Seen while viewing the Top Changers report. https://crash-stats.mozilla.com/report/list?range_value=7&range_unit=days&signature=nsIFrame%3A%3AGetUsedBorder%28%29&version=Firefox links to the crashes. https://crash-stats.mozilla.com/report/index/1c261424-13dc-4eda-8539-4de0d2110324 Frame Module Signature [Expand] Source 0 xul.dll nsIFrame::GetUsedBorder layout/generic/nsFrame.cpp:652 1 xul.dll nsBoxFrame::BuildDisplayList layout/xul/base/src/nsBoxFrame.cpp:1306 2 xul.dll nsIFrame::BuildDisplayListForChild layout/generic/nsFrame.cpp:1749 3 xul.dll nsBoxFrame::BuildDisplayList layout/xul/base/src/nsBoxFrame.cpp:1321 4 xul.dll nsIFrame::BuildDisplayListForChild layout/generic/nsFrame.cpp:1706 5 xul.dll nsBoxFrame::BuildDisplayList layout/xul/base/src/nsBoxFrame.cpp:1321 6 xul.dll nsIFrame::BuildDisplayListForChild layout/generic/nsFrame.cpp:1706 7 xul.dll nsBoxFrame::BuildDisplayList layout/xul/base/src/nsBoxFrame.cpp:1321 8 xul.dll nsIFrame::BuildDisplayListForChild layout/generic/nsFrame.cpp:1704 9 xul.dll nsBoxFrame::BuildDisplayListForChildren layout/xul/base/src/nsBoxFrame.cpp:1359 10 xul.dll nsRootBoxFrame::BuildDisplayList layout/xul/base/src/nsRootBoxFrame.cpp:250 11 xul.dll nsIFrame::BuildDisplayListForChild layout/generic/nsFrame.cpp:1706 12 xul.dll nsIFrame::BuildDisplayListForStackingContext layout/generic/nsFrame.cpp:1455 13 xul.dll nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:1457 14 xul.dll PresShell::Paint layout/base/nsPresShell.cpp:6203

This is #117 with ~40 crashes per million ADU on yesterday's 4.0* list and is rising. What looks very interesting is the correlations for 4.0 in https://crash-stats.mozilla.com/report/list?signature=nsIFrame%3A%3AGetUsedBorder() - at least those for modules: 83% (72/87) vs. 3% (1830/56849) atiuxpag.dll 83% (72/87) vs. 3% (1834/56849) atidxx32.dll 83% (72/87) vs. 3% (1929/56849) aticfx32.dll 84% (73/87) vs. 10% (5943/56849) d3d10.dll 84% (73/87) vs. 10% (5943/56849) d3d10core.dll 84% (73/87) vs. 10% (5950/56849) d2d1.dll 85% (74/87) vs. 12% (6723/56849) d3d10_1core.dll 85% (74/87) vs. 12% (6723/56849) d3d10_1.dll 85% (74/87) vs. 12% (6768/56849) dxgi.dll That looks to me like graphics plays a significant part here in the 4.0 case - on 3.6, this signature appears but rarely enough that we don't get correlation info. bz, do we need to pull graphics people into this one or is this purely a layout thing (not too high volume right now, but I caught it due to rising in volume)?

You probably want roc and Timothy here.

I took a look at a handful of stacks and I wasn't able to glean anything useful.

This signature is heavily exploding on the 2012-02-28 Aurora build now. Correlations for Firefox 12.0a2 Windows NT 98% (101/103) vs. 10% (348/3505) atiuxpag.dll 98% (101/103) vs. 10% (357/3505) atidxx32.dll 88% (91/103) vs. 9% (328/3505) aticfx32.dll 98% (101/103) vs. 20% (695/3505) d3d10.dll 98% (101/103) vs. 20% (695/3505) d3d10core.dll 98% (101/103) vs. 20% (703/3505) d2d1.dll 98% (101/103) vs. 21% (743/3505) dxgi.dll 98% (101/103) vs. 21% (743/3505) d3d10_1core.dll 98% (101/103) vs. 21% (743/3505) d3d10_1.dll 100% (103/103) vs. 34% (1199/3505) explorerframe.dll 100% (103/103) vs. 34% (1200/3505) dui70.dll 100% (103/103) vs. 35% (1227/3505) duser.dll 100% (103/103) vs. 36% (1257/3505) slc.dll 100% (103/103) vs. 36% (1279/3505) srvcli.dll 100% (103/103) vs. 37% (1299/3505) cscapi.dll 100% (103/103) vs. 37% (1304/3505) RpcRtRemote.dll 100% (103/103) vs. 38% (1338/3505) EhStorShell.dll

This crash still occurs in recent versions (v60+), but in very low volume, e.g.: bp-64fc75a8-d623-4c26-8b7c-8f9790180609 nsIFrame::GetUsedBorder() nsCSSRendering::ComputeImageLayerPositioningArea(nsPresContext*, nsIFrame*, nsRect const&, nsStyleImageLayers::Layer const&, nsIFrame**, bool*) nsDisplayBackgroundImage::GetPositioningArea() nsDisplayBackgroundImage::ComputeInvalidationRegion(nsDisplayListBuilder*, nsDisplayItemGeometry const*, nsRegion*) ... bp-7b2a1ec1-64f7-4535-a0c8-c59fa0180609 nsIFrame::GetUsedBorder() mozilla::ReflowInput::GetHypotheticalBoxContainer(nsIFrame*, int&, mozilla::LogicalSize&) mozilla::ReflowInput::CalculateHypotheticalPosition(nsPresContext*, nsPlaceholderFrame*, mozilla::ReflowInput const*, nsHypotheticalPosition&, mozilla::LayoutFrameType) mozilla::ReflowInput::InitAbsoluteConstraints(nsPresContext*, mozilla::ReflowInput const*, mozilla::LogicalSize const&, mozilla::LayoutFrameType) mozilla::ReflowInput::InitConstraints(nsPresContext*, mozilla::LogicalSize const&, nsMargin const*, nsMargin const*, mozilla::LayoutFrameType) mozilla::ReflowInput::Init(nsPresContext*, mozilla::LogicalSize const*, nsMargin const*, nsMargin const*) mozilla::ReflowInput::ReflowInput(nsPresContext*, mozilla::ReflowInput const&, nsIFrame*, mozilla::LogicalSize const&, mozilla::LogicalSize const*, unsigned int) nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsIFrame*, nsReflowStatus&, nsOverflowAreas*) nsAbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsOverflowAreas*) nsFrame::ReflowAbsoluteFrames(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, bool) nsBoxFrame::DoXULLayout(nsBoxLayoutState&) nsSprocketLayout::XULLayout(nsIFrame*, nsBoxLayoutState&) nsBoxFrame::DoXULLayout(nsBoxLayoutState&) nsSprocketLayout::XULLayout(nsIFrame*, nsBoxLayoutState&) nsBoxFrame::DoXULLayout(nsBoxLayoutState&) nsIFrame::XULLayout(nsBoxLayoutState&) nsStackLayout::XULLayout(nsIFrame*, nsBoxLayoutState&) nsBoxFrame::DoXULLayout(nsBoxLayoutState&) nsIFrame::XULLayout(nsBoxLayoutState&) nsBoxFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) ...