Open Bug 1857241 Opened 2 years ago Updated 1 year ago

Crash in [@ nsIFrame::HasAnyStateBits]

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Tracking Flags:
Tracking Status
firefox-esr115 --- affected
firefox118 --- affected
firefox119 --- affected
firefox120 --- affected

People

(Reporter: aryx, Unassigned)

References

Details

(Keywords: crash)

Crash Data

This crash signature preexisted but it got more frequent with Firefox 118: already 181 crash reports from 177 installations compared to 96 from 90 for the whole v117 release cycle.

Crash report: https://crash-stats.mozilla.org/report/index/c5eb3222-7c10-4cdc-9605-526660231005

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  nsIFrame::HasAnyStateBits const  layout/generic/nsIFrame.h:2311
0  xul.dll  nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached  layout/style/nsStyleTransformMatrix.cpp:113
1  xul.dll  nsStyleTransformMatrix::TransformReferenceBox::Height  layout/style/nsStyleTransformMatrix.h:112
1  xul.dll  nsStyleTransformMatrix::Convert2DPosition::<lambda_3>::operator const  layout/style/nsStyleTransformMatrix.cpp:626
1  xul.dll  mozilla::StyleLengthPercentageUnion::ResolveToCSSPixelsWith const  layout/style/ServoStyleConstsInlines.h:707
1  xul.dll  nsStyleTransformMatrix::Convert2DPosition  layout/style/nsStyleTransformMatrix.cpp:622
2  xul.dll  mozilla::MotionPathUtils::ResolveMotionPath  layout/base/MotionPathUtils.cpp:524
3  xul.dll  mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties  layout/painting/nsDisplayList.cpp:6176
3  xul.dll  mozilla::nsDisplayTransform::GetResultingTransformMatrix  layout/painting/nsDisplayList.cpp:6193
4  xul.dll  nsIFrame::GetTransformMatrix const  layout/generic/nsIFrame.cpp:7335

The severity field is not set for this bug.
:tlouw, could you have a look please?

For more information, please visit BugBot documentation.

Flags: needinfo?(tlouw)

Boris do you think this might be related to work you've been doing?

Flags: needinfo?(tlouw) → needinfo?(boris.chiou)

The crash report mention we are trying to access a null pointer when calling nsIFrame::HasAnyStateBits. However, the frame pointer should be valid when calling nsDisplayTransform::GetResultingTransformMatrix(this, ...). Not sure what happened.

Also, I didn't update here in 117 and 118., so probably this is regressed from others. I'd keep monitoring this bug.

Flags: needinfo?(boris.chiou)
Severity: -- → S3

About 1/3 of the crashes here (538/1591) over the last 3 months have some value for "Possible Bit Flips Max Confidence".

There are 538 crashes where that field exists out of 1,591 total crashes. Perusing through some of those, I'm seeing crash addresses that end with

So, I think it's reasonable to assume that hardware issues are responsible for at least a portion of the crash volume here.

That pattern continues; 148/339 (44%) of crashes in the past month have some nonzero value for "Possible Bit Flips Max Confidence".

Bug 1906768 has a fuzz testcase that crashes with this same signature.

See Also: → 1906768

Thanks, good find!

That one is a recent regression, though, so it's not likely to be related to the historical crash volume here. (Unfortunately HasStateBits() isn't an especially specific crash signature; a crash with that signature just means some code is dealing with a bogus nsIFrame pointer, essentially.)

Still: good call to link them up with see-also, given the common signature.

You need to log in before you can comment on or make changes to this bug.