644696 - Crash Report [@ nsIFrame::GetUsedBorder() ]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Marcia Knous [:marcia]]

Seen while viewing the Top Changers report. https://crash-stats.mozilla.com/report/list?range_value=7&range_unit=days&signature=nsIFrame%3A%3AGetUsedBorder%28%29&version=Firefox links to the crashes.

https://crash-stats.mozilla.com/report/index/1c261424-13dc-4eda-8539-4de0d2110324

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsIFrame::GetUsedBorder 	layout/generic/nsFrame.cpp:652
1 	xul.dll 	nsBoxFrame::BuildDisplayList 	layout/xul/base/src/nsBoxFrame.cpp:1306
2 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1749
3 	xul.dll 	nsBoxFrame::BuildDisplayList 	layout/xul/base/src/nsBoxFrame.cpp:1321
4 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1706
5 	xul.dll 	nsBoxFrame::BuildDisplayList 	layout/xul/base/src/nsBoxFrame.cpp:1321
6 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1706
7 	xul.dll 	nsBoxFrame::BuildDisplayList 	layout/xul/base/src/nsBoxFrame.cpp:1321
8 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1704
9 	xul.dll 	nsBoxFrame::BuildDisplayListForChildren 	layout/xul/base/src/nsBoxFrame.cpp:1359
10 	xul.dll 	nsRootBoxFrame::BuildDisplayList 	layout/xul/base/src/nsRootBoxFrame.cpp:250
11 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1706
12 	xul.dll 	nsIFrame::BuildDisplayListForStackingContext 	layout/generic/nsFrame.cpp:1455
13 	xul.dll 	nsLayoutUtils::PaintFrame 	layout/base/nsLayoutUtils.cpp:1457
14 	xul.dll 	PresShell::Paint 	layout/base/nsPresShell.cpp:6203

Comment 1

[Robert Kaiser]

This is #117 with ~40 crashes per million ADU on yesterday's 4.0* list and is rising. What looks very interesting is the correlations for 4.0 in https://crash-stats.mozilla.com/report/list?signature=nsIFrame%3A%3AGetUsedBorder() - at least those for modules:

83% (72/87) vs.   3% (1830/56849) atiuxpag.dll
83% (72/87) vs.   3% (1834/56849) atidxx32.dll
83% (72/87) vs.   3% (1929/56849) aticfx32.dll
84% (73/87) vs.  10% (5943/56849) d3d10.dll
84% (73/87) vs.  10% (5943/56849) d3d10core.dll
84% (73/87) vs.  10% (5950/56849) d2d1.dll
85% (74/87) vs.  12% (6723/56849) d3d10_1core.dll
85% (74/87) vs.  12% (6723/56849) d3d10_1.dll
85% (74/87) vs.  12% (6768/56849) dxgi.dll

That looks to me like graphics plays a significant part here in the 4.0 case - on 3.6, this signature appears but rarely enough that we don't get correlation info.

bz, do we need to pull graphics people into this one or is this purely a layout thing (not too high volume right now, but I caught it due to rising in volume)?

Comment 2

[Boris Zbarsky [:bzbarsky]]

You probably want roc and Timothy here.

Comment 3

[Timothy Nikkel (:tnikkel)]

I took a look at a handful of stacks and I wasn't able to glean anything useful.

Comment 4

[Robert Kaiser]

This signature is heavily exploding on the 2012-02-28 Aurora build now.

Correlations for Firefox 12.0a2 Windows NT

    98% (101/103) vs.  10% (348/3505) atiuxpag.dll
    98% (101/103) vs.  10% (357/3505) atidxx32.dll
    88% (91/103) vs.   9% (328/3505) aticfx32.dll
    98% (101/103) vs.  20% (695/3505) d3d10.dll
    98% (101/103) vs.  20% (695/3505) d3d10core.dll
    98% (101/103) vs.  20% (703/3505) d2d1.dll
    98% (101/103) vs.  21% (743/3505) dxgi.dll
    98% (101/103) vs.  21% (743/3505) d3d10_1core.dll
    98% (101/103) vs.  21% (743/3505) d3d10_1.dll
    100% (103/103) vs.  34% (1199/3505) explorerframe.dll
    100% (103/103) vs.  34% (1200/3505) dui70.dll
    100% (103/103) vs.  35% (1227/3505) duser.dll
    100% (103/103) vs.  36% (1257/3505) slc.dll
    100% (103/103) vs.  36% (1279/3505) srvcli.dll
    100% (103/103) vs.  37% (1299/3505) cscapi.dll
    100% (103/103) vs.  37% (1304/3505) RpcRtRemote.dll
    100% (103/103) vs.  38% (1338/3505) EhStorShell.dll

Comment 5

[Mats Palmgren (inactive)]

This crash still occurs in recent versions (v60+), but in very low volume, e.g.:

bp-64fc75a8-d623-4c26-8b7c-8f9790180609
nsIFrame::GetUsedBorder()
nsCSSRendering::ComputeImageLayerPositioningArea(nsPresContext*, nsIFrame*, nsRect const&, nsStyleImageLayers::Layer const&, nsIFrame**, bool*)
nsDisplayBackgroundImage::GetPositioningArea()
nsDisplayBackgroundImage::ComputeInvalidationRegion(nsDisplayListBuilder*, nsDisplayItemGeometry const*, nsRegion*)
...

bp-7b2a1ec1-64f7-4535-a0c8-c59fa0180609
nsIFrame::GetUsedBorder()
mozilla::ReflowInput::GetHypotheticalBoxContainer(nsIFrame*, int&, mozilla::LogicalSize&)
mozilla::ReflowInput::CalculateHypotheticalPosition(nsPresContext*, nsPlaceholderFrame*, mozilla::ReflowInput const*, nsHypotheticalPosition&, mozilla::LayoutFrameType)
mozilla::ReflowInput::InitAbsoluteConstraints(nsPresContext*, mozilla::ReflowInput const*, mozilla::LogicalSize const&, mozilla::LayoutFrameType)
mozilla::ReflowInput::InitConstraints(nsPresContext*, mozilla::LogicalSize const&, nsMargin const*, nsMargin const*, mozilla::LayoutFrameType)
mozilla::ReflowInput::Init(nsPresContext*, mozilla::LogicalSize const*, nsMargin const*, nsMargin const*)
mozilla::ReflowInput::ReflowInput(nsPresContext*, mozilla::ReflowInput const&, nsIFrame*, mozilla::LogicalSize const&, mozilla::LogicalSize const*, unsigned int)
nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsIFrame*, nsReflowStatus&, nsOverflowAreas*)
nsAbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsOverflowAreas*)
nsFrame::ReflowAbsoluteFrames(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, bool)
nsBoxFrame::DoXULLayout(nsBoxLayoutState&)
nsSprocketLayout::XULLayout(nsIFrame*, nsBoxLayoutState&)
nsBoxFrame::DoXULLayout(nsBoxLayoutState&)
nsSprocketLayout::XULLayout(nsIFrame*, nsBoxLayoutState&)
nsBoxFrame::DoXULLayout(nsBoxLayoutState&)
nsIFrame::XULLayout(nsBoxLayoutState&)
nsStackLayout::XULLayout(nsIFrame*, nsBoxLayoutState&)
nsBoxFrame::DoXULLayout(nsBoxLayoutState&)
nsIFrame::XULLayout(nsBoxLayoutState&)
nsBoxFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)
nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*)
mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)
...

Comment 6

[Pablo]

It seems this crash no longer occurs since I cant find any reports on it , I will close it as WFM and then if it starts to reoccur we can reopen the issue