This site is normally a pretty good example of this crash: http://vinothkumarm.blogspot.com/2009/02/police-car.html 1. Wait for the page to load. 2. Scroll down the page. It will probably freeze. 3. Try to switch tabs. 4. Wait and it should crash within 10 seconds.

(In reply to comment #1) > This site is normally a pretty good example of this crash: > http://vinothkumarm.blogspot.com/2009/02/police-car.html > > 1. Wait for the page to load. > 2. Scroll down the page. It will probably freeze. > 3. Try to switch tabs. > 4. Wait and it should crash within 10 seconds. Hrm, works like a charm for me. I thought you might be running out of VRAM but it doesn't seem that RAM heavy, and D3D should just swap out stuff to RAM.. I'm not sure I understand why it would crash for you.

Never mind, got it now, thanks!

(In reply to comment #2) > Hrm, works like a charm for me. I thought you might be running out of VRAM but > it doesn't seem that RAM heavy, and D3D should just swap out stuff to RAM.. I'm > not sure I understand why it would crash for you. it doesn't crash every time. It sometimes just completely locks up the browser. The last three crashes I've had in Firefox have been then same: de790838-7d00-4b54-a186-68d2c2100304, 8a22056f-b6c0-401d-a41b-f8d442100304, e300cbef-4520-47c7-a445-e71c02100303. Is there anything I can do to help you track this down?

So the fact the way this crashes the way it does is because d2dsurf->surface is released and NULL'ed out on an error in acquire_source. This is wrong in the first place. But I still need to figure out why there's an error in the map that causes this to occur. In any case I'm on it.

The problem triggering all of this is nsWindow::Scroll giving us an affectedRect with a y of -4179.. This in turn seems to be caused by the function getting passed in a destRect with a large negative destrect.. no idea what's causing this.

So we get in really odd clip rectangles. We might want to look at why at some point, but that's not D2D specific code. d2d_scroll should be able to deal with it though, fixing that here.

At some point acquire/release stored their temporary surface on the cairo_d2d_surface_t structure. This hasn't been the case for a while though! They have little to do with that object, and should leave it alone, properly releasing softTexture now instead, and no longer checking it.

Comment on attachment 430378 [details] [diff] [review] Part 1: Make d2d_scroll robust against clip rects outside the surface I don't really like doing the QueryInterface() in the scroll code, but can't think of a better way. A comment for the section explaining why we need to constrain the clip would be good to. (i.e. what goes wrong if we don't etc)

Pushed http://hg.mozilla.org/mozilla-central/rev/1936b0d5f431 http://hg.mozilla.org/mozilla-central/rev/bdc694e65e64