Closed Bug 799856 Opened 13 years ago Closed 13 years ago

crash in mozilla::InternalInvalidateThebesLayersInSubtree , Firefox17b1 crashes when I canceled login to Facebook

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Version:
17 Branch
Type:
defect
Priority:
Not set
Severity:
blocker

Tracking

()

Status:
VERIFIED FIXED
Tracking Flags:
Tracking Status
firefox16 --- unaffected
firefox17 + verified
firefox18 --- unaffected

People

(Reporter: alice0775, Unassigned)

References

Details

(4 keywords)

Crash Data

This bug was filed from the Socorro interface and is report bp-2056b9e7-1591-41d7-bff4-fd60f2121010 . ============================================================= Firefox17b1 crashes. However, Aurora18.a2 and Nightly19.0a1 do not crash. Reproducible: Always Steps To reproduce: 1. Start Firefox with clean profile 2. Open http://www.facebook.com/alice.white.3382 3. "To connect with Alice, sign up for Facebook today. Log In Sin UP" dialog pops up 4. Click "Close" blue button
Keywords: reproducible
Summary: crash in mozilla::InternalInvalidateThebesLayersInSubtree → crash in mozilla::InternalInvalidateThebesLayersInSubtree , Firefox17b1 crashes when I canceled login to Facebook
Regression window(beta channel) Good: http://hg.mozilla.org/releases/mozilla-beta/rev/62cd5d1049f7 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20121008 Firefox/16.0 ID:20121008111035 Crash: http://hg.mozilla.org/releases/mozilla-beta/rev/f335e7dacdc1 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20121008113033 Pushlog: http://hg.mozilla.org/releases/mozilla-beta/pushloghtml?fromchange=62cd5d1049f7&tochange=f335e7dacdc1
Regression window(aurora channel) Good: http://hg.mozilla.org/releases/mozilla-aurora/rev/7b56051aeb49 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20121008082334 Crash: http://hg.mozilla.org/releases/mozilla-aurora/rev/7f293a7c521d Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20121008085633 Pushlog: http://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?fromchange=7b56051aeb49&tochange=7f293a7c521d Triggered by: 7f293a7c521d Robert O'Callahan — Bug 786740 - Fix invalidations on out-of-flow frames. r=cwiiis a=akeybl We invalidate following the frame-tree, but we build the display-list following placeholder frames, so if any non-shared ancestors of the placeholder and out-of-flow frames aren't shared, and they create container layers, invalidations will be lost. Fix this by checking if any of the ancestors of placeholder frames for out-of-flow frames have container layers and doing a full invalidation on the first frame we find that satisfies this condition.
Blocks: 786740
Component: Layout: View Rendering → Graphics: Layers
OS: Windows NT → Windows 7
Component: Graphics: Layers → Layout
Keywords: regression
OS: Windows 7 → All
Hardware: x86 → All
It's currently #1 top crasher in 17.0b1 (hit by 20 users).
Severity: critical → blocker
Keywords: topcrash
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/17.0 Firefox/17.0 Reproducible on Mac OS X 10.6. I scrolled through notifications on Home page and tried to open a picture and it crashed. https://crash-stats.mozilla.com/report/index/bp-f50029df-9f4a-4694-866a-a1c812121010
Interesting stack - it crashes when it gets the frame properties... Will have a look.
Backed out: https://hg.mozilla.org/releases/mozilla-beta/rev/4aeb1704699f
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Simona, please verify this is fixed with the next Beta builds.
status-firefox17: affected → fixed
Keywords: verifyme
QA Contact: simona.marcu
Verified on Firefox 17 beta 1 build 2 that the crash does not occur when: - following the steps from the Description - scrolling through the notifications and posts on the Home page (as mentioned in Comment 5) - opening any photos (as mentioned in Comment 6) Verified on Windows 7. Ubuntu 12.04 and Mac OS X 10.7: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/17.0 Firefox/17.0 Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/17.0 Firefox/17.0 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/17.0 Firefox/17.0
status-firefox17: fixed → verified
It would be nice to have a reduced testcase for this crash for our regression test suite, since apparently this is an edge case we don't have coverage for.
Flags: in-testsuite?
Keywords: testcase-wanted
There is a crashtest in my patch in bug 786740.
Ah, indeed there is, thanks!
Keywords: testcase-wanted
Marking verified fixed based on comment 10.
Status: RESOLVED → VERIFIED
Keywords: verifyme
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.