crash in nsLayoutUtils::DoCompareTreePosition

NEW
Unassigned

Status

()

P4
critical
6 years ago
5 months ago

People

(Reporter: scoobidiver, Unassigned)

Tracking

({crash})

unspecified
crash
Points:
---

Firefox Tracking Flags

(blocking-b2g:-)

Details

(crash signature)

(Reporter)

Description

6 years ago
It has been hit by two FxOS users.

Here is a crash report: bp-b7f21aec-6868-469f-adc5-596572130311.

Frame 	Module 	Signature 	Source
0 	libxul.so 	nsLayoutUtils::DoCompareTreePosition 	nsIFrame.h:747
1 	libxul.so 	nsFrameConstructorState::ProcessFrameInsertions 	nsLayoutUtils.h:219
2 	libxul.so 	nsFrameConstructorState::~nsFrameConstructorState 	nsCSSFrameConstructor.cpp:983
3 	libxul.so 	nsCSSFrameConstructor::ContentRangeInserted 	nsCSSFrameConstructor.cpp:7393
4 	libxul.so 	nsCSSFrameConstructor::RecreateFramesForContent 	nsCSSFrameConstructor.cpp:6852
5 	libxul.so 	nsCSSFrameConstructor::ProcessRestyledFrames 	nsCSSFrameConstructor.cpp:8108
6 	libxul.so 	nsCSSFrameConstructor::RestyleElement 	nsCSSFrameConstructor.cpp:8258
7 	libxul.so 	mozilla::css::RestyleTracker::ProcessOneRestyle 	RestyleTracker.cpp:124
8 	libxul.so 	mozilla::css::RestyleTracker::DoProcessRestyles 	RestyleTracker.cpp:209
9 	libxul.so 	nsCSSFrameConstructor::ProcessPendingRestyles 	RestyleTracker.h:68
10 	libxul.so 	PresShell::FlushPendingNotifications 	nsPresShell.cpp:3872
11 	libxul.so 	nsRefreshDriver::Notify 	nsRefreshDriver.cpp:386
12 	libxul.so 	nsTimerImpl::Fire 	nsTimerImpl.cpp:476
13 	libxul.so 	nsTimerEvent::Run 	nsTimerImpl.cpp:556
14 	libxul.so 	nsThread::ProcessNextEvent 	nsThread.cpp:620
15 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:237
16 	libxul.so 	mozilla::ipc::MessagePump::Run 	MessagePump.cpp:82
17 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	MessagePump.cpp:231
18 	libxul.so 	MessageLoop::RunInternal 	message_loop.cc:216
19 	libxul.so 	MessageLoop::Run 	message_loop.cc:209
20 	libxul.so 	nsBaseAppShell::Run 	nsBaseAppShell.cpp:163
21 	libxul.so 	XRE_RunAppShell 	nsEmbedFunctions.cpp:646
22 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	MessagePump.cpp:198
23 	libxul.so 	MessageLoop::RunInternal 	message_loop.cc:216
24 	libxul.so 	MessageLoop::Run 	message_loop.cc:209
25 	libxul.so 	XRE_InitChildProcess 	nsEmbedFunctions.cpp:485
26 	plugin-container 	main 	ipc/app/MozillaRuntimeMain.cpp:48
27 	libc.so 	__libc_init 	libc_init_dynamic.c:114
28 		@0xb0001dc5 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsLayoutUtils%3A%3ADoCompareTreePosition
Without STR here and since this is not an exploitable crash, not a blocker.Until we get a top-crash criteria its hard to look at these and block on them.Please renominate if STR are found .
blocking-b2g: leo? → -

Comment 2

5 months ago
The remaining crashes seems more like a Layout bug to me,
e.g. bp-7a24e264-fb2b-4e4a-8709-a4f4f0180530:
nsLayoutUtils::DoCompareTreePosition(nsIContent*, nsIContent*, int, int, nsIContent const*)
nsLayoutUtils::FindSiblingViewFor(nsView*, nsIFrame*)
nsFrame::CreateView()
nsSubDocumentFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*)
nsCSSFrameConstructor::InitAndRestoreFrame(nsFrameConstructorState const&, nsIContent*, nsContainerFrame*, nsIFrame*, bool)

The crash volume is very low though.
Component: CSS Parsing and Computation → Layout
OS: Gonk (Firefox OS) → All
Priority: -- → P4
Hardware: ARM → All
Whiteboard: [b2g-crash]
Version: 18 Branch → unspecified
You need to log in before you can comment on or make changes to this bug.