803262 - Firefox 19 crash in mozilla::FrameLayerBuilder::CheckDOMModified

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

It started spiking in 19.0a1/20121018 and is currently #2 top crasher in today's build. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=dac5700acf8b&tochange=cb573b9307e5
Bug 802144 is my best guess.

See the comment of the following report:
Signature 	mozilla::FrameLayerBuilder::CheckDOMModified() More Reports Search
UUID	f980d908-90be-48f0-b111-c13222121018
Date Processed	2012-10-18 19:21:23
Uptime	17
Last Crash	1.1 minutes before submission
Install Age	4.4 hours since version was first installed.
Install Time	2012-10-18 14:54:52
Product	Firefox
Version	19.0a1
Build ID	20121018030618
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 37 stepping 5
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x8
User Comments	Crash happens after hovering my mouse over a thumbnail on my favourite wallpaper site.Not at the first thumbnail but at the fifth or sixth.
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x68ba, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.982.0.0
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- 
EMCheckCompatibility	True
Adapter Vendor ID	0x1002
Adapter Device ID	0x68ba
Total Virtual Memory	4294836224
Available Virtual Memory	3838681088
System Memory Use Percentage	21
Available Page File	15116595200
Available Physical Memory	6777569280

Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::FrameLayerBuilder::CheckDOMModified 	layout/base/FrameLayerBuilder.cpp:3284
1 	xul.dll 	mozilla::FrameLayerBuilder::DrawThebesLayer 	layout/base/FrameLayerBuilder.cpp:3115
2 	xul.dll 	mozilla::gfx::BaseRect<double,gfxRect,gfxPoint,gfxSize,gfxMargin>::RoundOut 	obj-firefox/dist/include/mozilla/gfx/BaseRect.h:348

More reports at:
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozilla%3A%3AFrameLayerBuilder%3A%3ACheckDOMModified%28%29

Comment 1

[Scoobidiver (away)]

More reports also at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3AFrameLayerBuilder%3A%3ADrawThebesLayer%28mozilla%3A%3Alayers%3A%3AThebesLayer*%2C+gfxContext*%2C+nsIntRegion+const%26%2C+nsIntRegion+const%26%2C+void*%29

Comment 2

[Josh Matthews [:jdm]]

I'm doubtful that it's related to 802144. I'm more inclined to look at some of Matt's patches that landed in that range.

Comment 3

[Matt Woodrow (:mattwoodrow)]

This isn't obviously caused by anything I landed, unless it exposed an existing bug somehow.

Looks like this affects windows with BasicLayers only.

Can't see how we're getting a crash address of 0x8 either, neither FrameLayerBuilder::mInitialDOMGeneration nor nsRootPresContext::mDOMGeneration are at that offset.

Comment 4

[Benoit Girard (:BenWa)]

I'm fairly sure this is a duplicate of bug 803826. Undupe if I'm wrong.

Comment 5

[Scoobidiver (away)]

(In reply to Benoit Girard (:BenWa) from comment #4)
> I'm fairly sure this is a duplicate of bug 803826. Undupe if I'm wrong.
It's not because it stopped in 19.0a1/20121020 before the patch of bug 803826 landed. The working range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=0ff60bfb3442&tochange=ff4af83233dc