851033 - crash in nsLayoutUtils::DoCompareTreePosition

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P4)

Description

[Scoobidiver (away)]

It has been hit by two FxOS users.

Here is a crash report: bp-b7f21aec-6868-469f-adc5-596572130311.

Frame 	Module 	Signature 	Source
0 	libxul.so 	nsLayoutUtils::DoCompareTreePosition 	nsIFrame.h:747
1 	libxul.so 	nsFrameConstructorState::ProcessFrameInsertions 	nsLayoutUtils.h:219
2 	libxul.so 	nsFrameConstructorState::~nsFrameConstructorState 	nsCSSFrameConstructor.cpp:983
3 	libxul.so 	nsCSSFrameConstructor::ContentRangeInserted 	nsCSSFrameConstructor.cpp:7393
4 	libxul.so 	nsCSSFrameConstructor::RecreateFramesForContent 	nsCSSFrameConstructor.cpp:6852
5 	libxul.so 	nsCSSFrameConstructor::ProcessRestyledFrames 	nsCSSFrameConstructor.cpp:8108
6 	libxul.so 	nsCSSFrameConstructor::RestyleElement 	nsCSSFrameConstructor.cpp:8258
7 	libxul.so 	mozilla::css::RestyleTracker::ProcessOneRestyle 	RestyleTracker.cpp:124
8 	libxul.so 	mozilla::css::RestyleTracker::DoProcessRestyles 	RestyleTracker.cpp:209
9 	libxul.so 	nsCSSFrameConstructor::ProcessPendingRestyles 	RestyleTracker.h:68
10 	libxul.so 	PresShell::FlushPendingNotifications 	nsPresShell.cpp:3872
11 	libxul.so 	nsRefreshDriver::Notify 	nsRefreshDriver.cpp:386
12 	libxul.so 	nsTimerImpl::Fire 	nsTimerImpl.cpp:476
13 	libxul.so 	nsTimerEvent::Run 	nsTimerImpl.cpp:556
14 	libxul.so 	nsThread::ProcessNextEvent 	nsThread.cpp:620
15 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:237
16 	libxul.so 	mozilla::ipc::MessagePump::Run 	MessagePump.cpp:82
17 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	MessagePump.cpp:231
18 	libxul.so 	MessageLoop::RunInternal 	message_loop.cc:216
19 	libxul.so 	MessageLoop::Run 	message_loop.cc:209
20 	libxul.so 	nsBaseAppShell::Run 	nsBaseAppShell.cpp:163
21 	libxul.so 	XRE_RunAppShell 	nsEmbedFunctions.cpp:646
22 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	MessagePump.cpp:198
23 	libxul.so 	MessageLoop::RunInternal 	message_loop.cc:216
24 	libxul.so 	MessageLoop::Run 	message_loop.cc:209
25 	libxul.so 	XRE_InitChildProcess 	nsEmbedFunctions.cpp:485
26 	plugin-container 	main 	ipc/app/MozillaRuntimeMain.cpp:48
27 	libc.so 	__libc_init 	libc_init_dynamic.c:114
28 		@0xb0001dc5 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsLayoutUtils%3A%3ADoCompareTreePosition

Comment 1

[bhavana bajaj [:bajaj]]

Without STR here and since this is not an exploitable crash, not a blocker.Until we get a top-crash criteria its hard to look at these and block on them.Please renominate if STR are found .

Comment 2

[Mats Palmgren (inactive)]

The remaining crashes seems more like a Layout bug to me,
e.g. bp-7a24e264-fb2b-4e4a-8709-a4f4f0180530:
nsLayoutUtils::DoCompareTreePosition(nsIContent*, nsIContent*, int, int, nsIContent const*)
nsLayoutUtils::FindSiblingViewFor(nsView*, nsIFrame*)
nsFrame::CreateView()
nsSubDocumentFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*)
nsCSSFrameConstructor::InitAndRestoreFrame(nsFrameConstructorState const&, nsIContent*, nsContainerFrame*, nsIFrame*, bool)

The crash volume is very low though.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.