702248 - Crash in nsHTMLEditor::HasStyleOrIdOrClass

Status: RESOLVED WONTFIX

(Firefox for Android Graveyard :: General, defect)

Description

[Scoobidiver (away)]

With combined crash signatures, it's #2 top content crasher in Fennec 8.0.

There are two crash signatures:
Frame 	Module 	Signature [Expand] 	Source
0 	libmozalloc.so 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:66
1 	libc.so 	__swrite 	
2 		@0xfffffffd 	
3 	org.mozilla.firefox-2.apk 	org.mozilla.firefox-2.apk@0x11f011f 	
4 	libxul.so 	nsHTMLEditor::HasStyleOrIdOrClass 	editor/libeditor/html/nsHTMLEditorStyle.cpp:1920
5 		@0xbea62986 	
6 	libxul.so 	nsLayoutUtils::RoundedRectIntersectRect 	nsRegion.h:135
7 	libxul.so 	nsDisplayBackground::GetInsideClipRegion 	layout/base/nsDisplayList.cpp:1091
8 		@0x3e 	
9 	libmozalloc.so 	arena_malloc 	memory/jemalloc/jemalloc.c:3783
10 	libmozalloc.so 	malloc_mutex_unlock 	memory/jemalloc/jemalloc.c:1479
11 	libmozalloc.so 	arena_malloc 	memory/jemalloc/jemalloc.c:3783
12 	libxul.so 	base::RefCountedThreadSafe<base::MessagePump>::Release 	ipc/chromium/src/base/ref_counted.h:106
13 	libxul.so 	MessageLoop::PostTask_Helper 	ipc/chromium/src/base/ref_counted.h:196
14 	libmozalloc.so 	malloc_mutex_unlock 	memory/jemalloc/jemalloc.c:1479
15 	libmozalloc.so 	arena_dalloc 	memory/jemalloc/jemalloc.c:4255
16 	libmozalloc.so 	je_free 	memory/jemalloc/jemalloc.c:6200
17 	libmozalloc.so 	moz_free 	memory/mozalloc/mozalloc.cpp:104
...

Frame 	Module 	Signature [Expand] 	Source
0 	libmozalloc.so 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:66
1 	libc.so 	__swrite 	
2 		@0xfffffffd 	
3 	org.mozilla.firefox-1.apk 	org.mozilla.firefox-1.apk@0x11f011f 	
4 	libxul.so 	nsHTMLEditor::HasStyleOrIdOrClass 	editor/libeditor/html/nsHTMLEditorStyle.cpp:1920

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozalloc_abort%20|%20__swrite%20|%20org.mozilla.firefox-2.apk%400x11f011f
https://crash-stats.mozilla.com/report/list?signature=mozalloc_abort%20|%20__swrite%20|%20org.mozilla.firefox-1.apk%400x11f011f

Comment 1

[Scoobidiver (away)]

With combined signatures, it's #3 top crasher in 8.0.

Comment 2

[(no longer active)]

This stack is bogus...

Comment 3

[Scoobidiver (away)]

It's #46 top crasher in 9.0.

Comment 4

[BMO Automation]

Closing all opened bug in a graveyard component