297127 - FF104 crash [@ IsCanvasFrame]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Jay Patel [:jay]]

This seems to be a regression or a new crash that just started showing up in
Firefox 1.0.4.  This was not a topcrasher for any previous Firefox 1.0.x release
off the Aviary branch until now.  Marking topcrash+ to get some traction on this.

Here is a link to the latest crashes for IsCanvasFrame:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=+IsCanvasFrame&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

We need to find the regression window for this crash and hopefully get it fixed
in any future releases off the Aviary branch.  It is currently the #7 topcrasher
for Firefox 1.0.4 (after not being anywhere near the top 50 for 1.0-1.0.3)

Here is a recent incident:
Incident ID: 6500345
Stack Signature	IsCanvasFrame a81fa5a3
Product ID	Firefox10
Build ID	2005051112
Trigger Time	2005-06-08 12:06:10.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (00274ea4)
URL visited	drudgereport.com
User Comments	
Since Last Crash	9091 sec
Total Uptime	116722 sec
Trigger Reason	Access violation
Source File, Line No.
d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 2554
Stack Trace 	
IsCanvasFrame 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/style/src/nsCSSRendering.cpp,
line 2554]
SyncFrameViewGeometryDependentProperties 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 557]
nsContainerFrame::SyncFrameViewProperties 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 873]
UpdateViewProperties 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 3403]
nsPresContext::ClearStyleDataAndReflow 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/base/src/nsPresContext.cpp,
line 564]
nsPresContext::PreferenceChanged 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/base/src/nsPresContext.cpp,
line 587]
nsPresContext::PrefChangedCallback 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/base/src/nsPresContext.cpp,
line 106]
PREF_ReaderCallback 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/modules/libpref/src/prefapi.cpp,
line 878]
PREF_ParseBuf 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/modules/libpref/src/prefread.cpp,
line 447]

A lot of people are crashing at drudgereport.com, dilbert.com, and a few other
sites...see the link above for more user comments and urls.  Although the stack
signature is the same as in bug 236590, this looks like a different crash based
on the stack trace.

Comment 1

[Kathleen :Brade]

Jay -- Is this still a topcrash?

Comment 2

[Jesse Ruderman on Windows]

Only 4 crash reports in IsCanvasFrame in the last week, all on old versions of Firefox.