747054 - crash in nsHTMLReflowState::InitResizeFlags

Status: RESOLVED INCOMPLETE

(Core :: Layout, defect)

Description

[Robert Kaiser]

This bug was filed from the Socorro interface and is 
report bp-2b3a0b24-f12b-49dd-a345-ef6ba2120419 .
============================================================= 

I saw a number of crashes on 13.0a2 with a stack like this:

0 		@0x2fbab0ff 	
1 		@0x106b319f 	
2 	xul.dll 	nsHTMLReflowState::InitResizeFlags 	layout/generic/nsHTMLReflowState.cpp:412
3 	xul.dll 	ViewportFrame::Reflow 	layout/generic/nsViewportFrame.cpp:231

There are other stacks with the same signature in other versions, including 11, see https://crash-stats.mozilla.com/report/list?signature=nsHTMLReflowState%3A%3AInitResizeFlags%28nsPresContext*%2C%20nsIAtom*%29 - not sure if those are the same thing or not.

Comment 1

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

This would be sg:crit if we had a testcase.

Comment 2

[(no longer active)]

Presumably this would happen if the frame pointer is bogus, but I don't see why we would not crash earlier in that case...  Maybe someone needs to look at the crash dump file to see if we can find out what's happening?

Comment 3

[Daniel Veditz [:dveditz]]

crash-stats is showing this signature (at small numbers) going back to 10, and a large number of people on Firefox 11.

Comment 4

[(no longer active)]

I grabbed a few of these crash dumps, and I will look into them tomorrow to see if I can find any evidence of what causes this.

Comment 5

[(no longer active)]

FWIW, I was not able to find anything of value.

Comment 6

[Daniel Veditz [:dveditz]]

This bug is going nowhere, probably not much point staying open.