Closed Bug 279804 Opened 20 years ago Closed 20 years ago

Trunk crash [@ ntdll.dll - nsRenderingContextWin::PushState]

Categories

(Core Graveyard :: GFX: Win32, defect)

Product:
Core Graveyard
Component:
GFX: Win32
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: jay, Unassigned)

References

Details

(Keywords: crash, topcrash)

Crash Data

This is showing up as a topcrasher in recent MozillaTrunk data, but most of the
crashes are coming from just one user.  Still, it might be worth a look to see
if we can fix this.  It looks like either a gfx or layout bug and I haven't
found any useful comments or urls to help reproduce.

Here is a recent incident with a decent stack:

Incident ID: 3214681
Stack Signature	ntdll.dll + 0xeddc (0x7c90eddc) 46f63f79
Product ID	MozillaTrunk
Build ID	2005012005
Trigger Time	2005-01-21 23:42:34.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	ntdll.dll + (0000eddc)
URL visited	
User Comments	
Since Last Crash	66821 sec
Total Uptime	68885 sec
Trigger Reason	Stack overflow
Source File, Line No.	N/A
Stack Trace 	
ntdll.dll + 0xeddc (0x7c90eddc)
msvcrt.dll + 0x1c3c9 (0x77c2c3c9)
msvcrt.dll + 0x1c3e7 (0x77c2c3e7)
msvcrt.dll + 0x19cd4 (0x77c29cd4)
nsRenderingContextWin::PushState 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/gfx/src/windows/nsRenderingContextWin.cpp,
line 670]
nsCSSRendering::PaintBackground 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSRendering.cpp,
line 2727]
nsFrame::PaintSelf 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp,
line 931]
nsBoxFrame::Paint 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1410]
nsBoxFrame::PaintChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1483]
nsBoxFrame::PaintChildren 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1609]
nsBoxFrame::Paint 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1432]
nsBoxFrame::PaintChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1483]
nsBoxFrame::PaintChildren 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1609]
nsBoxFrame::Paint 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1432]
nsContainerFrame::PaintChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 230]
nsContainerFrame::Paint 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsContainerFrame.cpp,
line 211]
PresShell::Paint 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5397]
nsView::Paint 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 316]
nsViewManager::RenderDisplayListElement 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1465]
nsViewManager::RenderViews 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1380]
nsViewManager::Refresh 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 945]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1962]
HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1103]
nsWindow::Invalidate 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 2668]
nsViewManager::UpdateWidgetArea 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1774]
nsViewManager::UpdateView 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1825]
nsViewManager::UpdateView 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1650]
nsViewManager::UpdateViews 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1858]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1962]
HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1103]
nsWindow::Invalidate 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 2668]
nsViewManager::UpdateWidgetArea 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1774]
nsViewManager::UpdateView 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1825]
nsViewManager::UpdateView 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1650]
nsViewManager::UpdateViews 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1858]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1962]
HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1103]
nsWindow::Invalidate 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 2668]
nsViewManager::UpdateWidgetArea 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1774]
nsViewManager::UpdateView 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1825]
nsViewManager::UpdateView 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1650]
nsViewManager::UpdateViews 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1858]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1962]
HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1103]
nsWindow::Invalidate 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 2668]
nsViewManager::UpdateWidgetArea 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1774]
nsViewManager::UpdateView 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1825]
nsViewManager::UpdateView 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1650]
nsViewManager::UpdateViews 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1858]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1962]
HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1103]
nsWindow::Invalidate 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 2668]
nsViewManager::UpdateWidgetArea 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1774]
nsViewManager::UpdateView 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1825]
nsViewManager::UpdateView 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1650]
nsViewManager::UpdateViews 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1858]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1962]
HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 174]
My original bug report with my comments and theories as to the cause.
https://bugzilla.mozilla.org/show_bug.cgi?id=279127

They later regrouped it as this one:
https://bugzilla.mozilla.org/show_bug.cgi?id=278811

Basically its related to background behaviour. I could have Mozilla open but in
the background, while I work in another application. It appears to be related to
when Mozilla polls for new mail, it chimes, then crashes when it attempts to
show the new mail popup. This has been happening for several monthes, since
about 1.8a3.  

I tried with last night's rebuild 2005012506 and it died yet again:

TB3297577K

Any time one of 12 IMAP mailboxes gets new mail, Mozilla 1.8b goes poof! Its
consistant.

In case this is relavent, my system is a 

Sony VAIO PCG-GRT796HP
Windows XP Pro SP2 (all updates applied)


More crashes this morning...

TB3299403E, TB3298658E, TB3298194W
Most recently:

TB3324083Z, TB3319071G
Cc'ing a the folks from bug 278811.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b) Gecko/20050130

Crash ID TB3386223W
TB3400600X, TB3399048H, TB3398678X, TB3398574Y, TB3397640Y
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b) Gecko/20050203

TB3484197K

When will this bug be addressed? You're coming up to 1.8 Beta 2 and this crash
continues with each nightly.
thank you for volunteering, you can now tell us exactly when it will be
addressed. we don't have infinite resources. we rely on volunteers. be a
volunteer, pull out your compiler and debugger and get to work.

otherwise, please do us the favor of being amazingly patient and quiet until
someone asks for your input.
Assignee: win32 → achowe
I deserved that. 

However, I work on Sendmail milters and Apache modules already and don't do C++,
only ANSI C on *nix boxes.

But you'll be pleased to note that I am attempting to build Firefox 1.0 for
OpenBSD 3.6. Contributions come in many forms.
This looks more or less identical to bug 278811 (same infinite recursion stack).

I'll put whatever I find in the other bug, since it's in the right component and
all...
Depends on: 278811
I checked in a patch for bug 278811 that may fix this.  Could someone who could
reproduce the bug retest with tomorrow's builds?
I just tried 

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b) Gecko/20050205

and it crashed

TB3522068E
Stacktrace:
nsImapServerResponseParser::msg_fetch_literal 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/mailnews/imap/src/nsImapServerResponseParser.cpp,
line 2663]
nsImapServerResponseParser::msg_fetch_content 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/mailnews/imap/src/nsImapServerResponseParser.cpp,
line 2044]

That looks like Bug 269573 now...
Other than the one crash I reported ealier today, I've had no further crashes
when new mail arrives.
sounds like worksforme, then, unless somebody sees this in a trunk build newer
than comment 11
Status: NEW → RESOLVED
Closed: 20 years ago
Resolution: --- → FIXED
Product: Core → Core Graveyard
Crash Signature: [@ ntdll.dll - nsRenderingContextWin::PushState]
You need to log in before you can comment on or make changes to this bug.