1909776 - Crash in [@ nsTArray_Impl<T>::~nsTArray_Impl | mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible]

Status: NEW

(Core :: Layout, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/2be6cd4e-8759-4c40-8a16-e0de30240724

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_RelocateUsingMemutils>::IsEmpty const  xpcom/ds/nsTArray.h:400
0  xul.dll  nsTArray_Impl<mozilla::FrameChildList, nsTArrayInfallibleAllocator>::~nsTArray_Impl  xpcom/ds/nsTArray.h:1032
0  xul.dll  mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible  layout/base/PresShell.cpp:6067
1  xul.dll  mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible  layout/base/PresShell.cpp:6092
2  xul.dll  mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible  layout/base/PresShell.cpp:6092
3  xul.dll  mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible  layout/base/PresShell.cpp:6092
4  xul.dll  mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible  layout/base/PresShell.cpp:6092
5  xul.dll  mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible  layout/base/PresShell.cpp:6092
6  xul.dll  mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible  layout/base/PresShell.cpp:6092
7  xul.dll  mozilla::PresShell::MarkFramesInSubtreeApproximatelyVisible  layout/base/PresShell.cpp:6092

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-05-21
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 3 out of 4 crashes happened on null or near null memory address

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Layout' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jfkthame, could you have a look please?

For more information, please visit BugBot documentation.

Comment 3

[Daniel Holbert [:dholbert]]

Of the 99 crashes in the past 6 months, 97 of them (i.e. 98%) are all with the same "CPU Info": family 6 model 183 stepping 1

That's the same model as in bug 1898999 comment 7.

--> This seems likely to be a CPU bug. Calling stalled and marking as S4.

Comment 4

[Wayne Mery (:wsmwk)]

No crashes recorded for this since 2024-08-31