Closed Bug 595335 Opened 15 years ago Closed 7 years ago

volume increase in Firefox 4.0b5 Crashes [@ nsIFrame::GetUsedBorderAndPadding() ]

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
Unspecified
Android
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WONTFIX
Tracking Flags:
Tracking Status
blocking2.0 --- -

People

(Reporter: chofmann, Unassigned)

Details

(Keywords: crash, regression)

Crash Data

the signature has been around for a while, but we have seen a significant uptick for this in beta 5 in the past two days. currently ranking #8 for 4.0b5 date tl crashes at nsIFrame::GetUsedBorderAndPadding.. count release, count release,... 20100906 101 ,41 3.0.19,11 3.5.11,4 3.6.8,4 3.5b4,4 3.5,4 3.0.8,3 4.0b6pre,.. 20100907 125 ,53 3.0.19,15 3.5.11,8 4.0b5,7 3.0b2,5 3.0,4 4.0b6pre,4 3.6.8,.. 20100908 182 ,85 4.0b5,45 3.0.19,9 3.5.11,4 4.0b6pre,4 3.6.8,4 3.5.12,... 20100909 324 ,204 4.0b5,53 3.0.19,12 3.5.12,8 3.0b5,6 3.0b1,5 3.5.11,4 3.0,.. stacks look like below with crashing address at these new crashes all seeming to be 0xfffffffff0de804b http://crash-stats.mozilla.com/report/index/1a52371e-1c94-4a18-babf-011802100909 Frame Module Signature [Expand] Source 0 xul.dll nsIFrame::GetUsedBorderAndPadding layout/generic/nsIFrame.h:902 1 xul.dll nsIFrame::GetContentRect layout/generic/nsFrame.cpp:731 2 xul.dll nsDisplayVideo::GetBounds layout/generic/nsVideoFrame.cpp:379 3 xul.dll nsDisplayPlugin::Paint layout/generic/nsObjectFrame.cpp:1184 4 xul.dll mozilla::FrameLayerBuilder::DrawThebesLayer layout/base/FrameLayerBuilder.cpp:1507 5 xul.dll mozilla::layers::BasicThebesLayer::Paint gfx/layers/basic/BasicLayers.cpp:389 6 xul.dll mozilla::layers::BasicLayerManager::PaintLayer gfx/layers/basic/BasicLayers.cpp:1069 7 xul.dll mozilla::layers::BasicLayerManager::PaintLayer gfx/layers/basic/BasicLayers.cpp:1077 8 xul.dll mozilla::layers::BasicLayerManager::EndTransaction gfx/layers/basic/BasicLayers.cpp:977 9 xul.dll nsDisplayList::PaintForFrame layout/base/nsDisplayList.cpp:410 10 xul.dll nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:1409 11 xul.dll PresShell::RenderDocument layout/base/nsPresShell.cpp:5298 12 xul.dll nsCanvasRenderingContext2D::DrawWindow content/canvas/src/nsCanvasRenderingContext2D.cpp:3747 13 xul.dll nsIDOMCanvasRenderingContext2D_DrawWindow obj-firefox/js/src/xpconnect/src/dom_quickstubs.cpp:3662 14 xul.dll js::Interpret js/src/jsinterp.cpp:4696 15 xul.dll js::InvokeCommon<int > js/src/jsinterp.cpp:577 16 xul.dll js::Invoke js/src/jsinterp.cpp:696 17 xul.dll array_extra js/src/jsarray.cpp:2807 18 xul.dll array_forEach js/src/jsarray.cpp:2862 19 xul.dll js::Interpret js/src/jsinterp.cpp:4696 20 xul.dll js::InvokeCommon<int > js/src/jsinterp.cpp:577 21 xul.dll js::Invoke js/src/jsinterp.cpp:696 22 xul.dll js::InternalInvoke js/src/jsinterp.cpp:736 23 xul.dll nsXPCWrappedJSClass::CallMethod js/src/xpconnect/src/xpcwrappedjsclass.cpp:1688 24 xul.dll nsXPCWrappedJS::CallMethod js/src/xpconnect/src/xpcwrappedjs.cpp:570 25 xul.dll PrepareAndDispatch xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114 26 xul.dll SharedStub xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141 27 xul.dll mozilla::widget::TaskbarPreview::DrawBitmap widget/src/windows/TaskbarPreview.cpp:406 source files shows layers changes landing in b5 but nothing directly connected to any of the file/lines in the first few frames of the stack. domains of sites 160 http://apps.facebook.com like http://apps.facebook.com/wildones/index.php?track=bookmark&ref=bookmarks&cs=2 http://apps.facebook.com/verdonia/?track=bookmark&ref=bookmarks 27 http://www.facebook.com profiles, photos, 21 http://wild-fb-apache-active-vip.playdom.com like http://wild-fb-apache-active-vip.playdom.com/pub/php/playdomapi.js.php?playdom_call=true&event_type=xpromobar&playdom_key=XXXX&user_id=XXXXX 11 http://www.youtube.com os breakdown total 223 Win5.1 0.76 Win6.0 0.05 Win6.1 0.17
blocking2.0: --- → ?
Keywords: crash, regression
roc, anything here that might have been affected by landings in late august? more reports at http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&query=nsIFrame%3A%3AGetUsedBorderAndPadding
Not that I can think of. Do all of the pages have plugins? Could be another case of bug 552512.
bc, any tools that we could string together to take the set of urls from crash reports and identify common tags and elements of the pages? volume on this crash remains pretty high checking --- nsIFrame::GetUsedBorderAndPadding.. 20100922-crashdata.csv found in: 4.0b6 3.0.19 4.0b5 3.5.13 3.0b3 3.0.16 3.5b4 3.5.3 3.5 3.1b3 3.0.5 3.0.10 3.6.8 3.6.3 3.6.10 3.5b99 3.5.5 3.1b2 3.1b1 3.0b5 3.0.7 3.0.6 3.0.4 3.0.18 3.0 .15 3.0.14 3.0.11 release total-crashes nsIFrame::GetUsedBorderAndPadding.. crashes pct. all 342643 490 0.00143006 4.0b6 24477 374 0.0152797 3.0.19 9434 36 0.00381598 4.0b5 6395 32 0.00500391 3.5.13 14415 13 0.000901838 3.0b3 147 5 0.0340136 3.0.16 51 3 0.0588235 3.5b4 618 2 0.00323625 3.5.3 1083 2 0.00184672
the 4.0b version of the stack is a bit different than the 3.0.x version 21 4.0b6 [stack] xul.dll nsIFrame::GetUsedBorderAndPadding() xul.dll nsIFrame::GetContentRect() xul.dll nsImageFrame::GetInnerArea() xul.dll nsImageFrame::PaintImage(nsIRenderingContext &amp;,nsPoint,nsRect const &amp;,imgIContainer *,unsigned int) xul.dll nsDisplayImage::Paint(nsDisplayListBuilder * ,nsIRenderingContext *) xul.dll mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer *,gfxContext *,nsIntRegion const &amp;,nsIntRegion const &amp;,void *) 4 3.0.19 [stack] xul.dll nsIFrame::GetUsedBorderAndPadding() xul.dll nsIFrame::GetContentRect() xul.dll nsImageFrame::GetInnerArea() xul.dll nsImageFrame::PaintImage(nsIRenderingContext &amp;,nsPoint,nsRect const &amp;,imgIContainer *) xul.dll nsDisplayImage::Paint(nsDisplayListBuilder *,nsIRenderingContext *,nsRect const &amp;) xul.dll nsDisplayList::Paint(nsDisplayListBuilder *,nsIRenderingContext *,nsRect const &amp;)
Looks like NPSWF32.DLL is loaded in 100% of the crashes, so that could certainly be related. A substantial portion of the URLs are either: http://apps.facebook.com/wildones/index.php?track=bookmark&ref=ts http://apps.facebook.com/wildones/index.php?track=bookmark&ref=bookmarks
(In reply to comment #3) > bc, any tools that we could string together to take the set of urls from crash > reports and identify common tags and elements of the pages? An interesting idea. I can think of a couple of approaches that might work. I'll follow up with you in an email so as to not pollute this bug.
chofmann, I can't find this signature in the 4.0b7 top crash list. http://crash-stats.mozilla.com/topcrasher/byversion/Firefox/4.0b7 worksforme?
Taking off the blocker list then.
blocking2.0: final+ → -
Crash Signature: [@ nsIFrame::GetUsedBorderAndPadding() ]
Still some of these. In the past week... + 7.0.1 - 44 crashes + 8.0 - 38 crashes + 8.0.1 - 3 crashes
Currently it seems to only occur in FennecAndroid, with this stack: nsIFrame::GetUsedBorderAndPadding() const nsIFrame::GetContentRectRelativeToSelf() const nsImageFrame::GetInnerArea() const nsDisplayImage::GetBounds(bool*) nsDisplayImage::GetBounds(nsDisplayListBuilder*, bool*) nsDisplayItem::GetClippedBounds(nsDisplayListBuilder*) nsDisplayList::GetBounds(nsDisplayListBuilder*) const nsDisplaySubDocument::ComputeVisibility(nsDisplayListBuilder*, nsRegion*) nsDisplayList::ComputeVisibilityForSublist(nsDisplayListBuilder*, nsRegion*, nsRect const&, nsIFrame*) nsDisplayList::ComputeVisibilityForRoot(nsDisplayListBuilder*, nsRegion*, nsIFrame*) nsRootPresContext::ComputePluginGeometryUpdates(nsIFrame*, nsDisplayListBuilder*, nsDisplayList*) nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, unsigned int) PresShell::Paint(nsView*, nsRegion const&, unsigned int) nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) nsRefreshDriver::Tick(long long, mozilla::TimeStamp) ... bp-eca9ec24-86e8-4942-8022-40ad52150530 Most crashes have 0xf0dea83f as the crash address, which is frame poison. Note that we have similar stacks reported in bug 803536 and bug 819990 but those look more directly related to plugins, i.e. nsDisplayPlugin is near the top of the stack.
Crash Signature: [@ nsIFrame::GetUsedBorderAndPadding() ] → [@ nsIFrame::GetUsedBorderAndPadding() const ]
OS: Windows XP → Android
Hardware: x86 → Unspecified
Crash Signature: [@ nsIFrame::GetUsedBorderAndPadding() const ] → [@ nsIFrame::GetUsedBorderAndPadding() const ] [@ nsIFrame::GetUsedBorderAndPadding const ]
Closing because no crash reported since 12 weeks.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → WONTFIX
FYI, this still occurs in low volume but the signature now lacks 'const', e.g.: bp-95876e2a-5c87-4fff-8be2-da31e0180927 Probably not worth tracking though...
You need to log in before you can comment on or make changes to this bug.