1862281 - Crash in [@ mozilla::nsDisplayList::AppendToTop]

Status: NEW

(Core :: Web Painting, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/7245f6b4-8ed2-4395-bb54-28c570231026

Reason: EXCEPTION_ACCESS_VIOLATION_WRITE

Top 10 frames of crashing thread:

0  xul.dll  mozilla::nsDisplayList::AppendToTop  layout/painting/nsDisplayList.h:3060
0  xul.dll  mozilla::nsDisplayListCollection::SerializeWithCorrectZOrder  layout/painting/nsDisplayList.cpp:8544
1  xul.dll  nsIFrame::BuildDisplayListForStackingContext  layout/generic/nsIFrame.cpp:3501
2  xul.dll  nsIFrame::BuildDisplayListForChild  layout/generic/nsIFrame.cpp:4255
3  xul.dll  nsFlexContainerFrame::BuildDisplayList  layout/generic/nsFlexContainerFrame.cpp:2896
4  xul.dll  nsIFrame::BuildDisplayListForStackingContext  layout/generic/nsIFrame.cpp:3443
5  xul.dll  nsIFrame::BuildDisplayListForChild  layout/generic/nsIFrame.cpp:4255
6  xul.dll  nsFlexContainerFrame::BuildDisplayList  layout/generic/nsFlexContainerFrame.cpp:2896
7  xul.dll  nsIFrame::BuildDisplayListForStackingContext  layout/generic/nsIFrame.cpp:3443
8  xul.dll  nsIFrame::BuildDisplayListForChild  layout/generic/nsIFrame.cpp:4255

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2023-08-24
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - all crashes happened on null or near null memory address

Comment 1

[Gabriele Svelto [:gsvelto]]

This is one of those cases which it's hard to be sure what's going on. Looking through some crashes I suspect this is a bad hardware scenario, but it's hard to tell as the crashes happen in slightly different places with slightly different reasons.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 10 content process crashes on release

:tnikkel, could you consider increasing the severity of this top-crash bug?

For more information, please visit BugBot documentation.

Comment 3

[Timothy Nikkel (:tnikkel)]

Our good friend family 6 model 183 stepping 1 is responsible for the vast majority of these.

Comment 4

[Timothy Nikkel (:tnikkel)]

And even just one single install time seems to be responsible for the vast majority of these. That person must be having a very sad time.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Based on the topcrash criteria, the crash signature linked to this bug is not a topcrash signature anymore.

For more information, please visit BugBot documentation.