1873572 - Crash in [@ mozilla::MergeState::AddNewNode]

Status: NEW

(Core :: Web Painting, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/b685b63c-1b0e-4c64-a4a6-3dc8a0240106

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(!i->IsMergedItem())

Top 10 frames of crashing thread:

0  libxul.so  mozilla::MergeState::AddNewNode  layout/painting/RetainedDisplayListBuilder.cpp:654
1  libxul.so  mozilla::MergeState::ProcessOldNode  layout/painting/RetainedDisplayListBuilder.cpp:684
2  libxul.so  mozilla::MergeState::ProcessPredecessorsOfOldNode  layout/painting/RetainedDisplayListBuilder.cpp:725
3  libxul.so  mozilla::MergeState::ProcessItemFromNewList  layout/painting/RetainedDisplayListBuilder.cpp:484
3  libxul.so  mozilla::RetainedDisplayListBuilder::MergeDisplayLists  layout/painting/RetainedDisplayListBuilder.cpp:825
4  libxul.so  mozilla::MergeState::MergeChildLists  layout/painting/RetainedDisplayListBuilder.cpp:509
4  libxul.so  mozilla::MergeState::ProcessItemFromNewList  layout/painting/RetainedDisplayListBuilder.cpp:481
4  libxul.so  mozilla::RetainedDisplayListBuilder::MergeDisplayLists  layout/painting/RetainedDisplayListBuilder.cpp:825
5  libxul.so  mozilla::RetainedDisplayListBuilder::AttemptPartialUpdate  layout/painting/RetainedDisplayListBuilder.cpp:1674
5  libxul.so  nsLayoutUtils::PaintFrame  layout/base/nsLayoutUtils.cpp:3329

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2023-12-13
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - all crashes happened on null or near null memory address

Comment 1

[Timothy Nikkel (:tnikkel)]

Crash volume is not very high.

About 10% of the crashes have a non zero bit flip confidence value, indicating there is non-zero hardware error in these crashes.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 10 desktop browser crashes on nightly

:tnikkel, could you consider increasing the severity of this top-crash bug?

For more information, please visit BugBot documentation.

Comment 3

[Timothy Nikkel (:tnikkel)]

Based on install times seems like a small handful of machines hitting the same crash many many times. ie 31 times, 24 times, 19 times for one install time.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Based on the topcrash criteria, the crash signature linked to this bug is not a topcrash signature anymore.

For more information, please visit BugBot documentation.