1107792 - crash in OOM | unknown | NS_ABORT_OOM(unsigned int) | gfxContext::PushNewDT(gfxContentType)

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Jim Mathies [:jimm]]

Attachment: support.txt

This bug was filed from the Socorro interface and is 
report bp-30e4e829-57ca-4820-894f-8114b2141205.
=============================================================

STR:

visit http://news.yahoo.com/ and click in the scroll gutter to scroll content up and down. Also try dragging the scroll thumb down until content fills in.

- running e10s
- no flash plugin installed

Comment 1

[Robert Kaiser]

There's at least an annotation on the allocation size missing here...

Comment 2

[Joshua Mitchell (Inactive)]

I also ran into this crash: Browser, Google Maps - zooming and scrolling

Flame KK 3.0 

Device: Flame Master (KK - nightly - 319 mem)
Build ID: 20150227010229
Gaia: 7512026a377271a0cade12d70846557f0bc7781c
Gecko: c7968255c1ea
Gonk: e7c90613521145db090dd24147afd5ceb5703190
Version: 39.0a1 (Master)
Firmware Version: v18D-1
User Agent: Mozilla/5.0 (Mobile; rv:39.0) Gecko/39.0 Firefox/39.0

Comment 3

[Joshua Mitchell (Inactive)]

Attachment: bp-473701ce-3a4e-421c-97c9-867e72150227.txt

Comment 4

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

[Blocking Requested - why for this release]:

From comment 0:
Specific page :  	http://news.yahoo.com/college-student-found-dead-wisconsin-restaurant-dumbwaiter-005322299.html 
Stack shows:
Frame 	Module 	Signature 	Source
0 	xul.dll 	NS_ABORT_OOM(unsigned int) 	xpcom/base/nsDebugImpl.cpp
1 	xul.dll 	gfxContext::PushNewDT(gfxContentType) 	gfx/thebes/gfxContext.cpp
2 	xul.dll 	gfxContext::PushGroup(gfxContentType) 	gfx/thebes/gfxContext.cpp
3 	xul.dll 	mozilla::layers::BasicLayerManager::PushGroupForLayer(gfxContext*, mozilla::layers::Layer*, nsIntRegion const&, bool*) 	gfx/layers/basic/BasicLayerManager.cpp
4 	xul.dll 	mozilla::layers::BasicPaintedLayer::PaintThebes(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) 	gfx/layers/basic/BasicPaintedLayer.cpp
5 	xul.dll 	mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext&, gfxContext*) 	gfx/layers/basic/BasicLayerManager.cpp
6 	xul.dll 	mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) 	gfx/layers/basic/BasicLayerManager.cpp
7 	xul.dll 	mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext&, gfxContext*) 	gfx/layers/basic/BasicLayerManager.cpp
8 	xul.dll 	mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) 	gfx/layers/basic/BasicLayerManager.cpp
9 	xul.dll 	mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext&, gfxContext*) 	gfx/layers/basic/BasicLayerManager.cpp
10 	xul.dll 	mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) 	gfx/layers/basic/BasicLayerManager.cpp
11 	xul.dll 	mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/basic/BasicLayerManager.cpp
12 	xul.dll 	mozilla::PaintInactiveLayer 	layout/base/FrameLayerBuilder.cpp
13 	xul.dll 	mozilla::FrameLayerBuilder::PaintItems(nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem>&, nsIntRect const&, gfxContext*, nsRenderingContext*, nsDisplayListBuilder*, nsPresContext*, nsIntPoint const&, float, float, int) 	layout/base/FrameLayerBuilder.cpp
14 	xul.dll 	mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*) 	layout/base/FrameLayerBuilder.cpp
15 	xul.dll 	mozilla::layers::ClientPaintedLayer::PaintThebes() 	gfx/layers/client/ClientPaintedLayer.cpp
16 	xul.dll 	mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback(mozilla::layers::ReadbackProcessor*) 	gfx/layers/client/ClientPaintedLayer.cpp
17 	xul.dll 	mozilla::layers::ClientContainerLayer::RenderLayer() 	gfx/layers/client/ClientContainerLayer.h
18 	xul.dll 	mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/client/ClientLayerManager.cpp
19 	xul.dll 	mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/client/ClientLayerManager.cpp
20 	xul.dll 	nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) 	layout/base/nsDisplayList.cpp
21 	xul.dll 	nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, unsigned int) 	layout/base/nsLayoutUtils.cpp
22 	xul.dll 	PresShell::Paint(nsView*, nsRegion const&, unsigned int) 	layout/base/nsPresShell.cpp
23 	xul.dll 	nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) 	view/nsViewManager.cpp
24 	xul.dll 	nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) 	view/nsViewManager.cpp
25 	xul.dll 	nsViewManager::ProcessPendingUpdates() 	view/nsViewManager.cpp
26 	xul.dll 	nsRefreshDriver::Tick(__int64, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
27 	xul.dll 	mozilla::RefreshDriverTimer::Tick() 	layout/base/nsRefreshDriver.cpp
28 	xul.dll 	nsTimerImpl::Fire() 	xpcom/threads/nsTimerImpl.cpp
29 	xul.dll 	nsTimerEvent::Run() 	xpcom/threads/nsTimerImpl.cpp
30 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
31 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
32 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
33 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
34 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
35 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
36 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp
37 	xul.dll 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp
38 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
39 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
40 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
41 	xul.dll 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp
42 	plugin-container.exe 	content_process_main(int, char** const) 	ipc/contentproc/plugin-container.cpp
43 	plugin-container.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
44 	plugin-container.exe 	__tmainCRTStartup 	f:/dd/vctools/crt/crtw32/startup/crt0.c:255
45 	kernel32.dll 	BaseThreadInitThunk 	
Ø 46 	ntdll.dll 	ntdll.dll@0x50bba 	
Ø 47 	ntdll.dll 	ntdll.dll@0x50b90

From comment 3:
 	https://www.google.com/maps/@-22.5338446,-44.1844359,9.46z 

Frame 	Module 	Signature 	Source
0 	libxul.so 	NS_ABORT_OOM(unsigned int) 	xpcom/base/nsDebugImpl.cpp
1 	libxul.so 	gfxContext::PushNewDT(gfxContentType) 	gfx/thebes/gfxContext.cpp
2 	libxul.so 	gfxContext::PushGroup(gfxContentType) 	gfx/thebes/gfxContext.cpp
3 	libxul.so 	mozilla::layers::BasicLayerManager::PushGroupForLayer(gfxContext*, mozilla::layers::Layer*, nsIntRegion const&, bool*) 	gfx/layers/basic/BasicLayerManager.cpp
4 	libxul.so 	mozilla::layers::BasicPaintedLayer::PaintThebes(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) 	gfx/layers/basic/BasicPaintedLayer.cpp
5 	libxul.so 	mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext&, gfxContext*) 	gfx/layers/basic/BasicLayerManager.cpp
6 	libxul.so 	mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) 	gfx/layers/basic/BasicLayerManager.cpp
7 	libxul.so 	mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext&, gfxContext*) 	gfx/layers/basic/BasicLayerManager.cpp
8 	libxul.so 	mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) 	gfx/layers/basic/BasicLayerManager.cpp
9 	libxul.so 	mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/basic/BasicLayerManager.cpp
10 	libxul.so 	mozilla::FrameLayerBuilder::PaintItems(nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem>&, nsIntRect const&, gfxContext*, nsRenderingContext*, nsDisplayListBuilder*, nsPresContext*, nsIntPoint const&, float, float, int) 	layout/base/FrameLayerBuilder.cpp
11 	libxul.so 	mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*) 	layout/base/FrameLayerBuilder.cpp
12 	libxul.so 	mozilla::layers::ClientTiledLayerBuffer::PaintThebes(nsIntRegion const&, nsIntRegion const&, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) 	gfx/layers/client/TiledContentClient.cpp
13 	libxul.so 	mozilla::layers::ClientTiledLayerBuffer::ProgressiveUpdate(nsIntRegion&, nsIntRegion&, nsIntRegion const&, mozilla::layers::BasicTiledLayerPaintData*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) 	gfx/layers/client/TiledContentClient.cpp
14 	libxul.so 	mozilla::layers::ClientTiledPaintedLayer::RenderHighPrecision(nsIntRegion&, nsIntRegion const&, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) 	gfx/layers/client/ClientTiledPaintedLayer.cpp
15 	libxul.so 	mozilla::layers::ClientTiledPaintedLayer::RenderLayer() 	gfx/layers/client/ClientTiledPaintedLayer.cpp
16 	libxul.so 	RunnableMethodTraits<FdWatcher>::RetainCallee(FdWatcher*) 	ipc/chromium/src/base/task.h
17 	libxul.so 	mozilla::layers::ClientContainerLayer::RenderLayer() 	gfx/layers/client/ClientContainerLayer.h
18 	libxul.so 	mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/client/ClientLayerManager.cpp
19 	libxul.so 	mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/client/ClientLayerManager.cpp
20 	libxul.so 	nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) 	layout/base/nsDisplayList.cpp
21 	libxul.so 	nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, unsigned int) 	layout/base/nsLayoutUtils.cpp
22 	libxul.so 	PresShell::Paint(nsView*, nsRegion const&, unsigned int) 	layout/base/nsPresShell.cpp
23 	libxul.so 	nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) 	view/nsViewManager.cpp
24 	libxul.so 	nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) 	view/nsViewManager.cpp
25 	libxul.so 	nsRefreshDriver::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
26 	libxul.so 	mozilla::RefreshDriverTimer::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
27 	libxul.so 	mozilla::RefreshDriverTimer::TimerTick(nsITimer*, void*) 	layout/base/nsRefreshDriver.cpp
28 	libxul.so 	nsTimerImpl::Fire() 	xpcom/threads/nsTimerImpl.cpp
29 	libxul.so 	nsTimerEvent::Run() 	xpcom/threads/nsTimerImpl.cpp
30 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
31 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
32 	libxul.so 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
33 	libxul.so 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc
34 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
35 	libxul.so 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
36 	libxul.so 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp
37 	libxul.so 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc
38 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
39 	libxul.so 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp
40 	libxul.so 	content_process_main(int, char**) 	ipc/contentproc/plugin-container.cpp
41 	libxul.so 	mozilla::ipc::ProcLoaderLoadRunner::DoWork() 	ipc/glue/ProcessUtils_linux.cpp
42 	libxul.so 	XRE_ProcLoaderServiceRun 	ipc/glue/ProcessUtils_linux.cpp
43 	b2g 	main 	b2g/app/B2GLoader.cpp
44 	libc.so 	__libc_init 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/bionic/libc/bionic/libc_init_dynamic.cpp:112
45 	b2g 	b2g@0x941a 	
46 	linker 	set_soinfo_pool_protection 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/bionic/linker/linker.cpp:291
47 		@0xbe8a5d94

This seems to be the same crash signature as bug 1058661 which was marked a duplicate of bug  bug 1053934

Comment 5

[Matt Woodrow (:mattwoodrow)]

The same crash signature will happen for all the potential reasons that PushNewDT will fail.

This probably isn't the same bug (since that was fixed).

This isn't necessarily an actual OOM (OOM is just one of the reasons that these can fail), so each platform might be a separate bug.

Comment 6

[Peter Bylenga [:PBylenga]]

Adding qawanted to define the STR's reproducibility in comment 2 in order to gauge the feasibility of finding a window.

Comment 7

[Yeojin Chung [:YeojinC]]

I was unable to receive a crash report dialog or get a consistent STR when following and modifying steps in Comment 0 and Comment 2. Leaving qawanted for others to try.

Environmental Variables:
Device: Flame Master (KK, 319mb, shallow flash)
Build ID: 20150310055519
Gaia: f6a1fcd30ee6a286f3bca9d0c3cb600e21bfbf69
Gecko: c42e7e3bb0a0
Version: 39.0a1 (Master)
Firmware Version: v18D-1
User Agent: Mozilla/5.0 (Mobile; rv:39.0) Gecko/39.0 Firefox/39.0

Device: Flame Master (KK, 319mb, full flash)
Build ID: 20150310010227
Gaia: 2fb09da0cb9cefad9c6e40f57533fafda6d12557
Gecko: 6686aacf006f
Gonk: e7c90613521145db090dd24147afd5ceb5703190
Version: 39.0a1 (Master)
Firmware Version: v18D-1
User Agent: Mozilla/5.0 (Mobile; rv:39.0) Gecko/39.0 Firefox/39.0

Comment 8

[KTucker [:KTucker][Inactive 3/4/2016]]

I was unable to reproduce this on the Flame 3.0 and Flame 2.2

I tried for well over an hour trying the steps in Comment 0 and Comment 2.  I tried scrolling and zooming in and out on multiple websites including Google maps, yahoo.com, cnn.com, greenmangaming.com, ign.com, mlb.com etc...Performance did drop significantly and the browser did force close from time to time but no crash occurred.

Environmental Variables:
Device: Flame 3.0 (Full Flash)(KK)(319mb)
BuildID: 20150310010227
Gaia: 2fb09da0cb9cefad9c6e40f57533fafda6d12557
Gecko: 6686aacf006f
Gonk: e7c90613521145db090dd24147afd5ceb5703190
Version: 39.0a1 (3.0) 
Firmware Version: v18D-1
User Agent: Mozilla/5.0 (Mobile; rv:39.0) Gecko/39.0 Firefox/39.0

Environmental Variables:
Device: Flame 2.2 (Full Flash)(KK)(319mb)
BuildID: 20150310002536
Gaia: 166491b92278dc9e648f8d49ab02d9ca00d74421
Gecko: 1cda026f8996
Gonk: e7c90613521145db090dd24147afd5ceb5703190
Version: 37.0 (2.2) 
Firmware Version: v18D-1
User Agent: Mozilla/5.0 (Mobile; rv:37.0) Gecko/37.0 Firefox/37.0

Due to the low reproducibility of this issue, we will not be able to get a regression window here.

Comment 9

[No-Jun Park [:njpark]]

ni?ing myself to check whether there was a relevant gfx issue

Comment 10

[No-Jun Park [:njpark]]

Hi Milan, we were tracking this bug but recently it got much harder to repro.  I did a search on recently closed bugs that might involve this issue, but I didn't find any.  Does this issue look familiar to you?

Comment 11

[Milan Sreckovic [:milan] (needinfo for best results)]

Bug 1053934 probably helped.

Comment 12

[No-Jun Park [:njpark]]

If this does not repro until the end of this week, I think it is safe to mark this bug as a dup to Bug 1053934

Comment 13

[Joshua Mitchell (Inactive)]

I can no longer reproduce this with my STR from comment 2 

HOWEVER - according to the crash report stats this issue was hit 5 times yesterday, or 18 times in the last week - so certainly not fixed

Comment 14

[No-Jun Park [:njpark]]

There was one instance of B2G crash, (https://crash-stats.mozilla.com/report/index/ca68b1a1-d9bd-4ff4-8ef9-3c7d92150321) but it was in 2.1 and on the August build. Otherwise all errors came from Windows platform, so removingteh b2g-affected flag

Comment 15

[Randell Jesup [:jesup] (needinfo me)]

I've hit this 4 times in a row by reloading a crashed tab:
https://crash-stats.mozilla.com/report/index/9e42b7f1-0d08-4723-b6d1-596822151122
https://crash-stats.mozilla.com/report/index/c062524c-d54d-4dc1-9a96-380bc2151122
https://crash-stats.mozilla.com/report/index/0d0ce4d3-7992-4b4a-944f-bdcd42151122
https://crash-stats.mozilla.com/report/index/79dcd051-84ce-489d-9f29-4a9832151122
URL is http://www.nytimes.com/2015/11/22/world/africa/assault-in-mali-hotel-sets-back-fight-on-extremism.html?ribbon-ad-idx=3&rref=homepage&module=Ribbon&version=origin&region=Header&action=click&contentCollection=Home%20Page&pgtype=article

GPU is an nvidia 7600gt (old).  Definitely not an OOM; crashes within a  few seconds of starting to draw the page.  Doesn't crash on a Linux build.

Bas's name is on the code around the crash.  NI bas and milan; I can check additional things since it seems very reproducible.

Comment 16

[Bas Schouten (:bas.schouten)]

Cairo status 1, so likely this is one of those messed up cairo fonts being in that page.

Comment 17

[Milan Sreckovic [:milan] (needinfo for best results)]

Randell, can you set environment variable MOZ_CAIRO_ERROR_ABORT to 1 and see what the crash looks like then?

Comment 18

[Milan Sreckovic [:milan] (needinfo for best results)]

While at it - if you have a chance to apply https://bug1200021.bmoattachments.org/attachment.cgi?id=8685083 and run with that, and point to that crash (if one happens), it'd be great.

Comment 19

[Jim Mathies [:jimm]]

Currently the #1 top crash in our beta e10s experiment.

Comment 20

[u279076]

Is this just another manifestation of bug 805406?

Comment 21

[Randell Jesup [:jesup] (needinfo me)]

(In reply to Milan Sreckovic [:milan] from comment #17)
> Randell, can you set environment variable MOZ_CAIRO_ERROR_ABORT to 1 and see
> what the crash looks like then?

(Back from PTO) With that pref set, I'm crashing but it's not sending crash reports...
Without that set, it's no longer crashing

This is in Nightly 12/9/2015

Comment 22

[Milan Sreckovic [:milan] (needinfo for best results)]

Yeah, I think we're identifying this as OOM when it isn't.  I'm guessing we try to create a similar surface from one that has an error on it, which fails right away - and will for any size.  We interpret that as OOM, which doesn't sound quite right.  I'll put up a patch to verify if this is the case, since we are seeing some crashes in 46.

Comment 23

[Milan Sreckovic [:milan] (needinfo for best results)]

Attachment: A bit more info in the crash reports to validate a theory. r=jmathies

Comment 24

[Milan Sreckovic [:milan] (needinfo for best results)]

Attachment: Alternative to similar surface creation when the original is in error state. r=milan

Got the code from Bas on the side.
https://treeherder.mozilla.org/#/jobs?repo=try&revision=f9b1cb61ace7

Comment 25

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/6c49bb716593

Comment 26

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/6c49bb716593

Comment 27

[Jim Mathies [:jimm]]

If this patch was designed to fix this problem it looks promising, last crash was in the 25th build. 

https://crash-stats.mozilla.com/search/?product=Firefox&signature=~OOM+|+unknown+|+NS_ABORT_OOM+|+gfxContext%3A%3APushNewDT&version=46.0a1&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#crash-reports

If so, can we get this uplifted to aurora?

Comment 28

[Milan Sreckovic [:milan] (needinfo for best results)]

Comment on attachment 8701542 [details] [diff] [review]
Alternative to similar surface creation when the original is in error state. r=milan

Approval Request Comment
Not only a fix for the crash, but potentially dealing with the "nothing is drawing" scenarios as well; an error would eventually pollute the rest of the drawing and stop us from displaying anything.

Safe fix; we're using an alternative to create a draw surface that is used elsewhere in the code, for the initial creation.

Comment 29

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8701542 [details] [diff] [review]
Alternative to similar surface creation when the original is in error state. r=milan

Crash fix, taking it. Beta44+, Aurora45+.

Comment 30

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/releases/mozilla-beta/rev/5192a57059cf

Comment 31

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/2f2377b019b4

Comment 32

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-b2g44_v2_5/rev/5192a57059cf

Comment 33

[Milan Sreckovic [:milan] (needinfo for best results)]

There seems to be an equivalent of this bug for D2D1.1 (rather than Cairo) - but that one could be the real OOM.  https://crash-stats.mozilla.com/report/index/4a40bb9f-b637-4293-bb7b-73dd02160119 and https://crash-stats.mozilla.com/report/index/82ce712c-7ba6-4fc3-8266-93f722160119.  I'll open another bug for it.