Closed Bug 1312270 Opened 3 years ago Closed 3 months ago

Crash in mozilla::DisplayListClipState::CreateInactiveScrollClip

Categories

(Core :: Web Painting, defect, critical)

50 Branch
x86
Windows 10
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox50 + wontfix

People

(Reporter: marcia, Unassigned, NeedInfo)

References

Details

(Keywords: crash)

Crash Data

[Tracking Requested - why for this release]: High volume crash in Beta 9 that was not seen in previous betas.

This bug was filed from the Socorro interface and is 
report bp-23337f74-b88a-4d1a-ba43-8f02e2161023.
=============================================================

Seen while looking at FF Beta 9 crash stats: http://bit.ly/2eWs2x0. Appears to affect AMD. Some comments mention crashing on Facebook.

This was not seen in the previous beta according to a quick search in crash stats.
(100.0% in signature vs 05.35% overall) build_id = 20161020152750
(100.0% in signature vs 08.73% overall) reason = EXCEPTION_ACCESS_VIOLATION_WRITE
(100.0% in signature vs 12.17% overall) adapter_vendor_id = Advanced Micro Devices, Inc. [AMD/ATI]
(100.0% in signature vs 21.50% overall) cpu_microcode_version = null
(79.50% in signature vs 01.68% overall) address = 0x1
(62.39% in signature vs 01.00% overall) CPU Info = AuthenticAMD family 20 model 2 stepping 0
(94.82% in signature vs 49.47% overall) "D3D11 Layers+" in app_notes = true
(94.82% in signature vs 50.23% overall) "D3D11 Layers?" in app_notes = true
(42.57% in signature vs 00.46% overall) adapter_device_id = 0x9802
(37.61% in signature vs 00.34% overall) CPU Info = AuthenticAMD family 20 model 1 stepping 0
(99.55% in signature vs 74.51% overall) dom_ipc_enabled = null
Depends on: 772330
Andrew: Can you get someone to help us investigate this new top crash in Beta 9?
Flags: needinfo?(overholt)
Tagged as blocking for Beta50 release.
Hi Kats, Milan, could you please help find an owner who can investigate? We only have one more beta build before we enter RC week and this one is a top crasher on 50.0b9.
Flags: needinfo?(milan)
Flags: needinfo?(bugmail)
Hi Neil, could this be related to the fix we took in b9 for bug 1304243?
Flags: needinfo?(enndeakin)
This is the beta 8 -> beta 9 changelog: https://hg.mozilla.org/releases/mozilla-beta/pushloghtml?fromchange=FIREFOX_50_0b8_RELEASE&tochange=FIREFOX_50_0b9_RELEASE.

Display lists and stacking contexts.
Flags: needinfo?(milan) → needinfo?(matt.woodrow)
(In reply to Ritu Kothari (:ritu) from comment #5)
> Hi Neil, could this be related to the fix we took in b9 for bug 1304243?

Very unlikely. The stack trace suggests something to do with scrolling and/or video.
Flags: needinfo?(enndeakin)
(In reply to Neil Deakin from comment #7)
> (In reply to Ritu Kothari (:ritu) from comment #5)
> > Hi Neil, could this be related to the fix we took in b9 for bug 1304243?
> 
> Very unlikely. The stack trace suggests something to do with scrolling
> and/or video.

Of the entire pushlog bug 1304243 is the only one that touches anything in layout/, so it does seem like the most likely candidate given the crash stack. Some of the crash report comments seem to indicate the crash is happening on Facebook.
Flags: needinfo?(bugmail)
(In reply to Milan Sreckovic [:milan] from comment #6)
> This is the beta 8 -> beta 9 changelog:
> https://hg.mozilla.org/releases/mozilla-beta/
> pushloghtml?fromchange=FIREFOX_50_0b8_RELEASE&tochange=FIREFOX_50_0b9_RELEASE
> .
> 
> Display lists and stacking contexts.

There isn't really anything interesting in that range.

This looks a lot like bug 772330. 100% of the crash are from 'AuthenticAMD family 20 model 1' or 'AuthenticAMD family 20 model 2' CPUS.

There's no known fix for this, but there's a good chance it will be gone again in the next build.
Flags: needinfo?(overholt)
No reports with 50.0b10 so far.
This signature disappeared in 50.0b10 and 50.0b11, but in 50.0b11 we have `js::HeapSlot::set` with the same correlations to AMD CPUs.
See Also: → 1176268
Also `js::AutoSetNewObjectMetadata::trace`.
After the initial spike, this crash signature has disappeared from 50.0b10. Removing the blocking tag and marking this as wontfix for 50.
Component: Layout → Layout: Web Painting
this sees to affect the 52.0esr build at the moment - the signature is 2% of browser crashes there at the moment.

Correlations for Firefox Esr
(53.13% in signature vs 01.00% overall) CPU Info = AuthenticAMD family 20 model 2 stepping 0
(46.81% in signature vs 00.81% overall) CPU Info = AuthenticAMD family 20 model 1 stepping 0

Closing because no crashes reported for 12 weeks.

Status: NEW → RESOLVED
Closed: 3 months ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.