Created attachment 1178576 [details]
File: backtrace

Created attachment 1178577 [details]
File: cgroup

Created attachment 1178578 [details]
File: core_backtrace

Created attachment 1178579 [details]
File: dso_list

Created attachment 1178580 [details]
File: environ

Created attachment 1178581 [details]
File: limits

Created attachment 1178582 [details]
File: maps

Created attachment 1178583 [details]
File: mountinfo

Created attachment 1178584 [details]
File: namespaces

Created attachment 1178585 [details]
File: open_fds

Created attachment 1178586 [details]
File: proc_pid_status

Created attachment 1178587 [details]
File: var_log_messages

Same things happens with acceleration turned on.

*** Bug 1374850 has been marked as a duplicate of this bug. ***

Can you try v48, or possibly even v49 from rawhide/f26

[root@mammon-juno ~]# rpm -q firefox
firefox-48.0.1-1.fc25.aarch64
[root@mammon-juno ~]# firefox 
Segmentation fault (core dumped)
gdb /usr/lib64/firefox/firefox core.firefox.1473783380.14629
(trimming)
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/usr/lib64/firefox/firefox'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  raise (sig=sig@entry=11) at ../sysdeps/unix/sysv/linux/raise.c:58
58      }
[Current thread is 1 (Thread 0x3ff80815070 (LWP 14629))]
(gdb) bt
#0  raise (sig=sig@entry=11) at ../sysdeps/unix/sysv/linux/raise.c:58
#1  0x000003ff7c521c4c in nsProfileLock::FatalSignalHandler (signo=11, info=0x3ffd61162e0, context=0x3ffd6116360) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/toolkit/profile/nsProfileLock.cpp:181
#2  <signal handler called>
#3  0x000003ff7c079c04 in nsLayoutUtils::GetLastSibling (aFrame=0xe5e5e5e5e5e5e5e5) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/layout/base/nsLayoutUtils.cpp:1914
#4  0x000003ff7c0f2d54 in nsFrameList::SetFrames (this=0x3ffd6117c78, aFrameList=<optimized out>) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/layout/generic/nsFrameList.cpp:68
#5  0x000003ff7c03e798 in nsFrameConstructorState::AddChild (this=0x3ffd61181d8, aNewFrame=0x3ff61e5e930, aFrameItems=..., aContent=0x3ff5e466820, aStyleContext=0x3ff61e5e5c0, aParentFrame=
    0x3ff61e41c40, aCanBePositioned=<optimized out>, aCanBeFloated=<optimized out>, aIsOutOfFlowPopup=false, aInsertAfter=false, aInsertAfterFrame=0x0)
    at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/layout/base/nsCSSFrameConstructor.cpp:1302
#6  0x000003ff7c0604ac in nsCSSFrameConstructor::ConstructFrameFromItemInternal (this=this@entry=0x3ff68b37780, aItem=..., aState=..., aParentFrame=0x3ff61e41c40, aFrameItems=...)
    at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/layout/base/nsCSSFrameConstructor.cpp:3937
#7  0x000003ff7c060c58 in nsCSSFrameConstructor::ConstructFramesFromItem (this=0x3ff68b37780, aState=..., aIter=..., aParentFrame=0x3ff61e41c40, aFrameItems=...)
    at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/layout/base/nsCSSFrameConstructor.cpp:6081
#8  0x000003ff7c0612d8 in nsCSSFrameConstructor::ConstructFramesFromItemList (this=this@entry=0x3ff68b37780, aState=..., aItems=..., aParentFrame=aParentFrame@entry=0x3ff61e41c40, aFrameItems=...)
    at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/layout/base/nsCSSFrameConstructor.cpp:10498
#9  0x000003ff7c05f954 in nsCSSFrameConstructor::ProcessChildren (this=0x3ff68b37780, aState=..., aContent=0x3ff5e4660d0, aStyleContext=<optimized out>, aFrame=0x3ff61e41c40, 
    aCanHaveGeneratedContent=true, aFrameItems=..., aAllowBlockStyles=<optimized out>, aPendingBinding=0x3ff5e447f20, aPossiblyLeafFrame=0x3ff61e41c40)
    at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/layout/base/nsCSSFrameConstructor.cpp:10699
#10 0x000003ff7c0608f4 in nsCSSFrameConstructor::ConstructFrameFromItemInternal (this=this@entry=0x3ff68b37780, aItem=..., aState=..., aParentFrame=<optimized out>, aFrameItems=...)
    at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/layout/base/nsCSSFrameConstructor.cpp:4002
#11 0x000003ff7c060c58 in nsCSSFrameConstructor::ConstructFramesFromItem (this=0x3ff68b37780, aState=..., aIter=..., aParentFrame=0x3ff61e41440, aFrameItems=...)
    at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/layout/base/nsCSSFrameConstructor.cpp:6081
#12 0x000003ff7c0612d8 in nsCSSFrameConstructor::ConstructFramesFromItemList (this=0x3ff68b37780, aState=..., aItems=..., aParentFrame=0x3ff61e41440, aFrameItems=...)
    at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/layout/base/nsCSSFrameConstructor.cpp:10498
#13 0x000003ff7c062044 in nsCSSFrameConstructor::CreateAnonymousFrames (this=this@entry=0x3ff68b37780, aState=..., aParent=aParent@entry=0x3ff618f7730, aParentFrame=aParentFrame@entry=0x3ff61e41440, 
    aPendingBinding=aPendingBinding@entry=0x0, aChildItems=...) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/layout/base/nsCSSFrameConstructor.cpp:4132
#14 0x000003ff7c06258c in nsCSSFrameConstructor::BeginBuildingScrollFrame (this=0x3ff68b37780, aState=..., aContent=0x3ff618f7730, aContentStyle=0x3ff61e40140, aParentFrame=<optimized out>, 
    aScrolledPseudo=0x3ff6ea92620, aIsRoot=<optimized out>, aNewFrame=@0x3ffd61181b8: 0x0) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/layout/base/nsCSSFrameConstructor.cpp:4540
#15 0x000003ff7c062768 in nsCSSFrameConstructor::SetUpDocElementContainingBlock (this=this@entry=0x3ff68b37780, aDocElement=aDocElement@entry=0x3ff618f7730)
    at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/layout/base/nsCSSFrameConstructor.cpp:2875
#16 0x000003ff7c068d50 in nsCSSFrameConstructor::ConstructDocElementFrame (this=0x3ff68b37780, aDocElement=0x3ff618f7730, aFrameState=0x0)
    at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/layout/base/nsCSSFrameConstructor.cpp:2411
#17 0x000003ff7c069cb8 in nsCSSFrameConstructor::ContentRangeInserted (this=0x3ff68b37780, aContainer=aContainer@entry=0x0, aStartChild=aStartChild@entry=0x3ff618f7730, aEndChild=0x0, 
    aFrameState=aFrameState@entry=0x0, aAllowLazyConstruction=aAllowLazyConstruction@entry=false) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/layout/base/nsCSSFrameConstructor.cpp:7631
#18 0x000003ff7c06a458 in nsCSSFrameConstructor::ContentInserted (this=<optimized out>, aContainer=aContainer@entry=0x0, aChild=aChild@entry=0x3ff618f7730, aFrameState=aFrameState@entry=0x0, 
    aAllowLazyConstruction=aAllowLazyConstruction@entry=false) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/layout/base/nsCSSFrameConstructor.cpp:7521
#19 0x000003ff7c0af864 in PresShell::Initialize (this=0x3ff61853800, aWidth=<optimized out>, aHeight=<optimized out>) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/layout/base/nsPresShell.cpp:1685
#20 0x000003ff7af173dc in nsContentSink::StartLayout (this=<optimized out>, aIgnorePendingSheets=aIgnorePendingSheets@entry=false, this=<optimized out>)
    at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/dom/base/nsContentSink.cpp:1216
#21 0x000003ff7abedf20 in nsHtml5TreeOpExecutor::StartLayout (this=this@entry=0x3ff61852400) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/parser/html/nsHtml5TreeOpExecutor.cpp:614
#22 0x000003ff7ac0d344 in nsHtml5TreeOperation::Perform (this=0x3ff6185bad8, aBuilder=0x3ff61852400, aScriptElement=<optimized out>)
    at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/parser/html/nsHtml5TreeOperation.cpp:991
#23 0x000003ff7ac09898 in nsHtml5TreeOpExecutor::RunFlushLoop (this=0x3ff61852400) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/parser/html/nsHtml5TreeOpExecutor.cpp:451
#24 0x000003ff7ac09be0 in nsHtml5ExecutorFlusher::Run (this=<optimized out>) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/parser/html/nsHtml5StreamParser.cpp:125
#25 0x000003ff7a5d6400 in nsThread::ProcessNextEvent (this=0x3ff7db60eb0, aMayWait=<optimized out>, aResult=0x3ffd6118e97) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/xpcom/threads/nsThread.cpp:994
#26 0x000003ff7a5f9184 in NS_ProcessNextEvent (aThread=<optimized out>, aThread@entry=0x3ff7db60eb0, aMayWait=aMayWait@entry=false)
    at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/xpcom/glue/nsThreadUtils.cpp:290
#27 0x000003ff7a83d3c4 in mozilla::ipc::MessagePump::Run (this=0x3ff7e786f40, aDelegate=0x3ff70860080) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/ipc/glue/MessagePump.cpp:98
#28 0x000003ff7a820b1c in MessageLoop::Run (this=<optimized out>) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/ipc/chromium/src/base/message_loop.cc:230
#29 0x000003ff7be19b44 in nsBaseAppShell::Run (this=0x3ff6ac255c0) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/widget/nsBaseAppShell.cpp:156
#30 0x000003ff7c4e0be4 in nsAppStartup::Run (this=0x3ff6a9f2360) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/toolkit/components/startup/nsAppStartup.cpp:284
#31 0x000003ff7c52a07c in XREMain::XRE_mainRun (this=this@entry=0x3ffd6119138) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/toolkit/xre/nsAppRunner.cpp:4347
#32 0x000003ff7c52a880 in XREMain::XRE_main (this=this@entry=0x3ffd6119138, argc=argc@entry=1, argv=argv@entry=0x3ffd611a668, aAppData=aAppData@entry=0x3ffd6119338)
    at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/toolkit/xre/nsAppRunner.cpp:4451
#33 0x000003ff7c52aad8 in XRE_main (argc=1, argv=0x3ffd611a668, aAppData=0x3ffd6119338, aFlags=<optimized out>) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/toolkit/xre/nsAppRunner.cpp:4559
#34 0x000002aae19d5738 in do_main (argc=1, argv=0x3ffd611a668, envp=<optimized out>, xreDirectory=0x3ff7e741d20) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/browser/app/nsBrowserApp.cpp:220
#35 0x000002aae19d4c78 in main (argc=1, argv=0x3ffd611a668, envp=0x3ffd611a678) at /usr/src/debug/firefox-48.0.1/firefox-48.0.1/browser/app/nsBrowserApp.cpp:360

Similar problem has been detected:

Attempt to launch Firefox on aarch64.

reporter:       libreport-2.8.0
backtrace_rating: 4
cmdline:        /usr/lib64/firefox/firefox
crash_function: raise
executable:     /usr/lib64/firefox/firefox
global_pid:     1951
kernel:         4.8.0-0.rc6.git0.1.fc25.aarch64
package:        firefox-49.0-2.fc26
pkg_vendor:     Fedora Project
reason:         firefox killed by SIGSEGV
runlevel:       N 3
type:           CCpp
uid:            1000

Created attachment 1202956 [details]
File: backtrace

Still there with
[root@localhost ~]# rpm -qa |grep firefox
firefox-49.0-3.fc26.aarch64

Dope, wrong bug.. Unblocking all that.

*** Bug 1404344 has been marked as a duplicate of this bug. ***

This still happens with firefox-50.0.2-2.fc26.aarch64

As a futher datapoint firefox-50.1.0-1.fc26.aarch64 is coredumping, in the usual place, while a local build of a patched firefox repo is working. So this looks like it could be specific to the fedora configuration/compiler flags/etc.

Ok, a `fedpkg local` built version fails, yet a patched version generated with make works.

Digging into it a little more and we find:

(gdb) print *(nsIFrame *) 0xffffa2365c70
$59 = {<nsQueryFrame> = {_vptr.nsQueryFrame = 0xffffb4fea150 <vtable for nsScrollbarFrame+16>}, static kFrameIID = nsQueryFrame::nsIFrame_id, static kPrincipalList = mozilla::layout::kPrincipalList, static kAbsoluteList = mozilla::layout::kAbsoluteList, static kBulletList = mozilla::layout::kBulletList, 
  static kCaptionList = mozilla::layout::kCaptionList, static kColGroupList = mozilla::layout::kColGroupList, static kExcessOverflowContainersList = mozilla::layout::kExcessOverflowContainersList, static kFixedList = mozilla::layout::kFixedList, static kFloatList = mozilla::layout::kFloatList, 
  static kOverflowContainersList = mozilla::layout::kOverflowContainersList, static kOverflowList = mozilla::layout::kOverflowList, static kOverflowOutOfFlowList = mozilla::layout::kOverflowOutOfFlowList, static kPopupList = mozilla::layout::kPopupList, static kPushedFloatsList = mozilla::layout::kPushedFloatsList, 
  static kSelectPopupList = mozilla::layout::kSelectPopupList, static kBackdropList = mozilla::layout::kBackdropList, static kNoReflowPrincipalList = mozilla::layout::kNoReflowPrincipalList, static sLayerIsPrerenderedDataKey = 0 '\000', mRect = {<mozilla::gfx::BaseRect<int, nsRect, nsPoint, nsSize, nsMargin>> = {
      x = 0, y = 0, width = 0, height = 0}, <No data fields>}, mContent = 0xe5e5e5e5e5e5e5e5, mStyleContext = 0xffffa2364ce0, mParent = 0xe5e5e5e5e5e5e5e5, mNextSibling = 0xe5e5e5e5e5e5e5e5, mPrevSibling = 0xe5e5e5e5e5e5e5e5, mState = 12583938, mOverflow = {mType = 3857049061, mVisualDeltas = {mLeft = 229 '\345', 
      mTop = 229 '\345', mRight = 229 '\345', mBottom = 229 '\345'}}}
(gdb) bt
#0  0x0000ffffb3615b60 in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameItems&) (this=this@entry=0xffffa5b311f0, aItem=..., aState=..., aParentFrame=0xffffa2365468, aFrameItems=...)
    at /root/firefox/firefox-50.1.0/firefox-50.1.0/layout/base/nsCSSFrameConstructor.cpp:3881
#1  0x0000ffffb3616468 in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameItems&) (this=this@entry=0xffffa5b311f0, aState=..., aIter=..., aParentFrame=aParentFrame@entry=0xffffa2365468, aFrameItems=...)
    at /root/firefox/firefox-50.1.0/firefox-50.1.0/layout/base/nsCSSFrameConstructor.cpp:6103
#2  0x0000ffffb3616a94 in nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, nsFrameItems&) (this=this@entry=0xffffa5b311f0, aState=..., aItems=..., aParentFrame=aParentFrame@entry=0xffffa2365468, aFrameItems=...)
    at /root/firefox/firefox-50.1.0/firefox-50.1.0/layout/base/nsCSSFrameConstructor.cpp:10524
#3  0x0000ffffb3617898 in nsCSSFrameConstructor::CreateAnonymousFrames(nsFrameConstructorState&, nsIContent*, nsContainerFrame*, PendingBinding*, nsFrameItems&) (this=this@entry=0xffffa5b311f0, aState=..., aParent=aParent@entry=0xffffa5b6a330, aParentFrame=aParentFrame@entry=0xffffa2365468, aPendingBinding=aPendingBinding@entry=0x0, aChildItems=...) at /root/firefox/firefox-50.1.0/firefox-50.1.0/layout/base/nsCSSFrameConstructor.cpp:4150
#4  0x0000ffffb3617d7c in nsCSSFrameConstructor::BeginBuildingScrollFrame(nsFrameConstructorState&, nsIContent*, nsStyleContext*, nsContainerFrame*, nsIAtom*, bool, nsContainerFrame*&) (this=this@entry=0xffffa5b311f0, aState=..., aContent=aContent@entry=0xffffa5b6a330, aContentStyle=aContentStyle@entry=0xffffa2364140, aParentFrame=aParentFrame@entry=0xffffa2364938, aScrolledPseudo=aScrolledPseudo@entry=0xffffac892700, aIsRoot=aIsRoot@entry=true, aNewFrame=@0xffffffffba78: 0x0) at /root/firefox/firefox-50.1.0/firefox-50.1.0/layout/base/nsCSSFrameConstructor.cpp:4565
#5  0x0000ffffb3617f58 in nsCSSFrameConstructor::SetUpDocElementContainingBlock(nsIContent*) (this=this@entry=0xffffa5b311f0, aDocElement=aDocElement@entry=0xffffa5b6a330) at /root/firefox/firefox-50.1.0/firefox-50.1.0/layout/base/nsCSSFrameConstructor.cpp:2891
#6  0x0000ffffb361da00 in nsCSSFrameConstructor::ConstructDocElementFrame(mozilla::dom::Element*, nsILayoutHistoryState*) (this=this@entry=0xffffa5b311f0, aDocElement=aDocElement@entry=0xffffa5b6a330, aFrameState=aFrameState@entry=0x0)
    at /root/firefox/firefox-50.1.0/firefox-50.1.0/layout/base/nsCSSFrameConstructor.cpp:2411
#7  0x0000ffffb361ea38 in nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsIContent*, nsILayoutHistoryState*, bool) (this=0xffffa5b311f0, aContainer=aContainer@entry=0x0, aStartChild=aStartChild@entry=0xffffa5b6a330, aEndChild=0x0, aFrameState=aFrameState@entry=0x0, aAllowLazyConstruction=aAllowLazyConstruction@entry=false) at /root/firefox/firefox-50.1.0/firefox-50.1.0/layout/base/nsCSSFrameConstructor.cpp:7657
#8  0x0000ffffb361f1f0 in nsCSSFrameConstructor::ContentInserted(nsIContent*, nsIContent*, nsILayoutHistoryState*, bool) (this=<optimized out>, aContainer=aContainer@entry=0x0, aChild=aChild@entry=0xffffa5b6a330, aFrameState=aFrameState@entry=0x0, aAllowLazyConstruction=aAllowLazyConstruction@entry=false)
    at /root/firefox/firefox-50.1.0/firefox-50.1.0/layout/base/nsCSSFrameConstructor.cpp:7547
#9  0x0000ffffb3687418 in PresShell::Initialize(int, int) (this=0xffffa2354000, aWidth=<optimized out>, aHeight=<optimized out>) at /root/firefox/firefox-50.1.0/firefox-50.1.0/layout/base/nsPresShell.cpp:1731
#10 0x0000ffffb242a5c4 in nsContentSink::StartLayout(bool) (this=this@entry=0xffffa2352c00, aIgnorePendingSheets=aIgnorePendingSheets@entry=false, this=<optimized out>) at /root/firefox/firefox-50.1.0/firefox-50.1.0/dom/base/nsContentSink.cpp:1210
#11 0x0000ffffb20bb840 in nsHtml5TreeOpExecutor::StartLayout() (this=0xffffa2352c00) at /root/firefox/firefox-50.1.0/firefox-50.1.0/parser/html/nsHtml5TreeOpExecutor.cpp:614
#12 0x0000ffffb20dc07c in nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor*, nsIContent**) (this=this@entry=0xffffa235bea8, aBuilder=aBuilder@entry=0xffffa2352c00, aScriptElement=aScriptElement@entry=0xffffffffc6a0) at /root/firefox/firefox-50.1.0/firefox-50.1.0/parser/html/nsHtml5TreeOperation.cpp:990
#13 0x0000ffffb20d8638 in nsHtml5TreeOpExecutor::RunFlushLoop() (this=0xffffa2352c00) at /root/firefox/firefox-50.1.0/firefox-50.1.0/parser/html/nsHtml5TreeOpExecutor.cpp:449
#14 0x0000ffffb20d88b8 in nsHtml5TreeOpExecutor::RunFlushLoop() (this=<optimized out>) at /root/firefox/firefox-50.1.0/firefox-50.1.0/parser/html/nsHtml5StreamParser.cpp:125
#15 0x0000ffffb20d88b8 in nsHtml5ExecutorFlusher::Run() (this=<optimized out>) at /root/firefox/firefox-50.1.0/firefox-50.1.0/parser/html/nsHtml5StreamParser.cpp:128
#16 0x0000ffffb1a66248 in nsThread::ProcessNextEvent(bool, bool*) (this=0xffffb5370de0, aMayWait=<optimized out>, aResult=0xffffffffc7b7) at /root/firefox/firefox-50.1.0/firefox-50.1.0/xpcom/threads/nsThread.cpp:1076
#17 0x0000ffffb1a89474 in NS_ProcessNextEvent(nsIThread*, bool) (aThread=<optimized out>, aThread@entry=0xffffb5370de0, aMayWait=aMayWait@entry=true) at /root/firefox/firefox-50.1.0/firefox-50.1.0/xpcom/glue/nsThreadUtils.cpp:290
#18 0x0000ffffb38edcb4 in nsXULWindow::ShowModal() (this=0xffffb535f450) at /root/firefox/firefox-50.1.0/firefox-50.1.0/xpfe/appshell/nsXULWindow.cpp:408
#19 0x0000ffffb38b5140 in nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsIArray*, float*, mozIDOMWindowProxy**) (this=this@entry=0xffffa7630d80, aParent=aParent@entry=0x0, aUrl=aUrl@entry=0xffffa2da7d20 "chrome://browser/content/safeMode.xul", aName=aName@entry=0xffffa2fd0910 "_blank", aFeatures=aFeatures@entry=0xffffa2da7db0 "chrome,centerscreen,modal,resizable=no", aCalledFromJS=aCalledFromJS@entry=false, aDialog=aDialog@entry=false, aNavigate=aNavigate@entry=true, aArgv=aArgv@entry=0x0, aOpenerFullZoom=aOpenerFullZoom@entry=0x0, aResult=aResult@entry=0xffffffffcea8) at /root/firefox/firefox-50.1.0/firefox-50.1.0/embedding/components/windowwatcher/nsWindowWatcher.cpp:1307
#20 0x0000ffffb38b5764 in nsWindowWatcher::OpenWindow(mozIDOMWindowProxy*, char const*, char const*, char const*, nsISupports*, mozIDOMWindowProxy**) (this=0xffffa7630d80, aParent=0x0, aUrl=0xffffa2da7d20 "chrome://browser/content/safeMode.xul", aName=0xffffa2fd0910 "_blank", aFeatures=0xffffa2da7db0 "chrome,centerscreen,modal,resizable=no", aArguments=<optimized out>, aResult=0xffffffffcea8) at /root/firefox/firefox-50.1.0/firefox-50.1.0/embedding/components/windowwatcher/nsWindowWatcher.cpp:375
#21 0x0000ffffb1a706e4 in _NS_InvokeByIndex () at /root/firefox/firefox-50.1.0/firefox-50.1.0/xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_aarch64.s:58
#22 0x0000000000000000 in  ()


Which makes it appear like the pointer members of nsIFrame are not being initialized to nullptr. So they then get carried along an used as valid pointers.


The nsBox() constructor is being called by nsFrame's constructor, but it seems that either the nsIframe's constructor isn't initializing the pointers, or its not being called by nsBox's. 

More to come tomorrow.

Yah, so I double verified this. C++ doesn't initialize built in types declared in classes, which is why Weffc++ warns about initializer lists. So, its a bug in firefox. The nsIFrame needs a constructor to initialize the members, in particular mContent(nullptr), mStyleContext(nullptr), mParent(nullptr), mNextSibling(nullptr), mPrevSibling(nullptr).

That fixes the bug indicated by the initial calltrace, but then crashes in:

#0  0x000003ffb372a30c in nsSplittableFrame::FirstContinuation() const (this=<optimized out>)
    at /root/firefox/firefox-50.1.0/firefox-50.1.0/layout/generic/nsSplittableFrame.cpp:82
#1  0x000003ffb35fea14 in AdjustAbsoluteContainingBlock (aContainingBlockIn=0x3ffa1d6b100)
    at /root/firefox/firefox-50.1.0/firefox-50.1.0/layout/base/nsCSSFrameConstructor.cpp:1048
#2  0x000003ffb35fea14 in nsFrameConstructorState::PushAbsoluteContainingBlock(nsContainerFrame*, nsIFrame*, nsFrameConstructorSaveState&) (
    this=this@entry=0x3ffffffd228, aNewAbsoluteContainingBlock=0x3ffa1d6b100, aPositionedFrame=0x3ffa1d6b100, aSaveState=...)
    at /root/firefox/firefox-50.1.0/firefox-50.1.0/layout/base/nsCSSFrameConstructor.cpp:1070
#3  0x000003ffb361dec0 in nsCSSFrameConstructor::ConstructDocElementFrame(mozilla::dom::Element*, nsILayoutHistoryState*) (this=this@entry=0x3ffa4b46810, aDocElement=aDocElement@entry=0x3ffa09a3cc0, aFrameState=aFrameState@entry=0x0) at /root/firefox/firefox-50.1.0/firefox-50.1.0/layout/base/nsCSSFrameConstructor.cpp:2506
#4  0x000003ffb361ea38 in nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsIContent*, nsILayoutHistoryState*, bool) (this=0x3ffa4b46810, aContainer=aContainer@entry=0x0, aStartChild=aStartChild@entry=0x3ffa09a3cc0, aEndChild=0x0, aFrameState=aFrameState@entry=0x0, aAllowLazyConstruction=aAllowLazyConstruction@entry=false) at /root/firefox/firefox-50.1.0/firefox-50.1.0/layout/base/nsCSSFrameConstructor.cpp:7657
#5  0x000003ffb361f1f0 in nsCSSFrameConstructor::ContentInserted(nsIContent*, nsIContent*, nsILayoutHistoryState*, bool) (this=<optimized out>, aContainer=aContainer@entry=0x0, aChild=aChild@entry=0x3ffa09a3cc0, aFrameState=aFrameState@entry=0x0, aAllowLazyConstruction=aAllowLazyConstruction@entry=false)
    at /root/firefox/firefox-50.1.0/firefox-50.1.0/layout/base/nsCSSFrameConstructor.cpp:7547
#6  0x000003ffb3687418 in PresShell::Initialize(int, int) (this=0x3ffa1d55400, aWidth=<optimized out>, aHeight=<optimized out>)
    at /root/firefox/firefox-50.1.0/firefox-50.1.0/layout/base/nsPresShell.cpp:1731
#7  0x000003ffb242a5c4 in nsContentSink::StartLayout(bool) (this=this@entry=0x3ffa1d54000, aIgnorePendingSheets=aIgnorePendingSheets@entry=false, this=<optimized out>)
    at /root/firefox/firefox-50.1.0/firefox-50.1.0/dom/base/nsContentSink.cpp:1210
#8  0x000003ffb20bb840 in nsHtml5TreeOpExecutor::StartLayout() (this=0x3ffa1d54000)
    at /root/firefox/firefox-50.1.0/firefox-50.1.0/parser/html/nsHtml5TreeOpExecutor.cpp:614


With another similar crash.

Basically whats happening is the heap poisoning is filling the objects with garbage and classes which are missing initializers for pointers are then getting 0xe5e5e5e5e5e5e5e5 which are passing all the null pointer checks.

So, there are a couple fixes here. A whole class of these problems can be fixed by putting and __attribute__((optimizer("no-lifetime-dse")) in the class being called by the session classes new operators. like:

void* __attribute__((optimize("no-lifetime-dse"))) AllocateFrame(nsQueryFrame::FrameIID aID, size_t aSize)

in the nsIpressShell.h's nsIPressShell class.


That hides a whole host of classes lacking proper initializers on their pointer structures. 

For instance the crash listed in this defect is correctly solved via a constructor in nsIframe.h like:

 nsIFrame() : nsQueryFrame(), mRect(), mContent(nullptr),
               mStyleContext(nullptr), mParent(nullptr), mNextSibling(nullptr),
               mPrevSibling(nullptr), mState()
  {
  }

That moves the crash to nsSplittableFrame a few million cycles later.

That can be solved via

  explicit nsSplittableFrame(nsStyleContext* aContext) : nsFrame(aContext), mPrevContinuation(nullptr),  mNextContinuation(nullptr)
  {
  }

and on and on, until I got bored fixing them and just tossed the no-lifetime-dse into AllocateFrame.

If you want a quick fix I would just plug in DSE tweak into AllocateFrame.

Upstream bug is here:

https://bugzilla.mozilla.org/show_bug.cgi?id=1321579

Created attachment 1242952 [details]
Patch as suggested in comments.

(In reply to Tarell Ware from comment #28)
> Created attachment 1242952 [details]
> Patch as suggested in comments.

Great, thanks. Can you please attach the patch at https://bugzilla.mozilla.org/show_bug.cgi?id=1321579 to get it upstream?

firefox-51.0-3.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2017-36b325dac3

firefox-51.0-3.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2017-5df7a4018c

Posted to Mozilla.

firefox-51.0-3.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-5df7a4018c

btw, anyone have any idea if this is related to (or will fix) this crash in gnome-shell?

0x0000ffffb50df570 in js::ObjectImpl::setFlag(js::ExclusiveContext*, unsigned int, js::ObjectImpl::GenerateShape) () from /lib64/libmozjs-31.so

Whats the full backtrace? (is there another bug) I need to also watch out for 48bit VA issues, because I don't think this patch has been merged.

https://bugzilla.redhat.com/show_bug.cgi?id=1395969

(In reply to Jeremy Linton from comment #35)
> Whats the full backtrace? (is there another bug) I need to also watch out
> for 48bit VA issues, because I don't think this patch has been merged.
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1395969

somehow (and maybe this is just a transient issue), I'm having trouble getting debuginfo for full backtrace at the moment:

  Error: Failed to synchronize cache for repo 'rawhide-debuginfo'

It is an self-built kernel but I do have CONFIG_ARM64_VA_BITS_48=y.  I'm firing off a kernel build w/ 39b va instead.

(g-s did work in rawhide, at least as of a few weeks ago.  I can't guarantee that I was using same va size before, but unless that changed in defconfig recently upstream I probably was using 48b)

A few weeks ago gnome shell was linked against mozjs24...

firefox-51.0-3.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

firefox-51.0-3.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-36b325dac3

This bug appears to have been reported against 'rawhide' during the Fedora 26 development cycle.
Changing version to '26'.

Hope it's fixed now.