If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

crash in mozilla::InternalInvalidateThebesLayersInSubtree , Firefox17b1 crashes when I canceled login to Facebook

VERIFIED FIXED

Status

()

Core
Layout
--
blocker
VERIFIED FIXED
5 years ago
5 years ago

People

(Reporter: Alice0775 White, Unassigned)

Tracking

(4 keywords)

17 Branch
crash, regression, reproducible, topcrash
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox16 unaffected, firefox17+ verified, firefox18 unaffected)

Details

(crash signature)

(Reporter)

Description

5 years ago
This bug was filed from the Socorro interface and is 
report bp-2056b9e7-1591-41d7-bff4-fd60f2121010 .
============================================================= 

Firefox17b1 crashes.
However, Aurora18.a2 and Nightly19.0a1 do not crash.

Reproducible: Always

Steps To reproduce:
1. Start Firefox with clean profile
2. Open http://www.facebook.com/alice.white.3382
3. "To connect with Alice, sign up for Facebook today. Log In Sin UP" dialog pops up
4. Click "Close" blue button
(Reporter)

Comment 1

5 years ago
bp-c2e29a58-c179-4a36-a615-e3e542121010
bp-c61d741d-0ae7-45c2-bf7d-ab3f42121010
(Reporter)

Updated

5 years ago
Keywords: reproducible
(Reporter)

Updated

5 years ago
Summary: crash in mozilla::InternalInvalidateThebesLayersInSubtree → crash in mozilla::InternalInvalidateThebesLayersInSubtree , Firefox17b1 crashes when I canceled login to Facebook
(Reporter)

Comment 2

5 years ago
Regression window(beta channel)
Good:
http://hg.mozilla.org/releases/mozilla-beta/rev/62cd5d1049f7
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20121008 Firefox/16.0 ID:20121008111035
Crash:
http://hg.mozilla.org/releases/mozilla-beta/rev/f335e7dacdc1
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20121008113033
Pushlog:
http://hg.mozilla.org/releases/mozilla-beta/pushloghtml?fromchange=62cd5d1049f7&tochange=f335e7dacdc1
(Reporter)

Comment 3

5 years ago
Regression window(aurora channel)
Good:
http://hg.mozilla.org/releases/mozilla-aurora/rev/7b56051aeb49
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20121008082334
Crash:
http://hg.mozilla.org/releases/mozilla-aurora/rev/7f293a7c521d
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20121008085633
Pushlog:
http://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?fromchange=7b56051aeb49&tochange=7f293a7c521d

Triggered by:
7f293a7c521d	Robert O'Callahan — Bug 786740 - Fix invalidations on out-of-flow frames. r=cwiiis a=akeybl We invalidate following the frame-tree, but we build the display-list following placeholder frames, so if any non-shared ancestors of the placeholder and out-of-flow frames aren't shared, and they create container layers, invalidations will be lost. Fix this by checking if any of the ancestors of placeholder frames for out-of-flow frames have container layers and doing a full invalidation on the first frame we find that satisfies this condition.
Blocks: 786740
(Reporter)

Updated

5 years ago
Component: Layout: View Rendering → Graphics: Layers
OS: Windows NT → Windows 7

Updated

5 years ago
Component: Graphics: Layers → Layout
Keywords: regression
OS: Windows 7 → All
Hardware: x86 → All

Comment 4

5 years ago
It's currently #1 top crasher in 17.0b1 (hit by 20 users).
Severity: critical → blocker
Keywords: topcrash
Mozilla/5.0 (Windows NT 6.0; rv:17.0) Gecko/17.0 Firefox/17.0

On Windows Vista - I got this crash just by scrolling between the posts and notifications on my Facebook homepage.

https://crash-stats.mozilla.com/report/index/bp-0f270103-37f7-4ab0-9b7e-c3ac72121010
https://crash-stats.mozilla.com/report/index/bp-59a20164-db88-435d-96e4-0fe682121010
https://crash-stats.mozilla.com/report/index/bp-9192edb7-c432-41d6-b8bc-614172121010
https://crash-stats.mozilla.com/report/index/bp-249544be-7633-4778-b0ac-59f612121010
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/17.0 Firefox/17.0

Reproducible on Mac OS X 10.6. I scrolled through notifications on Home page and tried to open a picture and it crashed.

https://crash-stats.mozilla.com/report/index/bp-f50029df-9f4a-4694-866a-a1c812121010

Updated

5 years ago
status-firefox16: --- → unaffected
status-firefox17: --- → affected
status-firefox18: --- → unaffected

Updated

5 years ago
tracking-firefox17: ? → +

Comment 7

5 years ago
Interesting stack - it crashes when it gets the frame properties... Will have a look.

Comment 8

5 years ago
Backed out: https://hg.mozilla.org/releases/mozilla-beta/rev/4aeb1704699f
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Simona, please verify this is fixed with the next Beta builds.
status-firefox17: affected → fixed
Keywords: verifyme
QA Contact: simona.marcu
Verified on Firefox 17 beta 1 build 2 that the crash does not occur when:
- following the steps from the Description
- scrolling through the notifications and posts on the Home page (as mentioned in Comment 5) 
- opening any photos (as mentioned in Comment 6)

Verified on Windows 7. Ubuntu 12.04 and Mac OS X 10.7:
Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/17.0 Firefox/17.0
Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/17.0 Firefox/17.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/17.0 Firefox/17.0
status-firefox17: fixed → verified
It would be nice to have a reduced testcase for this crash for our regression
test suite, since apparently this is an edge case we don't have coverage for.
Flags: in-testsuite?
Keywords: testcase-wanted
There is a crashtest in my patch in bug 786740.
Ah, indeed there is, thanks!
Keywords: testcase-wanted
Marking verified fixed based on comment 10.
Status: RESOLVED → VERIFIED
Keywords: verifyme

Updated

5 years ago
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.