Closed Bug 1198798 Opened 10 years ago Closed 10 years ago

crash in mozilla::DisplayItemClip::operator=(mozilla::DisplayItemClip const&)

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Version:
43 Branch
Platform:
x86
Windows NT
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1181135
Tracking Flags:
Tracking Status
firefox43 --- affected

People

(Reporter: tracy, Unassigned)

Details

This bug was filed from the Socorro interface and is report bp-0345959a-2c9d-4bfc-b45d-06daa2150825. ============================================================= This started happening in very low numbers with builds from 2015072703. However, beginning with builds from 2015081706 the volume of this signature on Nightly (Fx43) has gone up notably such that this is now sitting at #4 on the top crash list.
This is bad, it looks like the this pointer is 0x5a5a5a5a. This suggests the clip is being picked up from a freed object. Which might be a freed displayitem.
Or it might be a freed ScrollFrameHelper.
It looks like the clip itself is the deleted object. We're crashing when we're accessing a member of the clip.
It looks like this is bug 1181135.
Status: NEW → RESOLVED
Crash Signature: [@ mozilla::DisplayItemClip::operator=(mozilla::DisplayItemClip const&)]
Closed: 10 years ago
Keywords: crash, topcrash-win
Resolution: --- → DUPLICATE
Group: core-security
Group: core-security
You need to log in before you can comment on or make changes to this bug.