722024 - Crash in nsIFrame::GetOverflowRect with AMD Radeon HD 6xxx series

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

It's #8 top crasher in 10.0b6.
It's probably related to bug 700288 as it happens only with AMD Radeon HD 6xxx serie GPUs.

Signature 	xul.dll@0xc584d | nsIFrame::GetOverflowRect(nsOverflowType) More Reports Search
UUID	3665a4ce-da0c-4b1a-bd3a-0f4882120128
Date Processed	2012-01-28 08:06:59
Uptime	23204
Install Age	6.5 hours since version was first installed.
Install Time	2012-01-28 01:34:35
Product	Firefox
Version	10.0
Build ID	20120123235200
Release Channel	beta
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 20 model 2 stepping 0
Crash Reason	EXCEPTION_BREAKPOINT
Crash Address	0x60ea584d
App Notes 	
AdapterVendorID: 1002, AdapterDeviceID: 9806, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.860.0.0
D2D? D2D+
DWrite? DWrite+
D3D10 Layers? D3D10 Layers+
Processor Notes 	This dump is too long and has triggered the automatic truncation routine
EMCheckCompatibility	True

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	xul.dll@0xc584d 	
1 		@0x176f 	
2 	xul.dll 	nsIFrame::GetOverflowRect 	layout/generic/nsFrame.cpp:4792
3 	xul.dll 	nsHTMLScrollFrame::Reflow 	layout/generic/nsGfxScrollFrame.cpp:879
4 	xul.dll 	nsFrame::ComputeSize 	layout/generic/nsFrame.cpp:3722
5 	xul.dll 	nsHTMLReflowState::InitConstraints 	layout/generic/nsHTMLReflowState.cpp:1851
6 	xul.dll 	nsBlockReflowContext::ReflowBlock 	layout/generic/nsBlockReflowContext.cpp:294
7 	xul.dll 	nsBlockFrame::ReflowBlockFrame 	layout/generic/nsBlockFrame.cpp:3173
8 	xul.dll 	nsBlockFrame::ReflowLine 	layout/generic/nsBlockFrame.cpp:2480
9 	xul.dll 	nsBlockFrame::ReflowDirtyLines 	layout/generic/nsBlockFrame.cpp:1962
10 	xul.dll 	nsBlockFrame::Reflow 	layout/generic/nsBlockFrame.cpp:1051
11 	xul.dll 	nsBlockReflowContext::ReflowBlock 	layout/generic/nsBlockReflowContext.cpp:294
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=xul.dll%400xc584d%20|%20nsIFrame%3A%3AGetOverflowRect%28nsOverflowType%29

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

In a minidump for this bug, we have jumped to C584D which is int3 padding (invalid destination). The stack shows that we entered a function at C57C0, I think it's UnionRectEdges, then somehow we jumped forward like we've seen in other bugs. (I think this is basically a version of bug 700288).

Comment 2

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

I'm marking this bug as WORKSFORME as bug crashlog signature didn't appear from a long time (over half year) in Firefox (except some obsolete Fx <11).