1139863 - Intermittent Shutdown | application crashed [@ mozilla::PaintedLayerData::UpdateCommonClipCount(mozilla::DisplayItemClip const&)]

Status: RESOLVED WORKSFORME

(Core :: Graphics: Layers, defect)

Description

[Carsten Book [:Tomcat]]

Android 4.0 armv7 API 11+ b2g-inbound opt test plain-reftest-8

https://treeherder.mozilla.org/logviewer.html#?job_id=1454684&repo=b2g-inbound

02:37:54 WARNING - PROCESS-CRASH | Shutdown | application crashed [@ mozilla::PaintedLayerData::UpdateCommonClipCount(mozilla::DisplayItemClip const&)] 

02:37:54 WARNING - PROCESS-CRASH | Shutdown | application crashed [@ mozilla::PaintedLayerData::UpdateCommonClipCount(mozilla::DisplayItemClip const&)]
02:37:54 INFO - Crash dump filename: /tmp/tmpLa21P1/08fe4b6a-a64b-f8b2-366c3638-43b97023.dmp
02:37:54 INFO - Operating system: Android
02:37:54 INFO - 0.0.0 Linux 3.2.0+ #2 SMP PREEMPT Thu Nov 29 08:06:57 EST 2012 armv7l pandaboard/pandaboard/pandaboard:4.0.4/IMM76I/5:eng/test-keys
02:37:54 INFO - CPU: arm
02:37:54 INFO - 2 CPUs
02:37:54 INFO - Crash reason: SIGSEGV
02:37:54 INFO - Crash address: 0x14
02:37:54 INFO - Thread 12 (crashed)
02:37:54 INFO - 0 libxul.so!mozilla::PaintedLayerData::UpdateCommonClipCount(mozilla::DisplayItemClip const&) [FrameLayerBuilder.cpp:0b754b3afe46 : 1968 + 0xa]
02:37:54 INFO - r4 = 0x6e0768a0 r5 = 0x6d595160 r6 = 0x00000004 r7 = 0x5c4fe714
02:37:54 INFO - r8 = 0x5c4fe790 r9 = 0x6e0e983c r10 = 0x6d03f960 fp = 0x6e0768a0
02:37:54 INFO - sp = 0x5c4fe6a8 lr = 0x63f8076b pc = 0x63f8076a
02:37:54 INFO - Found by: given as instruction pointer in context
02:37:54 INFO - 1 libxul.so!mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*) [FrameLayerBuilder.cpp:0b754b3afe46 : 3139 + 0x5]
02:37:54 INFO - r4 = 0x6d595110 r5 = 0x5c4fe910 r6 = 0x00000004 r7 = 0x5c4fe714
02:37:54 INFO - r8 = 0x5c4fe790 r9 = 0x6e0e983c r10 = 0x6d03f960 fp = 0x6e0768a0
02:37:54 INFO - sp = 0x5c4fe6b8 pc = 0x63f8ccdb
02:37:54 INFO - Found by: call frame info
02:37:54 INFO - 2 libxul.so!mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4 const*, unsigned int) [FrameLayerBuilder.cpp:0b754b3afe46 : 4125 + 0x7]
02:37:54 INFO - r4 = 0x71ac1c00 r5 = 0x6e0e9810 r6 = 0x5c4feadc r7 = 0x6d022f40
02:37:54 INFO - r8 = 0x6d03f2b8 r9 = 0x5c4fe8d0 r10 = 0x00000000 fp = 0x6e1a52c0
02:37:54 INFO - sp = 0x5c4fe7e8 pc = 0x63f8d89b
02:37:54 INFO - Found by: call frame info
02:37:54 INFO - 3 libxul.so!nsDisplayOwnLayer::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) [nsDisplayList.cpp:0b754b3afe46 : 4139 + 0x27]
02:37:54 INFO - r4 = 0x6e0e9810 r5 = 0x5c4fead8 r6 = 0x6e1a52c0 r7 = 0x5c4ff198
02:37:54 INFO - r8 = 0x6e1a52c0 r9 = 0x6d03fb68 r10 = 0x6d5452b8 fp = 0x00000000
02:37:54 INFO - sp = 0x5c4fea90 pc = 0x63fa256b
02:37:54 INFO - Found by: call frame info
02:37:54 INFO - 4 libxul.so!nsDisplaySubDocument::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) [nsDisplayList.cpp:0b754b3afe46 : 4187 + 0xd]
02:37:54 INFO - r4 = 0x6e0e9810 r5 = 0x5c4febf0 r6 = 0x5c4feadc r7 = 0x5c4ff198
02:37:54 INFO - r8 = 0x6e1a52c0 r9 = 0x6d03fb68 r10 = 0x6d5452b8 fp = 0x00000000
02:37:54 INFO - sp = 0x5c4feac8 pc = 0x63fa388d
02:37:54 INFO - Found by: call frame info
02:37:54 INFO - 5 libxul.so!mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*) [FrameLayerBuilder.cpp:0b754b3afe46 : 3018 + 0x9]
02:37:54 INFO - r4 = 0x6e0e9810 r5 = 0x5c4fed70 r6 = 0x5c4fec20 r7 = 0x00000000
02:37:54 INFO - r8 = 0x5c4febf0 r9 = 0x5c4ff14c r10 = 0x6d5452b8 fp = 0x00000000
02:37:54 INFO - sp = 0x5c4feb18 pc = 0x63f8cae5
02:37:54 INFO - Found by: call frame info

Comment 1

[Legacy TBPL/Treeherder Robot]

log: https://treeherder.mozilla.org/logviewer.html#?repo=b2g-inbound&job_id=1454684
repository: b2g-inbound
start_time: 2015-03-05T02:04:24
who: tomcat[at]mozilla[dot]com
machine: panda-0353
buildname: Android 4.0 armv7 API 11+ b2g-inbound opt test plain-reftest-8
revision: 0b754b3afe46

REFTEST TEST-UNEXPECTED-FAIL | http://10.26.131.17:30353/tests/dom/imptests/html/html/dom/elements/global-attributes/dir_auto-input-R.html | This test left crash dumps behind, but we weren't expecting it to!
PROCESS-CRASH | Shutdown | application crashed [@ mozilla::PaintedLayerData::UpdateCommonClipCount(mozilla::DisplayItemClip const&)]
Return code: 1

Comment 2

[Milan Sreckovic [:milan] (needinfo for best results)]

In FrameLayerBuilder...

Comment 3

[Markus Stange [:mstange]]

This is certainly a regression from bug 913443.

Comment 4

[Milan Sreckovic [:milan] (needinfo for best results)]

(In reply to Markus Stange [:mstange] from comment #3)
> This is certainly a regression from bug 913443.

That was quick!  Thanks.

Comment 5

[Markus Stange [:mstange]]

I was wrong - this crash happened on b2g-inbound revision 0b754b3afe46, which didn't have those changes.

I looked at the assembly with Jeff and we didn't have a good explanation for what might have been going on.
Let's wait for this crash to occur again. Maybe my changes from bug 913443 even change stuff around in such a way that we'll crash somewhere else.

Comment 6

[Ed Morley [:emorley]]

Inactive; closing (see bug 1180138).