Closed Bug 722024 Opened 8 years ago Closed 3 years ago

Crash in nsIFrame::GetOverflowRect with AMD Radeon HD 6xxx series


(Core :: Layout, defect, critical)

10 Branch
Windows 7
Not set





(Reporter: scoobidiver, Unassigned)


(Blocks 1 open bug)


(Keywords: crash)

Crash Data

It's #8 top crasher in 10.0b6.
It's probably related to bug 700288 as it happens only with AMD Radeon HD 6xxx serie GPUs.

Signature 	xul.dll@0xc584d | nsIFrame::GetOverflowRect(nsOverflowType) More Reports Search
UUID	3665a4ce-da0c-4b1a-bd3a-0f4882120128
Date Processed	2012-01-28 08:06:59
Uptime	23204
Install Age	6.5 hours since version was first installed.
Install Time	2012-01-28 01:34:35
Product	Firefox
Version	10.0
Build ID	20120123235200
Release Channel	beta
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 20 model 2 stepping 0
Crash Address	0x60ea584d
App Notes 	
AdapterVendorID: 1002, AdapterDeviceID: 9806, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.860.0.0
D2D? D2D+
DWrite? DWrite+
D3D10 Layers? D3D10 Layers+
Processor Notes 	This dump is too long and has triggered the automatic truncation routine
EMCheckCompatibility	True

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	xul.dll@0xc584d 	
1 		@0x176f 	
2 	xul.dll 	nsIFrame::GetOverflowRect 	layout/generic/nsFrame.cpp:4792
3 	xul.dll 	nsHTMLScrollFrame::Reflow 	layout/generic/nsGfxScrollFrame.cpp:879
4 	xul.dll 	nsFrame::ComputeSize 	layout/generic/nsFrame.cpp:3722
5 	xul.dll 	nsHTMLReflowState::InitConstraints 	layout/generic/nsHTMLReflowState.cpp:1851
6 	xul.dll 	nsBlockReflowContext::ReflowBlock 	layout/generic/nsBlockReflowContext.cpp:294
7 	xul.dll 	nsBlockFrame::ReflowBlockFrame 	layout/generic/nsBlockFrame.cpp:3173
8 	xul.dll 	nsBlockFrame::ReflowLine 	layout/generic/nsBlockFrame.cpp:2480
9 	xul.dll 	nsBlockFrame::ReflowDirtyLines 	layout/generic/nsBlockFrame.cpp:1962
10 	xul.dll 	nsBlockFrame::Reflow 	layout/generic/nsBlockFrame.cpp:1051
11 	xul.dll 	nsBlockReflowContext::ReflowBlock 	layout/generic/nsBlockReflowContext.cpp:294

More reports at:|%20nsIFrame%3A%3AGetOverflowRect%28nsOverflowType%29
Depends on: 722538
Depends on: 755974
In a minidump for this bug, we have jumped to C584D which is int3 padding (invalid destination). The stack shows that we entered a function at C57C0, I think it's UnionRectEdges, then somehow we jumped forward like we've seen in other bugs. (I think this is basically a version of bug 700288).
Crash Signature: [@ xul.dll@0xba28d | nsIFrame::GetOverflowRect(nsOverflowType)] [@ xul.dll@0xc584d | nsIFrame::GetOverflowRect(nsOverflowType)] → [@ xul.dll@0xba28d | nsIFrame::GetOverflowRect(nsOverflowType)] [@ xul.dll@0xc584d | nsIFrame::GetOverflowRect(nsOverflowType)] [@ xul.dll@0xba28d | nsIFrame::GetOverflowRect] [@ xul.dll@0xc584d | nsIFrame::GetOverflowRect]
I'm marking this bug as WORKSFORME as bug crashlog signature didn't appear from a long time (over half year) in Firefox (except some obsolete Fx <11).
Closed: 3 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.