Closed Bug 1904991 Opened 7 months ago Closed 7 months ago

Crash in [@ std::_List_node<T>::_Free_non_head]

Categories

(Core :: Graphics: WebRender, defect)

Product:
Core
Component:
Graphics: WebRender
Platform:
Other
Windows 11
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1748102
Tracking Flags:
Tracking Status
firefox129 --- affected

People

(Reporter: release-mgmt-account-bot, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash)

Crash Data

Crash report: https://crash-stats.mozilla.org/report/index/8e379afa-8a40-4f8a-a7d4-2b5060240626

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  std::_List_node<std::pair<const mozilla::DisplayItemClipChain*const, AutoTArray<mozilla::wr::WrClipId, 4> >, void*>::_Free_non_head  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/list:324
0  xul.dll  std::list<std::pair<const mozilla::DisplayItemClipChain*const, AutoTArray<mozilla::wr::WrClipId, 4> >, std::allocator<std::pair<const mozilla::DisplayItemClipChain*const, AutoTArray<mozilla::wr::WrClipId, 4> > > >::_Tidy  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/list:1500
0  xul.dll  std::list<std::pair<const mozilla::DisplayItemClipChain*const, AutoTArray<mozilla::wr::WrClipId, 4> >, std::allocator<std::pair<const mozilla::DisplayItemClipChain*const, AutoTArray<mozilla::wr::WrClipId, 4> > > >::~list  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/list:1045
0  xul.dll  std::_Hash<std::_Umap_traits<const mozilla::DisplayItemClipChain*, AutoTArray<mozilla::wr::WrClipId, 4>, std::_Uhash_compare<const mozilla::DisplayItemClipChain*, std::hash<const mozilla::DisplayItemClipChain*>, std::equal_to<const mozilla::DisplayItemClipChain*> >, std::allocator<std::pair<const mozilla::DisplayItemClipChain*const, AutoTArray<mozilla::wr::WrClipId, 4> > >, 0> >::~_Hash  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/xhash:330
0  xul.dll  std::_Default_allocator_traits<std::allocator<std::unordered_map<const mozilla::DisplayItemClipChain*, AutoTArray<mozilla::wr::WrClipId, 4>, std::hash<const mozilla::DisplayItemClipChain*>, std::equal_to<const mozilla::DisplayItemClipChain*>, std::allocator<std::pair<const mozilla::DisplayItemClipChain*const, AutoTArray<mozilla::wr::WrClipId, 4> > > > > >::destroy  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/xmemory:736
0  xul.dll  std::deque<std::unordered_map<const mozilla::DisplayItemClipChain*, AutoTArray<mozilla::wr::WrClipId, 4>, std::hash<const mozilla::DisplayItemClipChain*>, std::equal_to<const mozilla::DisplayItemClipChain*>, std::allocator<std::pair<const mozilla::DisplayItemClipChain*const, AutoTArray<mozilla::wr::WrClipId, 4> > > >, std::allocator<std::unordered_map<const mozilla::DisplayItemClipChain*, AutoTArray<mozilla::wr::WrClipId, 4>, std::hash<const mozilla::DisplayItemClipChain*>, std::equal_to<const mozilla::DisplayItemClipChain*>, std::allocator<std::pair<const mozilla::DisplayItemClipChain*const, AutoTArray<mozilla::wr::WrClipId, 4> > > > > >::pop_back  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/deque:1453
1  xul.dll  std::stack<std::unordered_map<const mozilla::DisplayItemClipChain*, AutoTArray<mozilla::wr::WrClipId, 4>, std::hash<const mozilla::DisplayItemClipChain*>, std::equal_to<const mozilla::DisplayItemClipChain*>, std::allocator<std::pair<const mozilla::DisplayItemClipChain*const, AutoTArray<mozilla::wr::WrClipId, 4> > > >, std::deque<std::unordered_map<const mozilla::DisplayItemClipChain*, AutoTArray<mozilla::wr::WrClipId, 4>, std::hash<const mozilla::DisplayItemClipChain*>, std::equal_to<const mozilla::DisplayItemClipChain*>, std::allocator<std::pair<const mozilla::DisplayItemClipChain*const, AutoTArray<mozilla::wr::WrClipId, 4> > > >, std::allocator<std::unordered_map<const mozilla::DisplayItemClipChain*, AutoTArray<mozilla::wr::WrClipId, 4>, std::hash<const mozilla::DisplayItemClipChain*>, std::equal_to<const mozilla::DisplayItemClipChain*>, std::allocator<std::pair<const mozilla::DisplayItemClipChain*const, AutoTArray<mozilla::wr::WrClipId, 4> > > > > > >::pop  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/stack:134
1  xul.dll  mozilla::layers::ClipManager::PopOverrideForASR  gfx/layers/wr/ClipManager.cpp:127
2  xul.dll  mozilla::layers::ClipManager::EndList  gfx/layers/wr/ClipManager.cpp:92
2  xul.dll  mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList  gfx/layers/wr/WebRenderCommandBuilder.cpp:2188

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

  • First crash report: 2024-05-06
  • Process type: Content
  • Is startup crash: No
  • Has user comments: No
  • Is null crash: Yes - all crashes happened on null or near null memory address

The Bugbug bot thinks this bug should belong to the 'Core::Graphics: WebRender' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Component: General → Graphics: WebRender

Signature change of bug 1748102?

See Also: → 1748102

More like the Windows version of the Linux-based fuzzer stacks, I think?

Status: NEW → RESOLVED
Closed: 7 months ago
Duplicate of bug: 1748102
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.