633903 - Crash [@ mozalloc_abort(char const* const) | mozalloc_handle_oom() | mozilla::`anonymous namespace''::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&) ]

Status: RESOLVED DUPLICATE of bug 600150

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

They are new crash signatures. Crashes first appeared in 4.0b11pre/20110127.
With combined signatures, it is a virtual #34 top crasher in 4.0b11 over the last week.

Stack traces look like:
Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1298
1 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1224
2 	xul.dll 	mozilla::FrameLayerBuilder::BuildContainerLayerFor 	layout/base/FrameLayerBuilder.cpp:1576
3 	xul.dll 	nsDisplayOwnLayer::BuildLayer 	layout/base/nsDisplayList.cpp:1667
4 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1258
5 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1224
6 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1224
7 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1224
8 	xul.dll 	mozilla::FrameLayerBuilder::BuildContainerLayerFor 	layout/base/FrameLayerBuilder.cpp:1576
9 	xul.dll 	nsDisplayList::PaintForFrame 	layout/base/nsDisplayList.cpp:515
10 	xul.dll 	nsLayoutUtils::PaintFrame 	layout/base/nsLayoutUtils.cpp:1557
11 	xul.dll 	PresShell::Paint 	layout/base/nsPresShell.cpp:6188
12 	xul.dll 	nsViewManager::RenderViews 	view/src/nsViewManager.cpp:458
13 	xul.dll 	nsViewManager::Refresh 	view/src/nsViewManager.cpp:424
14 	xul.dll 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:925
15 	xul.dll 	AttachedHandleEvent 	view/src/nsView.cpp:193
16 	xul.dll 	nsWindow::DispatchEvent 	widget/src/windows/nsWindow.cpp:3746
17 	xul.dll 	nsWindow::DispatchWindowEvent 	widget/src/windows/nsWindow.cpp:3774
18 	xul.dll 	nsWindow::OnPaint 	widget/src/windows/nsWindowGfx.cpp:483
19 	xul.dll 	nsWindow::ProcessMessage 	widget/src/windows/nsWindow.cpp:5009
20 	xul.dll 	nsWindow::WindowProcInternal 	widget/src/windows/nsWindow.cpp:4580
21 	xul.dll 	CallWindowProcCrashProtected 	xpcom/base/nsCrashOnException.cpp:75
...

Frame 	Module 	Signature [Expand] 	Source
0 	mozalloc.dll 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:77
1 	mozalloc.dll 	mozalloc_handle_oom 	memory/mozalloc/mozalloc_oom.cpp:54
2 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1318
3 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1224
4 	xul.dll 	mozilla::FrameLayerBuilder::BuildContainerLayerFor 	layout/base/FrameLayerBuilder.cpp:1576
5 	xul.dll 	nsDisplayOwnLayer::BuildLayer 	layout/base/nsDisplayList.cpp:1667
6 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1258
7 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1224
8 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1224
9 	xul.dll 	mozilla::`anonymous namespace'::ContainerState::ProcessDisplayItems 	layout/base/FrameLayerBuilder.cpp:1224
10 	xul.dll 	mozilla::FrameLayerBuilder::BuildContainerLayerFor 	layout/base/FrameLayerBuilder.cpp:1576
11 	xul.dll 	nsDisplayList::PaintForFrame 	layout/base/nsDisplayList.cpp:515
12 	xul.dll 	nsLayoutUtils::PaintFrame 	layout/base/nsLayoutUtils.cpp:1557
13 	xul.dll 	PresShell::Paint 	layout/base/nsPresShell.cpp:6188
14 	xul.dll 	nsRegion::Or 	gfx/src/nsRegion.cpp:840
15 	xul.dll 	nsViewManager::Refresh 	view/src/nsViewManager.cpp:424
16 	xul.dll 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:925
17 		@0x7350483 	
18 	xul.dll 	SearchTable 	obj-firefox/xpcom/build/pldhash.c:439
19 	xul.dll 	nsAbsoluteContainingBlock::Reflow 	layout/generic/nsAbsoluteContainingBlock.cpp:142

The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e0fc18b3bc41&tochange=b5314bc1a926

More reports at:
https://crash-stats.mozilla.com/report/list?product=Firefox&range_value=4&range_unit=weeks&signature=mozilla%3A%3A%60anonymous%20namespace%27%27%3A%3AContainerState%3A%3AProcessDisplayItems%28nsDisplayList%20const%26%2C%20mozilla%3A%3AFrameLayerBuilder%3A%3AClip%26%29
https://crash-stats.mozilla.com/report/list?product=Firefox&range_value=4&range_unit=weeks&signature=mozalloc_abort%28char%20const*%20const%29%20|%20mozalloc_handle_oom%28%29%20|%20mozilla%3A%3A%60anonymous%20namespace%27%27%3A%3AContainerState%3A%3AProcessDisplayItems%28nsDisplayList%20const%26%2C%20mozilla%3A%3AFrameLayerBuilder%3A%3AClip%26%29

Comment 1

[Scoobidiver (away)]

It is now a virtual #16 top crasher in 4.0b11.

Comment 2

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

(In reply to comment #1)
> It is now a virtual #16 top crasher in 4.0b11.

By this, Scoobidiver means that if you add the numbers for the two separate crashes, the sum would be ranked #16.

Comment 3

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

er, two separate crash *signatures*

Comment 4

[Mike Beltzner [:beltzner, not reading bugmail]]

The regression range contains a lot of follow up fixes for bug 627273, which has to do with layer construction.

There's also tn's checkin for bug 628745 (rounded rects) but that seems less suspicious to me.

Comment 5

[Mike Beltzner [:beltzner, not reading bugmail]]

tn: can you please look and see if this was caused by bug 628745, which dbaron tells me is the more likely regression culprit?

Renominate if you think we should block, or if you think we can take it on a stability release.

Comment 6

[Timothy Nikkel (:tnikkel)]

I think the regression range is just because my patch for bug 628745 changed the signature for ContainerState::ProcessDisplayItems. So this is just an existing crash whose signature has changed. Bug 600150 was filed on this crash a long time ago.