AutoTArray<mozilla::wr::WrClipId, 4> > > >, std::allocator<std::unordered_map<const mozilla::DisplayItemClipChain*, AutoTArray<mozilla::wr::WrClipId, 4>, std::hash<const mozilla::DisplayItemClipChain*>, std::equal_to<const mozilla::DisplayItemClipChain*>, std::allocator<std::pair<const mozilla::DisplayItemClipChain*const, AutoTArray<mozilla::wr::WrClipId, 4> > > > > >::pop_back vs2017_15.9.6/VC/include/deque:1516
2 xul.dll mozilla::layers::ClipManager::PopOverrideForASR gfx/layers/wr/ClipManager.cpp:107
3 xul.dll mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList gfx/layers/wr/WebRenderCommandBuilder.cpp:1937
4 xul.dll mozilla::nsDisplayTransform::CreateWebRenderCommands layout/painting/nsDisplayList.cpp:6672
5 xul.dll mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList gfx/layers/wr/WebRenderCommandBuilder.cpp:1829
6 xul.dll mozilla::nsDisplayOwnLayer::CreateWebRenderCommands layout/painting/nsDisplayList.cpp:5242
7 xul.dll mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList gfx/layers/wr/WebRenderCommandBuilder.cpp:1829
8 xul.dll mozilla::layers::WebRenderLayerManager::EndTransactionWithoutLayer gfx/layers/wr/WebRenderLayerManager.cpp:362
9 xul.dll mozilla::nsDisplayList::PaintRoot layout/painting/nsDisplayList.cpp:2195

Comment 1

[Randell Jesup [:jesup] (needinfo me)]

Appears to have started in 91

Comment 2

[BugBot [:suhaib / :marco]]

Closing because no crashes reported for 12 weeks.