Crash in mozilla::DisplayListClipState::CreateInactiveScrollClip

NEW
Unassigned

Status

()

Core
Layout: Web Painting
--
critical
a year ago
9 months ago

People

(Reporter: marcia, Unassigned, NeedInfo)

Tracking

({crash})

50 Branch
x86
Windows 10
crash
Points:
---

Firefox Tracking Flags

(firefox50+ wontfix)

Details

(crash signature)

(Reporter)

Description

a year ago
[Tracking Requested - why for this release]: High volume crash in Beta 9 that was not seen in previous betas.

This bug was filed from the Socorro interface and is 
report bp-23337f74-b88a-4d1a-ba43-8f02e2161023.
=============================================================

Seen while looking at FF Beta 9 crash stats: http://bit.ly/2eWs2x0. Appears to affect AMD. Some comments mention crashing on Facebook.

This was not seen in the previous beta according to a quick search in crash stats.
(100.0% in signature vs 05.35% overall) build_id = 20161020152750
(100.0% in signature vs 08.73% overall) reason = EXCEPTION_ACCESS_VIOLATION_WRITE
(100.0% in signature vs 12.17% overall) adapter_vendor_id = Advanced Micro Devices, Inc. [AMD/ATI]
(100.0% in signature vs 21.50% overall) cpu_microcode_version = null
(79.50% in signature vs 01.68% overall) address = 0x1
(62.39% in signature vs 01.00% overall) CPU Info = AuthenticAMD family 20 model 2 stepping 0
(94.82% in signature vs 49.47% overall) "D3D11 Layers+" in app_notes = true
(94.82% in signature vs 50.23% overall) "D3D11 Layers?" in app_notes = true
(42.57% in signature vs 00.46% overall) adapter_device_id = 0x9802
(37.61% in signature vs 00.34% overall) CPU Info = AuthenticAMD family 20 model 1 stepping 0
(99.55% in signature vs 74.51% overall) dom_ipc_enabled = null

Updated

a year ago
Depends on: 772330
(Reporter)

Comment 2

a year ago
Andrew: Can you get someone to help us investigate this new top crash in Beta 9?
Flags: needinfo?(overholt)
Tagged as blocking for Beta50 release.
tracking-firefox50: ? → blocking
Hi Kats, Milan, could you please help find an owner who can investigate? We only have one more beta build before we enter RC week and this one is a top crasher on 50.0b9.
Flags: needinfo?(milan)
Flags: needinfo?(bugmail)
Hi Neil, could this be related to the fix we took in b9 for bug 1304243?
Flags: needinfo?(enndeakin)
This is the beta 8 -> beta 9 changelog: https://hg.mozilla.org/releases/mozilla-beta/pushloghtml?fromchange=FIREFOX_50_0b8_RELEASE&tochange=FIREFOX_50_0b9_RELEASE.

Display lists and stacking contexts.
Flags: needinfo?(milan) → needinfo?(matt.woodrow)

Comment 7

a year ago
(In reply to Ritu Kothari (:ritu) from comment #5)
> Hi Neil, could this be related to the fix we took in b9 for bug 1304243?

Very unlikely. The stack trace suggests something to do with scrolling and/or video.
Flags: needinfo?(enndeakin)
(In reply to Neil Deakin from comment #7)
> (In reply to Ritu Kothari (:ritu) from comment #5)
> > Hi Neil, could this be related to the fix we took in b9 for bug 1304243?
> 
> Very unlikely. The stack trace suggests something to do with scrolling
> and/or video.

Of the entire pushlog bug 1304243 is the only one that touches anything in layout/, so it does seem like the most likely candidate given the crash stack. Some of the crash report comments seem to indicate the crash is happening on Facebook.
Flags: needinfo?(bugmail)
(In reply to Milan Sreckovic [:milan] from comment #6)
> This is the beta 8 -> beta 9 changelog:
> https://hg.mozilla.org/releases/mozilla-beta/
> pushloghtml?fromchange=FIREFOX_50_0b8_RELEASE&tochange=FIREFOX_50_0b9_RELEASE
> .
> 
> Display lists and stacking contexts.

There isn't really anything interesting in that range.

This looks a lot like bug 772330. 100% of the crash are from 'AuthenticAMD family 20 model 1' or 'AuthenticAMD family 20 model 2' CPUS.

There's no known fix for this, but there's a good chance it will be gone again in the next build.
Flags: needinfo?(overholt)
No reports with 50.0b10 so far.
This signature disappeared in 50.0b10 and 50.0b11, but in 50.0b11 we have `js::HeapSlot::set` with the same correlations to AMD CPUs.
See Also: → bug 1176268
Also `js::AutoSetNewObjectMetadata::trace`.
See Also: → bug 1281759
After the initial spike, this crash signature has disappeared from 50.0b10. Removing the blocking tag and marking this as wontfix for 50.
status-firefox50: affected → wontfix
tracking-firefox50: blocking → +
Component: Layout → Layout: Web Painting
See Also: → bug 1287087

Comment 14

9 months ago
this sees to affect the 52.0esr build at the moment - the signature is 2% of browser crashes there at the moment.

Correlations for Firefox Esr
(53.13% in signature vs 01.00% overall) CPU Info = AuthenticAMD family 20 model 2 stepping 0
(46.81% in signature vs 00.81% overall) CPU Info = AuthenticAMD family 20 model 1 stepping 0
You need to log in before you can comment on or make changes to this bug.