798761 - crash in mozilla::`anonymous namespace''::ContainerState::InvalidateForLayerChange

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

It first appeared in 18.0a1/20120929. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=895f66c4eada&tochange=c09a0c022b2e
It's likely a regression from bug 539356 part 25.

Signature 	mozilla::`anonymous namespace''::ContainerState::InvalidateForLayerChange(nsDisplayItem*, mozilla::layers::Layer*, mozilla::FrameLayerBuilder::Clip const&, nsPoint const&) More Reports Search
UUID	990a8ee5-192c-4ca6-879a-5236c2121005
Date Processed	2012-10-05 14:31:12
Uptime	4
Last Crash	6 seconds before submission
Install Age	23.5 minutes since version was first installed.
Install Time	2012-10-05 14:07:41
Product	Firefox
Version	18.0a1
Build ID	20121005030609
Release Channel	nightly
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 6 model 10 stepping 0
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x59
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x02e0, AdapterSubsysID: 080110b0, AdapterDriverVersion: 6.14.13.142
D3D10 Layers? D3D10 Layers- 
Processor Notes 	This dump is too long and has triggered the automatic truncation routine
EMCheckCompatibility	True
Adapter Vendor ID	0x10de
Adapter Device ID	0x02e0
Total Virtual Memory	2147352576
Available Virtual Memory	1883971584
System Memory Use Percentage	40
Available Page File	3326922752
Available Physical Memory	958869504

Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::InvalidateForLayerChange 	layout/base/FrameLayerBuilder.cpp:2226
1 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:2187
2 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:2065
3 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:2065
4 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:2065
5 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:2065
6 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:2065
7 	xul.dll 	mozilla::FrameLayerBuilder::BuildContainerLayerFor 	layout/base/FrameLayerBuilder.cpp:2858
8 	xul.dll 	nsDisplayList::PaintForFrame 	layout/base/nsDisplayList.cpp:1044
9 	xul.dll 	nsLayoutUtils::PaintFrame 	layout/base/nsLayoutUtils.cpp:1835
10 	xul.dll 	PresShell::Paint 	layout/base/nsPresShell.cpp:5323
11 	xul.dll 	nsViewManager::ProcessPendingUpdatesForView 	view/src/nsViewManager.cpp:436
12 	xul.dll 	nsViewManager::ProcessPendingUpdates 	view/src/nsViewManager.cpp:1210
13 	xul.dll 	nsRefreshDriver::Notify 	layout/base/nsRefreshDriver.cpp:431
14 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:476
15 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:612
16 	xul.dll 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:220
17 	xul.dll 	nsSyncStreamListener::WaitForData 	netwerk/base/src/nsSyncStreamListener.cpp:26
18 	xul.dll 	nsSyncStreamListener::Available 	netwerk/base/src/nsSyncStreamListener.cpp:128
19 	xul.dll 	NS_ImplementChannelOpen 	obj-firefox/dist/include/nsNetUtil.h:648
20 	xul.dll 	mozilla::net::HttpBaseChannel::Open 	netwerk/protocol/http/HttpBaseChannel.cpp:453
21 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:70
22 	xul.dll 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:2408
23 	xul.dll 	XPC_WN_CallMethod 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1469
24 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:367
25 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2461
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3A%60anonymous+namespace%27%27%3A%3AContainerState%3A%3AInvalidateForLayerChange%28nsDisplayItem*%2C+mozilla%3A%3Alayers%3A%3ALayer*%2C+mozilla%3A%3AFrameLayerBuilder%3A%3AClip+const%26%2C+nsPoint+const%26%29

Comment 1

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Is this crash still appearing?

Comment 2

[Scoobidiver (away)]

(In reply to Chris Jones [:cjones] [:warhammer] from comment #1)
> Is this crash still appearing?
Yes in Firefox and WebappRT.

Comment 3

[Matt Woodrow (:mattwoodrow)]

Is this still happening now that bug 795674 has landed?

Comment 4

[Scoobidiver (away)]

(In reply to Matt Woodrow (:mattwoodrow) from comment #3)
> Is this still happening now that bug 795674 has landed?
There are crashes up to 19.0a1/20121011 and 18.0a2/20121015.

Comment 5

[Scoobidiver (away)]

Bug 795674 was uplifted to Aurora.

Comment 6

[Ioana (away)]

Issue no longer reproducing on builds older than 10/25:
https://crash-stats.mozilla.com/report/list?query_search=signature&query_type=contains&reason_type=contains&range_value=4&range_unit=weeks&hang_type=any&process_type=any&signature=mozilla%3A%3A%60anonymous%20namespace%27%27%3A%3AContainerState%3A%3AInvalidateForLayerChange%28nsDisplayItem%2A%2C%20mozilla%3A%3Alayers%3A%3ALayer%2A%2C%20mozilla%3A%3AFrameLayerBuilder%3A%3AClip%20const%26%2C%20nsPoint%20const%26%29