This bug was filed from the Socorro interface and is report bp-ff667cfc-2b23-480b-bec6-964fa0180515. ============================================================= Seen while looking at nightly crash data: https://bit.ly/2rLkEbc. Crashes started using 20180515100038. Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=45ec8fd380dd2c308e79dbb396ca87f2ce9b3f9c&tochange=cf3ee14023483cbbb57129479537c713e22c1980 Bug 1459441 is in that range. Top 10 frames of crashing thread: 0 mozglue.dll MOZ_CrashPrintf mfbt/Assertions.cpp:63 1 xul.dll InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:26 2 xul.dll DirectedAcyclicGraph<OldListUnits>::GetDirectPredecessors layout/painting/RetainedDisplayListHelpers.h:127 3 xul.dll MergeState::ProcessPredecessorsOfOldNode layout/painting/RetainedDisplayListBuilder.cpp:425 4 xul.dll MergeState::ProcessItemFromNewList layout/painting/RetainedDisplayListBuilder.cpp:291 5 xul.dll RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:488 6 xul.dll RetainedDisplayListBuilder::AttemptPartialUpdate layout/painting/RetainedDisplayListBuilder.cpp:1179 7 xul.dll nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:3679 8 xul.dll mozilla::PresShell::Paint layout/base/PresShell.cpp:6350 9 xul.dll nsViewManager::ProcessPendingUpdatesPaint view/nsViewManager.cpp:480 =============================================================

Fairly sure that this is another duplicate of bug 1459997, but leaving it open and we'll see if it drops away once the new assertion patch lands.

:Matt can we get someone assigned to this?

(In reply to Matt Woodrow (:mattwoodrow) from comment #1) > Fairly sure that this is another duplicate of bug 1459997, but leaving it > open and we'll see if it drops away once the new assertion patch lands. FWIW, we were still seeing this on 61.0b13 beta update channel builds.

This is a duplicate of bug 1461832, all the crashes are hitting the release assertion in subspan. This is just a different amount of inlining, leading to a different top frame. The other bug is newer, but already has a comment with my findings thus far.