722030 - Crash in nsFrame::DisplayBorderBackgroundOutline

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

It's #23 top crasher in 10.0b6.
It's probably related to bug 700288, bug 722024 and bug 722025 as it happens mainly with AMD Radeon HD 6xxx serie GPUs.

As its crash signature is not moving like bug 722024 and bug 722025, it's easier to track across versions.
It seems to be a 10.0 regression and first appeared in 10.0a1/20111002 with an Intel GPU and an old driver: bp-764592be-48a7-4144-bd81-8b63d2111006.

Signature 	nsFrame::DisplayBorderBackgroundOutline(nsDisplayListBuilder*, nsDisplayListSet const&, bool) More Reports Search
UUID	0295b590-0c08-4e10-9d78-7e5532120128
Date Processed	2012-01-28 02:05:01
Uptime	11262
Last Crash	1.1 days before submission
Install Age	7.4 hours since version was first installed.
Install Time	2012-01-27 18:41:40
Product	Firefox
Version	10.0
Build ID	20120123235200
Release Channel	beta
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 20 model 1 stepping 0
Crash Reason	EXCEPTION_ACCESS_VIOLATION_WRITE
Crash Address	0xffffffff91ac7e09
App Notes 	
AdapterVendorID: 1002, AdapterDeviceID: 9803, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.792.0.0
D2D? D2D+
DWrite? DWrite+
D3D10 Layers? D3D10 Layers+
Processor Notes 	This dump is too long and has triggered the automatic truncation routine
EMCheckCompatibility	True

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsFrame::DisplayBorderBackgroundOutline 	layout/generic/nsFrame.cpp:1347
1 	xul.dll 	nsInlineFrame::BuildDisplayList 	layout/generic/nsInlineFrame.cpp:188
2 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1995
3 	xul.dll 	nsInlineFrame::BuildDisplayList 	layout/generic/nsInlineFrame.cpp:188
4 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1995
5 	xul.dll 	nsBlockFrame::BuildDisplayList 	layout/generic/nsBlockFrame.cpp:6228
6 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1995
7 	xul.dll 	nsBlockFrame::BuildDisplayList 	layout/generic/nsBlockFrame.cpp:6228
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsFrame%3A%3ADisplayBorderBackgroundOutline%28nsDisplayListBuilder*%2C%20nsDisplayListSet%20const%26%2C%20bool%29

Comment 1

[Robert Kaiser]

[Tracking Requested - why for this release]:

This has been spiking over the last few days on Firefox 37.0.2, it's #16 with 0.9% of all crashes in yesterday's data for that release.

https://crash-stats.mozilla.com/report/list?signature=nsFrame%3A%3ADisplayBorderBackgroundOutline%28nsDisplayListBuilder*%2C%20nsDisplayListSet%20const%26%2C%20bool%29#tab-sigsummary says that the main gfx adapters for this crash are:

Advanced Micro Devices, Inc. 	AMD E-350 AMD Radeon HD 6310 series	1863 	62.706 %
Advanced Micro Devices, Inc. 	2411E6FE Display driver http://support1.toshiba-tro.de/tedd-files2/0/display-20110404110958.zip	553 	18.613 %
Advanced Micro Devices, Inc. 	AMD Radeon HD 6310 Graphics AMD Radeon HD 6310 Gr AMD Radeon HD 6310 Graphics	236 	7.943 %

Comment 2

[Tyler Downer [He/Him]]

[Tracking Requested - why for this release]:

Yep, seeing this in user feedback as well. Since 37 is so close to the end of the cycle, a fix in 38 would be nice

Comment 3

[Tyler Downer [He/Him]]

Example user crash, https://crash-stats.mozilla.com/report/index/d9808f62-61db-4e7b-b77d-a84f92150507

Comment 4

[Lawrence Mandel [:lmandel] (use needinfo)]

Given that we're scheduled to release 38 in 5 days, I'm going to set this as wontfix for 37. Looks like this does affect 38 and 39 albeit in lower quantities. I have nommed for tracking and will let Sylvestre and Liz make the call on whether they want to track this for these releases.

Comment 5

[jen strickland :jenstrickland]

Hoping to help Sylvestre and Liz, I went ahead and tracked for 38, 38.0.5, 39, and 40, since it's a week later.

Comment 6

[Robert Kaiser]

Tyler, what did you ni? me for here? I can't see any question I need to answer.

Comment 7

[Sylvestre Ledru [:Sylvestre]]

Too late for 38.0.5 but happy to take a fix for 39

Comment 8

[Tyler Downer [He/Him]]

Kairo, this is popping up regularly on the forums, just wanted your help tracking it down

Comment 9

[Robert Kaiser]

(In reply to Tyler Downer [:Tyler] from comment #8)
> Kairo, this is popping up regularly on the forums, just wanted your help
> tracking it down

This is a small-volume crash that we had for quite some time. I don't know any specific on tracking it down, it's not even exclusive to the Radeon HD 6xxx series, it's just hit there more frequently than on others. If anything can help there, it's an engineer taking a deeper look into what's going on in those dumps/stacks.

Comment 10

[Kate Glazko]

Liz, currently 37 crashes in 39 b1, compared to 160 in 37.0.2. Around 1 in 40/41.

Comment 11

[Liz Henry (:lizzard) (relman/hg->git project)]

Marking wontfix for 39. I'm not sure this is worth tracking. It spikes intermittently but no one is working on it.

David is there anything that looks actionable here?  Or can you suggest someone who might take a look?

Comment 12

[(Away)]

This is another instance of the "the AMD bug" aka bug 772330.

Normally we'd see this particular crash as nsStyleContext::DoGetStyleBorder, but it got inlined into the caller on this particular build.

Bug 1155836 has made an attempt at fixing these. I don't want to claim victory just yet, but I am hopeful. Please alert me if you see a new spike of "AuthenticAMD family 20" on any channel with buildid greater than 2015-05-08.

Comment 13

[Sylvestre Ledru [:Sylvestre]]

Not tracking the amd bug...

Comment 14

[Martijn Wargers (dead)]

Just crashed with this stack: https://crash-stats.mozilla.com/report/index/8d03175a-7182-46a0-9fa5-e30002160618

Comment 15

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'nsFrame::DisplayBorderBackgroundOutline':
 - nightly (version 51): 1 crash from 2016-08-01.
 - aurora  (version 50): 2 crashes from 2016-08-01.
 - beta    (version 49): 43 crashes from 2016-08-02.
 - release (version 48): 51 crashes from 2016-07-25.
 - esr     (version 45): 10 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       0       1       0
 - aurora        1       1       0
 - beta         13       1       0
 - release      16      12       6
 - esr           2       4       1

Affected platform: Windows

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora            #1014
 - beta    #461      #514
 - release #947      #1065
 - esr

Comment 16

[Liz Henry (:lizzard) (relman/hg->git project)]

Wontfix for beta, not a concern right now
Calixte here is another for your consideration.  Maybe if it's a lower bug number/from years ago/untouched for a year, set the bar higher, for the # of crashes or crash rank that our bot will mark affected.  I'm not sure where the line is.

Comment 17

[Sylvestre Ledru [:Sylvestre]]

Clearing the ni on calixte, bugs about the bot should be reported here:
https://github.com/mozilla/clouseau/issues

Comment 18

[Daniel Holbert [:dholbert]]

Reducing severity given low crash volume, and dropping with AMD Radeon HD 6xxx series from title since that's likely irrelevant at this point.

Comment 19

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.

Comment 20

[Daniel Holbert [:dholbert]]

Looks like all of the crashes in the last 6 months were on 78.15.0esr, too. Hopefully/likely this was fixed at some point since that version.