1862281 - Crash in [@ mozilla::nsDisplayList::AppendToTop]

Status: NEW

(Core :: Web Painting, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/7245f6b4-8ed2-4395-bb54-28c570231026

Reason: EXCEPTION_ACCESS_VIOLATION_WRITE

Top 10 frames of crashing thread:

0  xul.dll  mozilla::nsDisplayList::AppendToTop  layout/painting/nsDisplayList.h:3060
0  xul.dll  mozilla::nsDisplayListCollection::SerializeWithCorrectZOrder  layout/painting/nsDisplayList.cpp:8544
1  xul.dll  nsIFrame::BuildDisplayListForStackingContext  layout/generic/nsIFrame.cpp:3501
2  xul.dll  nsIFrame::BuildDisplayListForChild  layout/generic/nsIFrame.cpp:4255
3  xul.dll  nsFlexContainerFrame::BuildDisplayList  layout/generic/nsFlexContainerFrame.cpp:2896
4  xul.dll  nsIFrame::BuildDisplayListForStackingContext  layout/generic/nsIFrame.cpp:3443
5  xul.dll  nsIFrame::BuildDisplayListForChild  layout/generic/nsIFrame.cpp:4255
6  xul.dll  nsFlexContainerFrame::BuildDisplayList  layout/generic/nsFlexContainerFrame.cpp:2896
7  xul.dll  nsIFrame::BuildDisplayListForStackingContext  layout/generic/nsIFrame.cpp:3443
8  xul.dll  nsIFrame::BuildDisplayListForChild  layout/generic/nsIFrame.cpp:4255

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2023-08-24
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - all crashes happened on null or near null memory address

Comment 1

[Gabriele Svelto [:gsvelto]]

This is one of those cases which it's hard to be sure what's going on. Looking through some crashes I suspect this is a bad hardware scenario, but it's hard to tell as the crashes happen in slightly different places with slightly different reasons.