Alan K [:ack] Reporter
	Description • 11 years ago

Initial crash report here:

https://crash-stats.mozilla.com/report/index/bp-f51354bf-a4cb-4b98-8e65-6cd272130201

	Alan K [:ack] Reporter
	Comment 1 • 11 years ago

I think this crash is only happening on retina macbooks.

	(not currently active) Ted Mielczarek
	Comment 2 • 11 years ago

Crashes on my rMBP too, but at a different place:
https://crash-stats.mozilla.com/report/index/bp-73481237-9021-4c4b-aa66-136b72130201

That makes me worry that this is heap corruption or something.

	Dan Mosedale (:dmosedale, :dmose)
	Comment 3 • 11 years ago

The original crash report is easily reproduced on a MacBook Pro Retina, Mid 2012, running 10.8.2.  It happens immediately after clicking "Allow" in the full-screen permission request prompt.

Here's another instance of the crash, which confused Breakpad mightily:  

https://crash-stats.mozilla.com/report/index/bp-cb3c6eb3-8d67-4437-af3a-b55162130201

Happily, Apple's crash reporter dialog extracted a bunch more details, which I'll paste.  Given that there are 2^9 - 1 (511) frames on the stack, and the STACK GUARD stuff at the top, this sure looks like a stack overflow to me:

Process:         firefox [3266]
Path:            /Applications/FirefoxNightly.app/Contents/MacOS/firefox
Identifier:      org.mozilla.nightly
Version:         21.0a1 (2113.1.31)
Code Type:       X86-64 (Native)
Parent Process:  ??? [1]
User ID:         501

Date/Time:       2013-02-01 08:12:27.219 -0800
OS Version:      Mac OS X 10.8.2 (12C3006)
Report Version:  10
Sleep/Wake UUID: E21B1AFC-25B3-4C67-B4A8-616200630C27

Interval Since Last Report:          674370 sec
Crashes Since Last Report:           1
Per-App Interval Since Last Report:  972 sec
Per-App Crashes Since Last Report:   1
Anonymous UUID:                      C2ECDBEC-25BD-485D-AEDE-A6346F7FBB56

Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_PROTECTION_FAILURE at 0x00007fff5f3fff30

VM Regions Near 0x7fff5f3fff30:
    __LINKEDIT             0000000201a1d000-0000000201a8a000 [  436K] r--/rwx SM=COW  /System/Library/Extensions/GeForceGLDriver.bundle/Contents/MacOS/GeForceGLDriver
--> STACK GUARD            00007fff5bc00000-00007fff5f400000 [ 56.0M] ---/rwx SM=NUL  stack guard for thread 0
    Stack                  00007fff5f400000-00007fff5fc00000 [ 8192K] rw-/rwx SM=COW  thread 0

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   XUL                           	0x000000010153cb24 nsStyleAnimation::ExtractComputedValue(nsCSSProperty, nsStyleContext*, nsStyleAnimation::Value&) + 20
1   XUL                           	0x00000001015415b5 nsStyleContext::GetVisitedDependentColor(nsCSSProperty) + 117
2   XUL                           	0x00000001013c9195

	Mats Palmgren (inactive)
	Comment 5 • 11 years ago

The "handleMouseMoved" repetition in the attached stack is the same as in bug 799523 comment 2.  That bug is also about bananabread on OSX, so resolving as dupe.