1019057 - crash in mozilla::layers::ContentClientDoubleBuffered::FinalizeFrame(nsIntRegion const&)

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-493ce34a-9cd4-49a8-91bf-78d452140527.
=============================================================
Frame 	Module 	Signature 	Source
0 	libxul.so 	mozilla::layers::ContentClientDoubleBuffered::FinalizeFrame(nsIntRegion const&) 	gfx/layers/client/ContentClient.cpp
1 	libxul.so 	mozilla::layers::RotatedContentBuffer::BeginPaint(mozilla::layers::ThebesLayer*, unsigned int) 	gfx/layers/RotatedBuffer.cpp
2 	libxul.so 	mozilla::layers::ContentClientBasic::BeginPaintBuffer(mozilla::layers::ThebesLayer*, unsigned int) 	
3 	libxul.so 	mozilla::layers::ClientThebesLayer::PaintThebes() 	gfx/layers/client/ClientThebesLayer.cpp
4 	libxul.so 	mozilla::layers::ClientThebesLayer::RenderLayer() 	gfx/layers/client/ClientThebesLayer.cpp
5 	libxul.so 	mozilla::layers::ClientContainerLayer::RenderLayer() 	gfx/layers/client/ClientContainerLayer.h
6 	libxul.so 	mozilla::layers::ClientContainerLayer::RenderLayer() 	gfx/layers/client/ClientContainerLayer.h
7 	libxul.so 	mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/client/ClientLayerManager.cpp
8 	libxul.so 	mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/client/ClientLayerManager.cpp
9 	libxul.so 	nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) const 	layout/base/nsDisplayList.cpp
10 	libxul.so 	nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) const 	layout/base/nsDisplayList.cpp
11 	libxul.so 	nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, unsigned int) 	layout/base/nsLayoutUtils.cpp
12 	libxul.so 	PresShell::Paint(nsView*, nsRegion const&, unsigned int) 	layout/base/nsPresShell.cpp
13 	libxul.so 	nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) 	view/src/nsViewManager.cpp
14 	libxul.so 	nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) 	view/src/nsViewManager.cpp
15 	libxul.so 	nsRefreshDriver::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
16 	libxul.so 	mozilla::RefreshDriverTimer::Tick() 	layout/base/nsRefreshDriver.cpp
17 	libxul.so 	nsTimerImpl::Fire() 	xpcom/threads/nsTimerImpl.cpp
18 	libxul.so 	nsTimerEvent::Run() 	xpcom/threads/nsTimerImpl.cpp
19 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
20 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
21 	libxul.so 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
22 	libxul.so 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc
23 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
24 	libxul.so 	nsBaseAppShell::Run() 	widget/xpwidgets/nsBaseAppShell.cpp
25 	libxul.so 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp
26 	libxul.so 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc
27 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
28 	libxul.so 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp
29 	plugin-container 	main 	ipc/app/MozillaRuntimeMain.cpp
30 	libc.so 	__libc_init 	/local/build/soul_3.5_ff-release/v123/bionic/libc/bionic/libc_init_dynamic.cpp:112
31 	plugin-container 	plugin-container@0x5ee 	
32 	linker 	set_soinfo_pool_protection 	/builds/slave/b2g_m-cen_flame_ntly-000000000/build/bionic/linker/linker.cpp:291
33 		@0xbe929a95

More Reports:
https://crash-stats.mozilla.com/report/list?product=B2G&signature=mozilla%3A%3Alayers%3A%3AContentClientDoubleBuffered%3A%3AFinalizeFrame%28nsIntRegion+const%26%29#tab-reports

First seen crash on socorro :  	20140527040202 

Possibly with screen rotation?

Comment 1

[Sotaro Ikeda [:sotaro]]

The cause of crash might be similar to Bug 1019057.

Comment 2

[Sotaro Ikeda [:sotaro]]

It might be a regression of Bug 1002300.

Comment 3

[Sotaro Ikeda [:sotaro]]

I could not reproduce the crash. From the code, mFrontClient seems possible cause of the crash like Bug 1016677.

Comment 4

[Sotaro Ikeda [:sotaro]]

(In reply to Sotaro Ikeda [:sotaro] from comment #1)
> The cause of crash might be similar to Bug 1019057.

Correction: Bug 1016677

Comment 5

[Sotaro Ikeda [:sotaro]]

Attachment: patch - Add pointer check to ContentClientDoubleBuffered::FinalizeFrame()

Comment 6

[Sotaro Ikeda [:sotaro]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5c347ab86841

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/5c347ab86841

Comment 8

[Chris Peterson [:cpeterson]]

Removing steps-wanted keyword because this bug has been resolved.