568487 - Firefox Crash @ nsIFrame::BuildDisplayListForChild

Status: NEW

(Core :: Web Painting, defect)

Description

[chris hofmann]

this crash has been around for awhile at about 275 crashes per day

found in: 3.6.3 3.5.9 3.0.19 3.6 3.6.4 3.7a4 3.6.2 3.5 3.6b4 3.6b1 3.5.8 3.5.7 3.5.5 3.5.4 3.0b5 3.0b3 3.0.8 3.0.15 3.0

most frequently on xp and mac 10.4

Win5.1  0.79
Win6.0  0.03
Win6.1  0.06
Mac10.4 0.11
Mac10.5 0.00
Mac10.6 0.00
Lin2.4  0.00


there are a variety of forms of the stack with this one being the most frequent.

          41 nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder *,nsIFrame *,nsRect const &,nsDisplayListSet const &,unsigned int)
        DisplayLine
        nsBlockFrame::BuildDisplayList(nsDisplayListBuilder *,nsRect const &,nsDisplayListSet const &)
        nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder *,nsIFrame *,nsRect const &,nsDisplayListSet const &,unsigned int)
        DisplayLine
        nsBlockFrame::BuildDisplayList(nsDisplayListBuilder *,nsRect const &,nsDisplayListSet const &)
        nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder *,nsIFrame *,nsRect const &,nsDisplayListSet const &,unsigned int)
        DisplayLine

url's reflect general browsing

domains of sites
  30 http://www.facebook.com
  30 \N//
  12 http://www.orkut.com.br
  11 http://www.youtube.com
   9 //
   3 https://mail.google.com
   3 http://www.4shared.com
   3 http://vkontakte.ru
   3 http://tv.repubblica.it
   3 http://apps.facebook.com
   2 http://www.yamahaskola.cz
   2 http://www.keezmovies.com
   2 http://www.hulu.com
   2 http://www.ebay.de
   2 http://us.mg4.mail.yahoo.com
   2 about:blank//
   1 wyciwyg://3
   1 wyciwyg://2
   1 wyciwyg://0
<long tail snipped>

I'll post a breakdown of all the stacks and maybe the becomes a tracking bug for several that we need to spin off.

Comment 1

[chris hofmann]

Attachment: breakdown of nsiframebuilder stacks from 2010 05 26

Comment 2

[chris hofmann]

more reports at  http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=nsIFrame%3A%3ABuildDisplayListForChild%28nsDisplayListBuilder*%2C%20nsIFrame*%2C%20nsRect%20const%26%2C%20nsDisplayListSet%20const%26%2C%20unsigned%20int%29&date=05%2F27%2F2010%2006%3A35%3A42&range_value=1&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&signature=nsIFrame%3A%3ABuildDisplayListForChild%28nsDisplayListBuilder*%2C%20nsIFrame*%2C%20nsRect%20const%26%2C%20nsDisplayListSet%20const%26%2C%20unsigned%20int%29

Comment 3

[chris hofmann]

> 
> there are a variety of forms of the stack with this one being the most
> frequent.
> 
>           41 nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder *,nsIFrame
> *,nsRect const &,nsDisplayListSet const &,unsigned int)
>         DisplayLine
>         nsBlockFrame::BuildDisplayList(nsDisplayListBuilder *,nsRect const
> &,nsDisplayListSet const &)
>         nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder *,nsIFrame
> *,nsRect const &,nsDisplayListSet const &,unsigned int)
>         DisplayLine
>         nsBlockFrame::BuildDisplayList(nsDisplayListBuilder *,nsRect const
> &,nsDisplayListSet const &)
>         nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder *,nsIFrame
> *,nsRect const &,nsDisplayListSet const &,unsigned int)
>         DisplayLine
> 

here is a full report for this form of the stack

http://crash-stats.mozilla.com/report/index/bc16c8f7-66c5-4d1f-b326-3608a2100526

Comment 4

[chris hofmann]

here is a report for the second most frequent sequence in the top 8 frames

http://crash-stats.mozilla.com/report/index/b650276a-5d0a-4e67-ba5f-3d5c92100526

  13 nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder *,nsIFrame *,nsRect const &,nsDisplayListSet const &,unsigned int)
	nsContainerFrame::BuildDisplayListForNonBlockChildren(nsDisplayListBuilder *,nsRect const &,nsDisplayListSet const &,unsigned int)
	nsHTMLContainerFrame::DisplayTextDecorationsAndChildren(nsDisplayListBuilder *,nsRect const &,nsDisplayListSet const &)
	nsInlineFrame::BuildDisplayList(nsDisplayListBuilder *,nsRect const &,nsDisplayListSet const &)
	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder *,nsIFrame *,nsRect const &,nsDisplayListSet const &,unsigned int)
	DisplayLine
	nsBlockFrame::BuildDisplayList(nsDisplayListBuilder *,nsRect const &,nsDisplayListSet const &)
	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder *,nsIFrame *,nsRect const &,nsDisplayListSet const &,unsigned int)

Comment 5

[Scoobidiver (away)]

It is #50 top crasher in b7pre for the last week.

Signature	nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int)
UUID	dba5e01a-40fa-4b9b-922f-e3fca2101002
Time 	2010-10-02 05:57:41.844840
Uptime	209
Last Crash	43555 seconds (12.1 hours) before submission
Install Age	209 seconds (3.5 minutes) since version was first installed.
Product	Firefox
Version	4.0b7pre
Build ID	20101001082844
Branch	2.0
OS	Windows NT
OS Version	6.1.7600
CPU	x86
CPU Info	GenuineIntel family 15 model 4 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x4
App Notes 	AdapterVendorID: 1106, AdapterDeviceID: 3344

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1634
1 	xul.dll 	DisplayRows 	layout/tables/nsTableRowGroupFrame.cpp:229
2 	xul.dll 	nsTableFrame::DisplayGenericTablePart 	layout/tables/nsTableFrame.cpp:1242
3 	xul.dll 	nsTableRowGroupFrame::BuildDisplayList 	layout/tables/nsTableRowGroupFrame.cpp:271
4 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1691
5 	xul.dll 	nsTableFrame::GenericTraversal 	layout/tables/nsTableFrame.cpp:1182
6 	xul.dll 	nsTableFrame::DisplayGenericTablePart 	layout/tables/nsTableFrame.cpp:1242
7 	xul.dll 	nsTableFrame::BuildDisplayList 	layout/tables/nsTableFrame.cpp:1330
...
50 	xul.dll 	nsIFrame::BuildDisplayListForStackingContext 	layout/generic/nsFrame.cpp:1440
51 	xul.dll 	nsLayoutUtils::GetFramesForArea 	layout/base/nsLayoutUtils.cpp:1104
52 	xul.dll 	nsLayoutUtils::GetFrameForPoint 	layout/base/nsLayoutUtils.cpp:1074
53 	xul.dll 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6565
54 	xul.dll 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:1071
55 	xul.dll 	AttachedHandleEvent 	view/src/nsView.cpp:193
56 	xul.dll 	nsWindow::DispatchEvent 	widget/src/windows/nsWindow.cpp:3554
57 	xul.dll 	nsWindow::DispatchWindowEvent 	widget/src/windows/nsWindow.cpp:3577
58 	xul.dll 	nsWindow::DispatchMouseEvent 	widget/src/windows/nsWindow.cpp:4000
59 	xul.dll 	nsWindow::ClientMarginHitTestPoint 	widget/src/windows/nsWindow.cpp:5630
60 	xul.dll 	xul.dll@0x46d5d5 	
61 	xul.dll 	nsWindow::WindowProcInternal 	widget/src/windows/nsWindow.cpp:4353
62 	xul.dll 	nsWindow::WindowProc 	widget/src/windows/nsWindow.cpp:4305

More reports at:
http://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=nsIFrame%3A%3ABuildDisplayListForChild%28nsDisplayListBuilder*%2C%20nsIFrame*%2C%20nsRect%20const%26%2C%20nsDisplayListSet%20const%26%2C%20unsigned%20int%29&version=Firefox%3A4.0b7pre

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I don't think a crash at #50 is a blocker if we don't have steps to reproduce; I'd rather devote crash-fixing efforts to higher crashes or to crashes where we can repro.

Comment 7

[Scoobidiver (away)]

It is #37 top crasher in 4.0b10.

Comment 10

[Scoobidiver (away)]

It's "only" #68 top browser crasher in 9.0.1.
But it's #20 top browser crasher in 10.0b4, #22 in 11.0a2 and #37 in 12.0a1.

Now the stack looks like:
Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1962
1 	xul.dll 	nsBoxFrame::BuildDisplayList 	layout/xul/base/src/nsBoxFrame.cpp:1332
2 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1995
3 	xul.dll 	nsBoxFrame::BuildDisplayList 	layout/xul/base/src/nsBoxFrame.cpp:1332
4 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1995
5 	xul.dll 	nsBoxFrame::BuildDisplayList 	layout/xul/base/src/nsBoxFrame.cpp:1332
6 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:2038
7 	xul.dll 	nsBoxFrame::BuildDisplayList 	layout/xul/base/src/nsBoxFrame.cpp:1332
and so on

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsIFrame%3A%3ABuildDisplayListForChild%28nsDisplayListBuilder*%2C+nsIFrame*%2C+nsRect+const%26%2C+nsDisplayListSet+const%26%2C+unsigned+int%29
https://crash-stats.mozilla.com/report/list?signature=nsIFrame%3A%3ABuildDisplayListForChild

Please don't exclude it from the desktop top crasher list because it has a mobile keyword. See http://bit.ly/vO7SxB.

Comment 11

[Alex Keybl [:akeybl]]

roc - can you find an assignee for this issue? We're making sure that every tracked issue (including top crashers) have an assignee.

Please let us know how QA and the crash-kill help in the investigation. We should try to figure out next steps.

Comment 12

[Timothy Nikkel (:tnikkel)]

I've seen this crash in crash stats for a long time now, but the stacks never provide me anything useful to go on. The stacks are normal, but we crash in a weird place. Maybe something is stepping on our memory? Can we look at correlations with addons or plugins or drivers or anything? I'm not really sure where to go with this.

Comment 13

[Timothy Nikkel (:tnikkel)]

Being able to reproduce somewhere would obviously help.

Comment 14

[Timothy Nikkel (:tnikkel)]

Did this spike in frequency? If so changesets that might have caused a spike might be useful.

Comment 15

[Scoobidiver (away)]

(In reply to Timothy Nikkel (:tn) from comment #12)
> Can we look at correlations with addons or plugins or drivers or anything?
EXCEPTION_ILLEGAL_INSTRUCTION crashes are correlated to ATI/AMD drivers:
  nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayListSet const&, unsigned int)|EXCEPTION_ILLEGAL_INSTRUCTION (165 crashes)
     95% (156/165) vs.   6% (3150/54820) atidxx32.dll
         72% (118/165) vs.   1% (352/54820) 8.17.10.318
          5% (9/165) vs.   0% (106/54820) 8.17.10.325
          7% (11/165) vs.   0% (141/54820) 8.17.10.331
          2% (3/165) vs.   0% (160/54820) 8.17.10.337
          4% (7/165) vs.   0% (213/54820) 8.17.10.355
          1% (2/165) vs.   1% (383/54820) 8.17.10.362
          1% (1/165) vs.   0% (112/54820) 8.17.10.378
          1% (2/165) vs.   0% (243/54820) 8.17.10.405
          2% (3/165) vs.   1% (532/54820) 8.17.10.414
I filed bug 728533 for that.

There are no clear correlations for EXCEPTION_ACCESS_VIOLATION_READ crashes.

Note: this crash doesn't appear in the desktop top crashers because it has the mobile-crash whiteboard (see https://wiki.mozilla.org/Platform/2012-02-14#Desktop).

Comment 16

[Sheila Mooney]

Is this a candidate for the blocklist? Is there some specific fix in mind?

Comment 17

[Timothy Nikkel (:tnikkel)]

Best theory so far is that AMD/ATI are causing this to increase (bug 728533) (although doesn't seem responsible for all crashes). Blocklisting those drivers is bug 722538.

Comment 18

[Alex Keybl [:akeybl]]

The blocklist should have gone live yesterday - we'll follow up with Jorge and Sheila to make sure it's enabled for all beta users and to find out whether or not it's lowering the crash numbers here.

Comment 19

[Alex Keybl [:akeybl]]

(In reply to Alex Keybl [:akeybl] from comment #18)
> The blocklist should have gone live yesterday - we'll follow up with Jorge
> and Sheila to make sure it's enabled for all beta users and to find out
> whether or not it's lowering the crash numbers here.

This didn't happen - there were issues in bug 722538 when testing on staging that prevented this from going out. We're working with Juan/Marcia to verify before rolling out the blocklist.

Comment 20

[Scoobidiver (away)]

(In reply to Timothy Nikkel (:tn) from comment #17)
> Best theory so far is that AMD/ATI are causing this to increase (bug 728533)
> (although doesn't seem responsible for all crashes). Blocklisting those
> drivers is bug 722538.
Bug 7282533 depends on bug 722538.

Comment 21

[Alex Keybl [:akeybl]]

Bug 722538 has now been resolved - we should watch for crash numbers to drop.

Comment 22

[Alex Keybl [:akeybl]]

(In reply to Alex Keybl [:akeybl] from comment #21)
> Bug 722538 has now been resolved - we should watch for crash numbers to drop.

This does not appear to have helped. We're still seeing this crash at #23 in the top crash list for beta 4. Given where we are in the schedule and the fact that this isn't a recent regression at this point, wontfixing for FF12.

Comment 23

[Scoobidiver (away)]

(In reply to Alex Keybl [:akeybl] from comment #22)
> This does not appear to have helped.
It's the wrong bug. Bug 728533 is the right one.

Comment 24

[Scoobidiver (away)]

It's #53 top browser crasher in 13.0.1, #37 in 14.0b11, #65 in 15.0a2, and #71 in 16.0a1.

Comment 25

[Scoobidiver (away)]

Since Firefox 17, it has been a low volume crash: https://crash-stats.mozilla.com/report/list?signature=nsIFrame%3A%3ABuildDisplayListForChild%28nsDisplayListBuilder*%2C+nsIFrame*%2C+nsRect+const%26%2C+nsDisplayListSet+const%26%2C+unsigned+int%29

Comment 26

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'nsIFrame::BuildDisplayListForChild':
 - nightly (version 53): 13 crashes from 2016-11-14.
 - aurora  (version 52): 16 crashes from 2016-11-14.
 - beta    (version 51): 307 crashes from 2016-11-14.
 - release (version 50): 1029 crashes from 2016-11-01.
 - esr     (version 45): 291 crashes from 2016-07-06.

Crash volume on the last weeks (Week N is from 01-02 to 01-08):
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       4       2       4       0       1       1       1
 - aurora        8       0       1       1       4       1       0
 - beta         34      43      43      51      56      57      17
 - release     148     171     146     179     138     144      60
 - esr          11      20      21       8      12      15       8

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly           #212
 - aurora  #954      #358
 - beta    #456      #171
 - release #574      #260
 - esr     #699

Comment 27

[Julien Cristau [:jcristau] (back April 22)]

Too late for firefox 52, mass-wontfix.

Comment 28

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 10 content process crashes on beta

For more information, please visit auto_nag documentation.

Comment 29

[BugBot [:suhaib / :marco/ :calixte]]

Based on the topcrash criteria, the crash signatures linked to this bug are not in the topcrash signatures anymore.

For more information, please visit auto_nag documentation.

Comment 30

[Timothy Nikkel (:tnikkel)]

Only 4 crashes that are newer than 105. Lowering severity.