1045122 - crash in VisitAbove

Status: RESOLVED DUPLICATE of bug 1049138

(Core :: Graphics, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-aee937cb-bc40-4af7-95e2-a04b22140723.
=============================================================
Crashing Thread
Frame 	Module 	Signature 	Source
0 	libc.so 	libc.so@0xe300 	
1 	libxul.so 	VisitAbove 	/home/geeksphone/FOS/keon/gecko/gfx/src/nsRegion.cpp:417
2 	libxul.so 	nsRegion::VisitEdges(void (*)(void*, VisitSide, int, int, int, int), void*) 	/home/geeksphone/FOS/keon/gecko/gfx/src/nsRegion.cpp:503
3 	libxul.so 	mozilla::layers::PadDrawTargetOutFromRegion(mozilla::RefPtr<mozilla::gfx::DrawTarget>, nsIntRegion&) 	/home/geeksphone/FOS/keon/objdir-gecko/gfx/layers/../../dist/include/nsRegion.h:656
4 	libxul.so 	mozilla::layers::ClientTiledLayerBuffer::ValidateTile(mozilla::layers::TileClient, nsIntPoint const&, nsIntRegion const&) 	/home/geeksphone/FOS/keon/gecko/gfx/layers/client/TiledContentClient.cpp:973
5 	libxul.so 	mozilla::layers::TiledLayerBuffer<mozilla::layers::ClientTiledLayerBuffer, mozilla::layers::TileClient>::Update(nsIntRegion const&, nsIntRegion const&) 	/home/geeksphone/FOS/keon/gecko/gfx/layers/TiledLayerBuffer.h:495
6 	libxul.so 	mozilla::layers::ClientTiledLayerBuffer::PaintThebes(nsIntRegion const&, nsIntRegion const&, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) 	/home/geeksphone/FOS/keon/gecko/gfx/layers/client/TiledContentClient.cpp:803
7 	libxul.so 	mozilla::layers::ClientTiledLayerBuffer::ProgressiveUpdate(nsIntRegion&, nsIntRegion&, nsIntRegion const&, mozilla::layers::BasicTiledLayerPaintData*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) 	/home/geeksphone/FOS/keon/gecko/gfx/layers/client/TiledContentClient.cpp:1331
8 	libxul.so 	mozilla::layers::ClientTiledThebesLayer::RenderHighPrecision(nsIntRegion&, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) 	/home/geeksphone/FOS/keon/gecko/gfx/layers/client/ClientTiledThebesLayer.cpp:222
9 	libxul.so 	mozilla::layers::ClientTiledThebesLayer::RenderLayer() 	/home/geeksphone/FOS/keon/gecko/gfx/layers/client/ClientTiledThebesLayer.cpp:393
10 	libxul.so 	mozilla::layers::ClientContainerLayer::RenderLayer() 	/home/geeksphone/FOS/keon/gecko/gfx/layers/client/ClientContainerLayer.h:64
11 	libxul.so 	mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	/home/geeksphone/FOS/keon/gecko/gfx/layers/client/ClientLayerManager.cpp:211
12 	libxul.so 	mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	/home/geeksphone/FOS/keon/gecko/gfx/layers/client/ClientLayerManager.cpp:237
13 	libxul.so 	nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) 	/home/geeksphone/FOS/keon/gecko/layout/base/nsDisplayList.cpp:1303
14 	libxul.so 	nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) 	/home/geeksphone/FOS/keon/gecko/layout/base/nsDisplayList.cpp:1157
15 	libxul.so 	nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, unsigned int) 	/home/geeksphone/FOS/keon/gecko/layout/base/nsLayoutUtils.cpp:2971
16 	libxul.so 	PresShell::Paint(nsView*, nsRegion const&, unsigned int) 	/home/geeksphone/FOS/keon/gecko/layout/base/nsPresShell.cpp:6222
17 	libxul.so 	nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) 	/home/geeksphone/FOS/keon/gecko/view/src/nsViewManager.cpp:443
18 	libxul.so 	nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) 	/home/geeksphone/FOS/keon/gecko/view/src/nsViewManager.cpp:384
19 	libxul.so 	nsViewManager::ProcessPendingUpdates() 	/home/geeksphone/FOS/keon/gecko/view/src/nsViewManager.cpp:1075
20 	libxul.so 	nsRefreshDriver::Tick(long long, mozilla::TimeStamp) 	/home/geeksphone/FOS/keon/gecko/layout/base/nsRefreshDriver.cpp:1278
21 	libxul.so 	nsRefreshDriver::DoTick() 	/home/geeksphone/FOS/keon/gecko/layout/base/nsRefreshDriver.cpp:1041
22 	libxul.so 	nsRefreshDriver::DoRefresh() 	/home/geeksphone/FOS/keon/gecko/layout/base/nsRefreshDriver.cpp:1520
23 	libxul.so 	nsRefreshDriver::FinishedWaitingForTransaction() 	/home/geeksphone/FOS/keon/gecko/layout/base/nsRefreshDriver.cpp:1400
24 	libxul.so 	nsRefreshDriver::NotifyTransactionCompleted(unsigned long long) 	/home/geeksphone/FOS/keon/gecko/layout/base/nsRefreshDriver.cpp:1440
25 	libxul.so 	mozilla::layers::ClientLayerManager::DidComposite(unsigned long long) 	/home/geeksphone/FOS/keon/gecko/gfx/layers/client/ClientLayerManager.cpp:314
26 	libxul.so 	mozilla::dom::TabChild::DidComposite(unsigned long long) 	/home/geeksphone/FOS/keon/gecko/dom/ipc/TabChild.cpp:2846
27 	libxul.so 	mozilla::layers::CompositorChild::RecvDidComposite(unsigned long long const&, unsigned long long const&) 	/home/geeksphone/FOS/keon/gecko/gfx/layers/ipc/CompositorChild.cpp:135
28 	libxul.so 	mozilla::layers::PCompositorChild::OnMessageReceived(IPC::Message const&) 	/home/geeksphone/FOS/keon/objdir-gecko/ipc/ipdl/PCompositorChild.cpp:744
29 	libxul.so 	mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) 	/home/geeksphone/FOS/keon/gecko/ipc/glue/MessageChannel.cpp:1158
30 	libxul.so 	mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message const&) 	/home/geeksphone/FOS/keon/gecko/ipc/glue/MessageChannel.cpp:1068
31 	libxul.so 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	/home/geeksphone/FOS/keon/gecko/ipc/glue/MessageChannel.cpp:1051
32 	libxul.so 	RunnableMethod<FdWatcher, void (FdWatcher::*)(), Tuple0>::Run() 	/home/geeksphone/FOS/keon/gecko/ipc/chromium/src/base/tuple.h:383
33 	libxul.so 	mozilla::ipc::MessageChannel::DequeueTask::Run() 	/home/geeksphone/FOS/keon/objdir-gecko/ipc/glue/../../dist/include/mozilla/ipc/MessageChannel.h:390
34 	libxul.so 	MessageLoop::RunTask(Task*) 	/home/geeksphone/FOS/keon/gecko/ipc/chromium/src/base/message_loop.cc:357
35 	libxul.so 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) 	/home/geeksphone/FOS/keon/gecko/ipc/chromium/src/base/message_loop.cc:365
36 	libxul.so 	MessageLoop::DoWork() 	/home/geeksphone/FOS/keon/gecko/ipc/chromium/src/base/message_loop.cc:443
37 	libxul.so 	mozilla::ipc::DoWorkRunnable::Run() 	/home/geeksphone/FOS/keon/gecko/ipc/glue/MessagePump.cpp:233
38 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	/home/geeksphone/FOS/keon/gecko/xpcom/threads/nsThread.cpp:770
39 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	/home/geeksphone/FOS/keon/gecko/xpcom/glue/nsThreadUtils.cpp:265
40 	libxul.so 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	/home/geeksphone/FOS/keon/gecko/ipc/glue/MessagePump.cpp:99
41 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	/home/geeksphone/FOS/keon/gecko/ipc/glue/MessagePump.cpp:302
42 	libxul.so 	MessageLoop::RunInternal() 	/home/geeksphone/FOS/keon/gecko/ipc/chromium/src/base/message_loop.cc:229
43 	libxul.so 	MessageLoop::Run() 	/home/geeksphone/FOS/keon/gecko/ipc/chromium/src/base/message_loop.cc:222
44 	libxul.so 	nsBaseAppShell::Run() 	/home/geeksphone/FOS/keon/gecko/widget/xpwidgets/nsBaseAppShell.cpp:164
45 	libxul.so 	XRE_RunAppShell 	/home/geeksphone/FOS/keon/gecko/toolkit/xre/nsEmbedFunctions.cpp:693
46 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	/home/geeksphone/FOS/keon/gecko/ipc/glue/MessagePump.cpp:272
47 	libxul.so 	MessageLoop::RunInternal() 	/home/geeksphone/FOS/keon/gecko/ipc/chromium/src/base/message_loop.cc:229
48 	libxul.so 	MessageLoop::Run() 	/home/geeksphone/FOS/keon/gecko/ipc/chromium/src/base/message_loop.cc:222
49 	libxul.so 	XRE_InitChildProcess 	/home/geeksphone/FOS/keon/gecko/toolkit/xre/nsEmbedFunctions.cpp:530
50 	plugin-container 	main 	/home/geeksphone/FOS/keon/gecko/ipc/app/MozillaRuntimeMain.cpp:147
51 	libc.so 	__libc_init 	/home/geeksphone/FOS/keon_nightly/bionic/libc/bionic/libc_init_dynamic.c:114 

More Reports:
https://crash-stats.mozilla.com/report/list?product=B2G&signature=VisitSides#tab-reports

Device : KEON only 
Crash reported started from : 20140722

Comment 1

[Jeff Muizelaar [:jrmuizel]]

Attachment: This might hep

Comment 2

[Benoit Girard (:BenWa)]

Comment on attachment 8463611 [details] [diff] [review]
This might hep

Review of attachment 8463611 [details] [diff] [review]:
-----------------------------------------------------------------

I don't see any way for this to get hit. If we want to information gather then you should add some proper runtime asserts and we can ship those rather then this.

Please fix the width problem I pointed out and the indent in the original patch.

Comment 3

[Safwan Rahman (:safwan)]

Any update?

Comment 4

[Robert Kaiser]

The assumption in bug 1049138 is that this is probably a dupe. If it goes away with that fix landing everywhere, we'll be able to confirm that and mark it as such.

Comment 5

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

bug 1049138 seems to have taken care of most of the crashing in b2g; I think.  We need people to update to make sure.  I don't see any b2g crashes after 12/29

Comment 6

[Robert Kaiser]

Still no crashes in builds after bug 1049138, so duping to that.