1312270 - Crash in mozilla::DisplayListClipState::CreateInactiveScrollClip

Status: RESOLVED WORKSFORME

(Core :: Web Painting, defect)

Description

[Marcia Knous [:marcia]]

[Tracking Requested - why for this release]: High volume crash in Beta 9 that was not seen in previous betas.

This bug was filed from the Socorro interface and is 
report bp-23337f74-b88a-4d1a-ba43-8f02e2161023.
=============================================================

Seen while looking at FF Beta 9 crash stats: http://bit.ly/2eWs2x0. Appears to affect AMD. Some comments mention crashing on Facebook.

This was not seen in the previous beta according to a quick search in crash stats.

Comment 1

[Marco Castelluccio [:marco]]

(100.0% in signature vs 05.35% overall) build_id = 20161020152750
(100.0% in signature vs 08.73% overall) reason = EXCEPTION_ACCESS_VIOLATION_WRITE
(100.0% in signature vs 12.17% overall) adapter_vendor_id = Advanced Micro Devices, Inc. [AMD/ATI]
(100.0% in signature vs 21.50% overall) cpu_microcode_version = null
(79.50% in signature vs 01.68% overall) address = 0x1
(62.39% in signature vs 01.00% overall) CPU Info = AuthenticAMD family 20 model 2 stepping 0
(94.82% in signature vs 49.47% overall) "D3D11 Layers+" in app_notes = true
(94.82% in signature vs 50.23% overall) "D3D11 Layers?" in app_notes = true
(42.57% in signature vs 00.46% overall) adapter_device_id = 0x9802
(37.61% in signature vs 00.34% overall) CPU Info = AuthenticAMD family 20 model 1 stepping 0
(99.55% in signature vs 74.51% overall) dom_ipc_enabled = null

Comment 2

[Marcia Knous [:marcia]]

Andrew: Can you get someone to help us investigate this new top crash in Beta 9?

Comment 3

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Tagged as blocking for Beta50 release.

Comment 4

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Hi Kats, Milan, could you please help find an owner who can investigate? We only have one more beta build before we enter RC week and this one is a top crasher on 50.0b9.

Comment 5

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Hi Neil, could this be related to the fix we took in b9 for bug 1304243?

Comment 6

[Milan Sreckovic [:milan] (needinfo for best results)]

This is the beta 8 -> beta 9 changelog: https://hg.mozilla.org/releases/mozilla-beta/pushloghtml?fromchange=FIREFOX_50_0b8_RELEASE&tochange=FIREFOX_50_0b9_RELEASE.

Display lists and stacking contexts.

Comment 7

[Neil Deakin]

(In reply to Ritu Kothari (:ritu) from comment #5)
> Hi Neil, could this be related to the fix we took in b9 for bug 1304243?

Very unlikely. The stack trace suggests something to do with scrolling and/or video.

Comment 8

[Kartikaya Gupta (email:[e-mail])]

(In reply to Neil Deakin from comment #7)
> (In reply to Ritu Kothari (:ritu) from comment #5)
> > Hi Neil, could this be related to the fix we took in b9 for bug 1304243?
> 
> Very unlikely. The stack trace suggests something to do with scrolling
> and/or video.

Of the entire pushlog bug 1304243 is the only one that touches anything in layout/, so it does seem like the most likely candidate given the crash stack. Some of the crash report comments seem to indicate the crash is happening on Facebook.

Comment 9

[Matt Woodrow (:mattwoodrow)]

(In reply to Milan Sreckovic [:milan] from comment #6)
> This is the beta 8 -> beta 9 changelog:
> https://hg.mozilla.org/releases/mozilla-beta/
> pushloghtml?fromchange=FIREFOX_50_0b8_RELEASE&tochange=FIREFOX_50_0b9_RELEASE
> .
> 
> Display lists and stacking contexts.

There isn't really anything interesting in that range.

This looks a lot like bug 772330. 100% of the crash are from 'AuthenticAMD family 20 model 1' or 'AuthenticAMD family 20 model 2' CPUS.

There's no known fix for this, but there's a good chance it will be gone again in the next build.

Comment 10

[Marco Castelluccio [:marco]]

No reports with 50.0b10 so far.

Comment 11

[Marco Castelluccio [:marco]]

This signature disappeared in 50.0b10 and 50.0b11, but in 50.0b11 we have `js::HeapSlot::set` with the same correlations to AMD CPUs.

Comment 12

[Marco Castelluccio [:marco]]

Also `js::AutoSetNewObjectMetadata::trace`.

Comment 13

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

After the initial spike, this crash signature has disappeared from 50.0b10. Removing the blocking tag and marking this as wontfix for 50.

Comment 14

[[:philipp]]

this sees to affect the 52.0esr build at the moment - the signature is 2% of browser crashes there at the moment.

Correlations for Firefox Esr
(53.13% in signature vs 01.00% overall) CPU Info = AuthenticAMD family 20 model 2 stepping 0
(46.81% in signature vs 00.81% overall) CPU Info = AuthenticAMD family 20 model 1 stepping 0

Comment 15

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.