Closed Bug 837371 Opened 7 years ago Closed 7 years ago

crash in nsContainerFrame::BuildDisplayListForNonBlockChildren mainly with AMD Radeon HD 6xxx series


(Core :: Layout, defect, critical)

19 Branch
Windows 7
Not set



Tracking Status
firefox18 --- unaffected
firefox19 - unaffected
firefox20 --- unaffected


(Reporter: scoobidiver, Unassigned)


(Blocks 1 open bug)


(Keywords: crash, regression, topcrash)

Crash Data

It first showed up in 19.0b4 and is #21 top browser crasher in the first hours of this version. The regression range is:
I suspect the backout in Beta of bug 806256 or bug 807563.

Signature 	nsContainerFrame::BuildDisplayListForNonBlockChildren(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&, unsigned int) More Reports Search
UUID	2c3879ad-1cbc-4edb-b19b-14d582130202
Date Processed	2013-02-02 09:05:12
Uptime	12731
Last Crash	4.3 hours before submission
Install Age	8.0 hours since version was first installed.
Install Time	2013-02-02 01:03:30
Product	Firefox
Version	19.0
Build ID	20130130080006
Release Channel	beta
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 20 model 1 stepping 0
Crash Address	0x4346980f
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x9803, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.792.0.0
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
Processor Notes 	sp-processor04.phx1.mozilla.com_30666:2008
EMCheckCompatibility	True
Adapter Vendor ID	0x1002
Adapter Device ID	0x9803
Total Virtual Memory	4294836224
Available Virtual Memory	3584851968
System Memory Use Percentage	48
Available Page File	3968004096
Available Physical Memory	1429270528

Frame 	Module 	Signature 	Source
0 		@0x4346980f 	
1 	xul.dll 	nsContainerFrame::BuildDisplayListForNonBlockChildren 	layout/generic/nsContainerFrame.cpp:334
2 	xul.dll 	nsContainerFrame::BuildDisplayListForInline 	layout/generic/nsContainerFrame.h:406
3 	xul.dll 	BuildDisplayListWithOverflowClip 	layout/generic/nsFrame.cpp:1715
4 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:2235
5 	xul.dll 	DisplayLine 	layout/generic/nsBlockFrame.cpp:6091
6 	xul.dll 	nsBlockFrame::BuildDisplayList 	layout/generic/nsBlockFrame.cpp:6188
7 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:2237
8 	xul.dll 	nsCanvasFrame::BuildDisplayList 	layout/generic/nsCanvasFrame.cpp:317
9 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:2237
10 	xul.dll 	nsGfxScrollFrameInner::BuildDisplayList 	layout/generic/nsGfxScrollFrame.cpp:2072
11 	xul.dll 	nsHTMLScrollFrame::BuildDisplayList 	layout/generic/nsGfxScrollFrame.h:377
12 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:2237
13 	xul.dll 	ViewportFrame::BuildDisplayList 	layout/generic/nsViewportFrame.cpp:73
14 	xul.dll 	nsIFrame::BuildDisplayListForStackingContext 	layout/generic/nsFrame.cpp:1930
15 	xul.dll 	nsSubDocumentFrame::BuildDisplayList 	layout/generic/nsSubDocumentFrame.cpp:369
16 	xul.dll 	nsIFrame::BuildDisplayListForStackingContext 	layout/generic/nsFrame.cpp:1930
17 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:2254
18 	xul.dll 	nsStackFrame::BuildDisplayListForChildren 	layout/xul/base/src/nsStackFrame.cpp:61
58 	xul.dll 	nsRootBoxFrame::BuildDisplayList 	layout/xul/base/src/nsRootBoxFrame.cpp:213
59 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:2237
60 	xul.dll 	ViewportFrame::BuildDisplayList 	layout/generic/nsViewportFrame.cpp:73
61 	xul.dll 	nsIFrame::BuildDisplayListForStackingContext 	layout/generic/nsFrame.cpp:1930
62 	xul.dll 	nsLayoutUtils::PaintFrame 	layout/base/nsLayoutUtils.cpp:1855
63 	xul.dll 	PresShell::Paint 	layout/base/nsPresShell.cpp:5356
64 	xul.dll 	nsViewManager::ProcessPendingUpdatesForView 	view/src/nsViewManager.cpp:430
65 	xul.dll 	nsViewManager::ProcessPendingUpdates 	view/src/nsViewManager.cpp:1218
66 	xul.dll 	nsRefreshDriver::Notify 	layout/base/nsRefreshDriver.cpp:436
67 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:485
68 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:565
69 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:627
70 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:117
71 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/
72 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/
73 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:163
74 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:229
75 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:290
76 	xul.dll 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3823
77 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3890
78 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:4084
79 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:105

More reports at:*%2C+nsRect+const%26%2C+nsDisplayListSet+const%26%2C+unsigned+int%29
It's currently #14 top browser crasher in 19.0b4 and correlated to ATI GPUs:
  nsContainerFrame::BuildDisplayListForNonBlockChildren(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&, unsigned int)|EXCEPTION_ACCESS_VIOLATION_EXEC (37 crashes)
     97% (36/37) vs.   3% (1878/54582) aticfx32.dll
     95% (35/37) vs.   3% (1554/54582) atidxx32.dll
     95% (35/37) vs.   3% (1572/54582) atiuxpag.dll

Checking App Notes in crash reports shows it's restricted to 980<n> device IDs.
Blocks: 605780
Depends on: 772330
Keywords: topcrash
Summary: crash in nsContainerFrame::BuildDisplayListForNonBlockChildren → crash in nsContainerFrame::BuildDisplayListForNonBlockChildren mainly with AMD Radeon HD 6xxx series
Assignee: nobody → matt.woodrow
I don't see the correlation between bug 806256/807563 and this crash.

The crashing code hasn't changed since hg1, and the crashing line doesn't dereference anything.

I also can't see how this code could possibly be affected by device drivers.
Assignee: matt.woodrow → nobody
(In reply to Matt Woodrow (:mattwoodrow) from comment #3)
> I don't see the correlation between bug 806256/807563 and this crash.
It's not caused directly by those bugs but by the induced shift in layout addresses. See bug 772330.
We backed out bug 806256 and bug 807563 due to bug 832611, another top crasher.

For bug 700288 (similar FF11 crash spike), we resolved bug 722538 and bug 755974. So it's not clear that we can blocklist anything to resolve this.

Our options are:
1) Do nothing, hope beta 5/6 and the release build are unaffected
2) Do nothing, because this crash only accounts for 0.36% of crashes on b4 currently
3) Take bug 806256 and bug 807563 again, as well as the forward fix in bug 832611
4) ?

What do you all think?
I don't see why we think taking any code change would affect this bug. If this in fact an instance of bug 772330, then it is merely a problem with a particular build that would probably not affect a subsequent build; probably even a subsequent build on the exact same changeset.
(In reply to Benjamin Smedberg  [:bsmedberg] from comment #6)
> I don't see why we think taking any code change would affect this bug. If
> this in fact an instance of bug 772330

dbaron agreed with you over email - is there anything we can do to gain confidence that this is in fact an instance of bug 772330 (other than wait and see)?
Mozilla/5.0 (Windows NT 6.1; rv:19.0) Gecko/20100101 Firefox/19.0
Build ID: 20130206083616
Build ID: 20130130080006

I have a AMD Radeon HD 6450 GPU. I loaded about 50 web pages with lots of content, images, videos, charts, different fonts. I was able to crash FF 19 beta 4 ( and beta 5 ( and but my crashes have no signature.
(In reply to Bogdan Maris [QA] from comment #9)
I don't think your crashes are related to this bug.
If you have reliable steps to reproduce, please file a new bug.
I spoke to Alex about this and he suggests we continue to track this so we can evaluate crashstats data for 19.0b5.
There are no crashes in 19.0b5.
Closed: 7 years ago
Resolution: --- → WORKSFORME
(In reply to Scoobidiver from comment #12)
> There are no crashes in 19.0b5.

That's great news. Thanks for keeping on top of this.
You need to log in before you can comment on or make changes to this bug.