1083471 - Intermittent 421069.html | application crashed [@ imgRequestProxy::GetImageStatus(unsigned int*) ]

Status: RESOLVED WORKSFORME

(Core :: Graphics: ImageLib, defect)

Description

[Ryan VanderMeulen [:RyanVM]]

https://treeherder.mozilla.org/ui/logviewer.html#?job_id=910402&repo=fx-team

builder 	Android 2.3 Emulator fx-team opt test plain-reftest-4
buildid 	20141015062413
builduid 	5a6e9b10aced475fa73660fe04861b8d
results 	warnings (1)
revision 	d597c195be2d
slave 	 	tst-emulator64-spot-117
starttime 	Wed Oct 15 2014 09:43:40 GMT-0400 (Eastern Standard Time)

07:26:05 INFO - REFTEST TEST-START | http://10.0.2.2:8854/tests/layout/reftests/bugs/421069.html
07:26:05 INFO - REFTEST TEST-LOAD | http://10.0.2.2:8854/tests/layout/reftests/bugs/421069.html | 682 / 683 (99%)
07:26:05 INFO -
07:26:05 INFO - INFO | automation.py | Application ran for: 0:37:52.857643
07:26:05 INFO - INFO | zombiecheck | Reading PID log: /tmp/tmp7cxGy9pidlog
07:26:05 INFO - Contents of /data/anr/traces.txt:
07:26:05 INFO -
07:26:05 INFO -
07:26:05 INFO - /data/tombstones does not exist; tombstone check skipped
07:26:05 INFO - mozcrash INFO | Downloading symbols from: https://ftp-ssl.mozilla.org/pub/mozilla.org/mobile/tinderbox-builds/fx-team-android/1413379453/fennec-36.0a1.en-US.android-arm.crashreporter-symbols.zip
07:26:05 INFO - mozcrash INFO | Saved minidump as /builds/slave/test/build/blobber_upload_dir/51ce8761-1876-3701-5235b7db-7f42148a.dmp
07:26:05 INFO - mozcrash INFO | Saved app info as /builds/slave/test/build/blobber_upload_dir/51ce8761-1876-3701-5235b7db-7f42148a.extra
07:26:05 WARNING - PROCESS-CRASH | http://10.0.2.2:8854/tests/layout/reftests/bugs/421069.html | application crashed [@ BRFrame::GetLogicalBaseline(mozilla::WritingMode) const]
07:26:05 INFO - Crash dump filename: /tmp/tmp35t0kh/51ce8761-1876-3701-5235b7db-7f42148a.dmp
07:26:05 INFO - Operating system: Android
07:26:05 INFO - 0.0.0 Linux 2.6.29-ge3d684d #1 Mon Dec 16 22:26:51 UTC 2013 armv7l generic/sdk/generic:2.3.7/GINGERBREAD/eng.ubuntu.20140123.014351:eng/test-keys
07:26:05 INFO - CPU: arm
07:26:05 INFO - 0 CPUs
07:26:05 INFO -
07:26:05 INFO - Crash reason: SIGSEGV
07:26:05 INFO - Crash address: 0x34
07:26:05 INFO -
07:26:05 INFO - Thread 10 (crashed)
07:26:05 INFO - 0 libxul.so!BRFrame::GetLogicalBaseline(mozilla::WritingMode) const [nsBRFrame.cpp:d597c195be2d : 202 + 0x0]
07:26:05 INFO - r4 = 0x476fca78 r5 = 0x476fca94 r6 = 0x00000000 r7 = 0x578307f8
07:26:05 INFO - r8 = 0x476fcc44 r9 = 0x00000004 r10 = 0x57ec7400 fp = 0x476fd194
07:26:05 INFO - sp = 0x476fca78 lr = 0x4df032a5 pc = 0x4dc235b4
07:26:05 INFO - Found by: given as instruction pointer in context
07:26:05 INFO - 1 libxul.so!imgRequestProxy::GetImageStatus(unsigned int*) [imgRequestProxy.cpp:d597c195be2d : 515 + 0x3]
07:26:05 INFO - r4 = 0x476fca78 r5 = 0x476fca94 r6 = 0x00000000 r7 = 0x578307f8
07:26:05 INFO - r8 = 0x476fcc44 r9 = 0x00000004 r10 = 0x57ec7400 fp = 0x476fd194
07:26:05 INFO - sp = 0x476fca78 pc = 0x4df032a5
07:26:05 INFO - Found by: call frame info
07:26:05 INFO - 2 libxul.so!nsStyleImage::IsComplete() const [nsStyleStruct.cpp:d597c195be2d : 2082 + 0x5]
07:26:05 INFO - r4 = 0x476fcc54 r5 = 0x578307a4 r6 = 0x00000000 r7 = 0x578307f8
07:26:05 INFO - r8 = 0x476fcc44 r9 = 0x00000004 r10 = 0x57ec7400 fp = 0x476fd194
07:26:05 INFO - sp = 0x476fca90 pc = 0x4e4fd34f
07:26:05 INFO - Found by: call frame info
07:26:05 INFO - 3 libxul.so!nsImageRenderer::PrepareImage() [nsCSSRendering.cpp:d597c195be2d : 4383 + 0x5]
07:26:05 INFO - r4 = 0x476fcc54 r5 = 0x578307a4 r6 = 0x00000000 r7 = 0x578307f8
07:26:05 INFO - r8 = 0x476fcc44 r9 = 0x00000004 r10 = 0x57ec7400 fp = 0x476fd194
07:26:05 INFO - sp = 0x476fcaa0 pc = 0x4e53f255
07:26:05 INFO - Found by: call frame info
07:26:05 INFO - 4 libxul.so!nsCSSRendering::PrepareBackgroundLayer(nsPresContext*, nsIFrame*, unsigned int, nsRect const&, nsRect const&, nsStyleBackground::Layer const&) [nsCSSRendering.cpp:d597c195be2d : 3033 + 0x3]
07:26:05 INFO - r4 = 0x476fcc54 r5 = 0x578307a4 r6 = 0x00000000 r7 = 0x578307f8
07:26:05 INFO - r8 = 0x476fcc44 r9 = 0x00000004 r10 = 0x57ec7400 fp = 0x476fd194
07:26:05 INFO - sp = 0x476fcb98 pc = 0x4e53f535
07:26:05 INFO - Found by: call frame info
07:26:05 INFO - 5 libxul.so!nsCSSRendering::GetBackgroundLayerRect(nsPresContext*, nsIFrame*, nsRect const&, nsRect const&, nsStyleBackground::Layer const&, unsigned int) [nsCSSRendering.cpp:d597c195be2d : 3122 + 0x15]
07:26:05 INFO - r4 = 0x578307f8 r5 = 0x476fcc44 r6 = 0x476fcd60 r7 = 0x476fcd00
07:26:05 INFO - r8 = 0x57ec7400 r9 = 0x00000000 r10 = 0x0000004c fp = 0x476fd194
07:26:05 INFO - sp = 0x476fcc30 pc = 0x4e53fa0f
07:26:05 INFO - Found by: call frame info
07:26:05 INFO - 6 libxul.so!nsDisplayBackgroundImage::GetBoundsInternal(nsDisplayListBuilder*) [nsDisplayList.cpp:d597c195be2d : 2449 + 0x15]
07:26:05 INFO - r4 = 0x58408878 r5 = 0x476fcd60 r6 = 0x476fcd10 r7 = 0x578307a4
07:26:05 INFO - r8 = 0x57ec7400 r9 = 0x476ff140 r10 = 0x0000004c fp = 0x476fd194
07:26:05 INFO - sp = 0x476fccf0 pc = 0x4e53fac1
07:26:05 INFO - Found by: call frame info
07:26:05 INFO - 7 libxul.so!nsDisplayBackgroundImage::nsDisplayBackgroundImage(nsDisplayListBuilder*, nsIFrame*, unsigned int, nsStyleBackground const*) [nsDisplayList.cpp:d597c195be2d : 1824 + 0x7]
07:26:05 INFO - r4 = 0x58408878 r5 = 0x00000000 r6 = 0x584088d0 r7 = 0x00000000
07:26:05 INFO - r8 = 0x00000000 r9 = 0x00000000 r10 = 0x0000004c fp = 0x476fd194
07:26:05 INFO - sp = 0x476fcd60 pc = 0x4e53fb0b
07:26:05 INFO - Found by: call frame info
07:26:05 INFO - 8 libxul.so!nsDisplayBackgroundImage::AppendBackgroundItemsToTop(nsDisplayListBuilder*, nsIFrame*, nsDisplayList*) [nsDisplayList.cpp:d597c195be2d : 1971 + 0xd]
07:26:05 INFO - r4 = 0x578307f8 r5 = 0x476ff140 r6 = 0x57830778 r7 = 0x00000000
07:26:05 INFO - r8 = 0x00000000 r9 = 0x00000000 r10 = 0x0000004c fp = 0x476fd194
07:26:05 INFO - sp = 0x476fcd88 pc = 0x4e53fd4f
07:26:05 INFO - Found by: call frame info
07:26:05 INFO - 9 libxul.so!nsFrame::DisplayBorderBackgroundOutline(nsDisplayListBuilder*, nsDisplayListSet const&, bool) [nsFrame.cpp:d597c195be2d : 1601 + 0xb]
07:26:05 INFO - r4 = 0x4e56e575 r5 = 0x476ff140 r6 = 0x578307f8 r7 = 0x00000000
07:26:05 INFO - r8 = 0x476fd148 r9 = 0x476fd148 r10 = 0x59957090 fp = 0x00000000
07:26:05 INFO - sp = 0x476fce18 pc = 0x4e58589d
07:26:05 INFO - Found by: call frame info
07:26:05 INFO - 10 libxul.so!nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsRect const&, nsDisplayListSet const&) [nsBlockFrame.cpp:d597c195be2d : 6184 + 0x3]
07:26:05 INFO - r4 = 0x4e56e575 r5 = 0x57830620 r6 = 0x578307f8 r7 = 0x476fcf8c
07:26:05 INFO - r8 = 0x476ff140 r9 = 0x476fd148 r10 = 0x59957090 fp = 0x00000000
07:26:05 INFO - sp = 0x476fce50 pc = 0x4e56e58b
07:26:05 INFO - Found by: call frame info

Comment 1

[Mats Palmgren (inactive)]

The top stack frame seems bogus; imgRequestProxy::GetImageStatus doesn't have
any GetLogicalBaseline calls.
http://mxr.mozilla.org/mozilla-central/source/image/src/imgRequestProxy.cpp#512

Comment 2

[Legacy TBPL/Treeherder Robot]

submit_timestamp: 2014-10-22T18:32:03
log: https://treeherder.mozilla.org/ui/logviewer.html#?repo=mozilla-inbound&job_id=3227054
repository: mozilla-inbound
who: wkocher[at]mozilla[dot]com
machine: panda-0320
buildname: Android 4.0 Panda mozilla-inbound debug test plain-reftest-2
revision: f0520d8ed4ed

10/22/2014 14:28:58: DEBUG: 30032 ?        S      0:00 python /builds/tools/buildfarm/mobile/../utils/retry.py --stderr-regexp ERROR 404: Not Found --fail-if-match wget -q -O/builds/panda-0330/buildbot.tac.new http://slavealloc.pvt.build.mozilla.org/gettac/panda-0330
PROCESS-CRASH | http://10.26.130.22:30320/tests/layout/reftests/bugs/421069.html | application crashed [@ mozalloc_abort(char const*)]
10-22 15:11:37.226 I/Gecko   ( 2102): [2102] ###!!! ABORT: Should have mStatusTracker until we create mImage: 'mStatusTracker', file /builds/slave/m-in-and-d-0000000000000000000/build/image/src/imgRequest.cpp, line 145
10-22 15:11:37.226 E/Gecko   ( 2102): mozalloc_abort: [2102] ###!!! ABORT: Should have mStatusTracker until we create mImage: 'mStatusTracker', file /builds/slave/m-in-and-d-0000000000000000000/build/image/src/imgRequest.cpp, line 145
Return code: 1
10-22 15:11:37.226 I/Gecko   ( 2102): [2102] ###!!! ABORT: Should have mStatusTracker until we create mImage: 'mStatusTracker', file /builds/slave/m-in-and-d-0000000000000000000/build/image/src/imgRequest.cpp, line 145
10-22 15:11:37.226 E/Gecko   ( 2102): mozalloc_abort: [2102] ###!!! ABORT: Should have mStatusTracker until we create mImage: 'mStatusTracker', file /builds/slave/m-in-and-d-0000000000000000000/build/image/src/imgRequest.cpp, line 145

Comment 3

[Mats Palmgren (inactive)]

Some reports in the wild as well: bp-64eee175-43cb-441b-aadf-b1bcb2141014
More at: https://crash-stats.mozilla.com/report/list?signature=imgRequestProxy%3A%3AGetImageStatus%28unsigned+int%2A%29&query_type=contains&range_unit=weeks&range_value=4#reports

Comment 4

[Seth Fowler [:seth] [:s2h]]

This code is all getting totally rewritten in bug 910441 anyway.

Comment 5

[Legacy TBPL/Treeherder Robot]

submit_timestamp: 2015-01-12T11:14:36
log: https://treeherder.mozilla.org/logviewer.html#?repo=b2g-inbound&job_id=1147083
repository: b2g-inbound
who: rvandermeulen[at]mozilla[dot]com
machine: t-snow-r4-0082
buildname: Rev4 MacOSX Snow Leopard 10.6 b2g-inbound opt test mochitest-browser-chrome-3
revision: ade0a9f9e487

[1268] ###!!! ABORT: Aborting on channel error.: file /builds/slave/b2g-in-osx64-00000000000000000/build/src/ipc/glue/MessageChannel.cpp, line 1591
[1268] ###!!! ABORT: Aborting on channel error.: file /builds/slave/b2g-in-osx64-00000000000000000/build/src/ipc/glue/MessageChannel.cpp, line 1591
630 ERROR TEST-UNEXPECTED-FAIL | toolkit/mozapps/extensions/test/browser/test-window/browser_bug562899.js | application terminated with exit code 1
PROCESS-CRASH | toolkit/mozapps/extensions/test/browser/test-window/browser_bug562899.js | application crashed [@ mozilla::image::ProgressTracker::GetImageStatus() const]

Comment 6

[Ed Morley [:emorley]]

Inactive; closing (see bug 1180138).