1766471 - Crash in [@ mozilla::RetainedDisplayList::DeleteAll]

Status: NEW

(Core :: Web Painting, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Crash signature already existed earlier but volume double to 200+ crash reports with Firefox 99.

Crash report: https://crash-stats.mozilla.org/report/index/9ad3585a-6017-45b8-87ae-ac0b30220426

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll mozilla::RetainedDisplayList::DeleteAll layout/painting/nsDisplayList.h:3583
1 xul.dll mozilla::RetainedDisplayList::DeleteAll layout/painting/nsDisplayList.h:3585
2 xul.dll mozilla::RetainedDisplayList::DeleteAll layout/painting/nsDisplayList.h:3585
3 xul.dll mozilla::RetainedDisplayList::DeleteAll layout/painting/nsDisplayList.h:3585
4 xul.dll static nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:3366
5 xul.dll mozilla::PresShell::PaintInternal layout/base/PresShell.cpp:6362
6 xul.dll nsViewManager::ProcessPendingUpdatesPaint view/nsViewManager.cpp:440
7 xul.dll nsViewManager::ProcessPendingUpdatesForView view/nsViewManager.cpp:375
8 xul.dll nsViewManager::ProcessPendingUpdates view/nsViewManager.cpp:948
9 xul.dll nsRefreshDriver::Tick layout/base/nsRefreshDriver.cpp:2582

Comment 1

[Gabriele Svelto [:gsvelto]]

New signature for this crash.

Comment 2

[Gabriele Svelto [:gsvelto]]

New signature for this crash.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criteria:

• Top 20 desktop browser crashes on beta
• Top 10 content process crashes on beta

For more information, please visit auto_nag documentation.

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

[Tracking Requested - why for this release]: Spiked in 106.0rc1, 106.0 already has 14 crash reports.

Comment 5

[Timothy Nikkel (:tnikkel)]

I don't think there have been any code changes recently that might have caused this.

Comment 6

[Timothy Nikkel (:tnikkel)]

All of the crashes with the signature mozilla::LinkedListIterator<T>::operator* are in family 23 model 1 stepping 1 cpus, so those look like an instance of bug 1796126. That signature is also by far the one with the largest number of crashes of the 3 signatures on this bug. So the spike here seems to be caused by bug 1796126.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The bug is marked as tracked for firefox106 (release). However, the bug still isn't assigned.

:bhood, could you please find an assignee for this tracked bug? If you disagree with the tracking decision, please talk with the release managers.

For more information, please visit auto_nag documentation.

Comment 8

[Timothy Nikkel (:tnikkel)]

The reason this bug is tracked is for bug 1796126. That bug is now fixed so this should be untracked.

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

Based on the topcrash criteria, the crash signatures linked to this bug are not in the topcrash signatures anymore.

For more information, please visit auto_nag documentation.