Closed
Bug 320430
Opened 19 years ago
Closed 3 years ago
Blue Screen triggered under [@ nsNativeThemeWin::DrawWidgetBackground]
Categories
(Core :: Widget: Win32, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: timeless, Unassigned)
References
Details
(Keywords: crash, Whiteboard: tpi:-)
Crash Data
Attachments
(1 file)
36 bytes,
patch
|
Details | Diff | Splinter Review |
yes, i know this is an os problem. i'm posting it here to enable me to track it. internal vendor build id: 1744. gecko branch: 1.8 kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fe87c790, memory referenced. Arg2: 00000000, value 0 = read operation, 1 = write operation. Arg3: 804e70d5, If non-zero, the instruction address which referenced the bad memory address. Arg4: 00000000, (reserved) Debugging Details: ------------------ READ_ADDRESS: fe87c790 FAULTING_IP: nt!MiLocateAndReserveWsle+52 804e70d5 8b0490 mov eax,[eax+edx*4] MM_INTERNAL_CODE: 0 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0x50 LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8 TRAP_FRAME: b3b1d100 -- (.trap ffffffffb3b1d100) ErrCode = 00000002 eax=e28514c8 ebx=bceb61b8 ecx=00000013 edx=00000000 esi=e285147c edi=bceb61b8 eip=804d9da8 esp=b3b1d174 ebp=b3b1d17c iopl=0 nv up ei pl nz ac pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010212 nt!memmove+0x33: 804d9da8 f3a5 rep movsd ds:e285147c=00eeede5 es:bceb61b8=00000000 Resetting default scope STACK_TEXT: b3b1d17c bf83a167 bceb61b8 e285147c 0000004c nt!memmove+0x33 b3b1d1a0 bf839e20 0000003a b3b1d73c b3b1d430 win32k!vSrcCopyS32D32Identity+0x5b b3b1d3b4 bf81768b e283a018 00000000 00000000 win32k!EngCopyBits+0x51a b3b1d3f4 bf817bd2 e2688010 e2843010 00000000 win32k!SURFREFAPI::SURFREFAPI+0x149 b3b1d480 bf81797a e283a018 e2688010 00000000 win32k!SURFREFAPI::SURFREFAPI+0x37a b3b1d4e0 bf817ea6 e283a018 e2688010 00000000 win32k!EngNineGrid+0x6e b3b1d53c bf818300 e283a018 e2688010 00000000 win32k!EngDrawStream+0xc5 b3b1d5a0 bf8186e7 b3b1d6c4 00000000 e2688000 win32k!NtGdiDrawStreamInternal+0x1ff b3b1d6c8 bf817f8b 090113c6 00000000 00000000 win32k!GreDrawStream+0x4ff b3b1d810 804de7ec 090113c6 00000060 0012d578 win32k!NtGdiDrawStream+0x9f b3b1d810 7c90eb94 090113c6 00000060 0012d578 nt!KiFastCallEntry+0xf8 0012d3ec 77f16c25 77f16c0f 090113c6 00000060 ntdll!KiFastSystemCallRet 0012d4f4 5ad72b54 090113c6 00000060 0012d578 GDI32!NtGdiDrawStream+0xc 0012d770 5ad728d4 009ba2bc 009b6c6c 00000001 uxtheme!CImageFile::DrawBackgroundDS+0x3ac 0012d7e8 5ad7278c 009ba2bc 00289200 090113c6 uxtheme!CImageFile::DrawImageInfo+0x1be 0012d838 5ad72cd8 00289200 090113c6 00000001 uxtheme!CImageFile::DrawBackground+0x45 0012d894 00d53ac2 00289200 090113c6 00000006 uxtheme!DrawThemeBackground+0x102 0012d910 00d95dab 01db1408 0a657590 0af9c5b4 gkgfxwin!nsNativeThemeWin::DrawWidgetBackground+0x132 [c:\build\chs3\build\mozilla\gfx\src\windows\nsnativethemewin.cpp @ 716] 0012d9e4 00d96349 0b00d7a8 0a657590 0af9c5b4 gklayout!nsCSSRendering::PaintBackgroundWithSC+0x86 [c:\build\chs3\build\mozilla\layout\base\nscssrendering.cpp @ 2825] 0012da38 00da2fef 0b00d7a8 0a657590 0af9c5b4 gklayout!nsCSSRendering::PaintBackground+0x82 [c:\build\chs3\build\mozilla\layout\base\nscssrendering.cpp @ 2748] 0012da8c 00e33a8b 0b00d7a8 0a657590 0012db28 gklayout!nsFrame::PaintSelf+0x97 [c:\build\chs3\build\mozilla\layout\generic\nsframe.cpp @ 947] 0012dab4 00d865c5 0af9c5b4 0b00d7a8 0a657590 gklayout!nsBoxFrame::Paint+0x41 [c:\build\chs3\build\mozilla\layout\xul\base\src\nsboxframe.cpp @ 1415] 0012dae4 00ebdd39 00000000 08142730 0a657590 gklayout!PresShell::Paint+0x4d [c:\build\chs3\build\mozilla\layout\base\nspresshell.cpp @ 5806] 0012db00 00eb8da2 0b014a28 0a657590 0012db28 gklayout!nsView::Paint+0x3e [c:\build\chs3\build\mozilla\view\src\nsview.cpp @ 316] 0012db48 00ebc0ec 0b476c58 0a657590 0b00dfe0 gklayout!nsViewManager::RenderDisplayListElement+0x78 [c:\build\chs3\build\mozilla\view\src\nsviewmanager.cpp @ 1460] 0012dbf0 00ebc922 09d36b70 0a657590 0012dc74 gklayout!nsViewManager::RenderViews+0x156 [c:\build\chs3\build\mozilla\view\src\nsviewmanager.cpp @ 1375] 0012dcfc 00ebcc65 0b00e060 0a657590 09bb24c0 gklayout!nsViewManager::Refresh+0x328 [c:\build\chs3\build\mozilla\view\src\nsviewmanager.cpp @ 930] 0012dd68 00ebdc0e 00000000 0b00e060 09bb24c0 gklayout!nsViewManager::DispatchEvent+0x203 [c:\build\chs3\build\mozilla\view\src\nsviewmanager.cpp @ 2047] 0012dd84 0100518b 0012de18 00000000 0012de54 gklayout!HandleEvent+0x27 [c:\build\chs3\build\mozilla\view\src\nsview.cpp @ 174] 0012dd98 01001e48 0b00e0dc 0012de18 0012de54 gkwidget!nsWindow::DispatchEvent+0x35 [c:\build\chs3\build\mozilla\widget\src\windows\nswindow.cpp @ 1253] 0012ddac 0100764a 0012de18 0012de54 00000001 gkwidget!nsWindow::DispatchWindowEvent+0x16 [c:\build\chs3\build\mozilla\widget\src\windows\nswindow.cpp @ 1279] 0012de74 010088f9 00000000 00000000 0b00e0d8 gkwidget!nsWindow::OnPaint+0x139 [c:\build\chs3\build\mozilla\widget\src\windows\nswindow.cpp @ 5748] 0012e0ec 010085cb 0000000f 00000000 00000000 gkwidget!nsWindow::ProcessMessage+0x230 [c:\build\chs3\build\mozilla\widget\src\windows\nswindow.cpp @ 4365] 0012e120 77d48734 008306cc 0000000f 00000000 gkwidget!nsWindow::WindowProc+0x9c [c:\build\chs3\build\mozilla\widget\src\windows\nswindow.cpp @ 1435] 0012e14c 77d48816 0100852f 008306cc 0000000f USER32!InternalCallWinProc+0x28 0012e1b4 77d4b4c0 00000000 0100852f 008306cc USER32!UserCallWinProcCheckWow+0x150 0012e208 77d4b50c 0058a3b8 0000000f 00000000 USER32!DispatchClientMessage+0xa3 0012e230 7c90eae3 0012e240 00000018 0058a3b8 USER32!__fnDWORD+0x24 0012e230 804e2b1c 0012e240 00000018 0058a3b8 ntdll!KiUserCallbackDispatcher+0x13 b3b1dad8 80565cec b3b1db94 b3b1db98 b3b1db68 nt!KiCallUserMode+0x4 b3b1db34 bf813e47 00000002 b3b1db78 00000018 nt!KeUserModeCallback+0x87 b3b1dbb8 bf813fdd bbe8a3b8 0000000f 00000000 win32k!SfnDWORD+0xa8 b3b1dc00 bf8141cf 42e8a3b8 0000000f 00000000 win32k!xxxSendMessageToClient+0x176 b3b1dc4c bf80f5b8 bbe8a3b8 0000000f 00000000 win32k!xxxSendMessageTimeout+0x1a6 b3b1dc70 bf827001 bbe8a3b8 0000000f 00000000 win32k!xxxSendMessage+0x1b b3b1dc9c bf826f6c bbe8a3b8 00000005 00000000 win32k!xxxUpdateWindow2+0x79 b3b1dcc0 bf826f6c bbe5ab88 00000005 00000000 win32k!xxxUpdateWindow2+0xfa b3b1dce4 bf826f6c bbe5aa60 00000005 b3b1dd64 win32k!xxxUpdateWindow2+0xfa b3b1dd08 bf826ed1 bbe7ec30 00000001 0012e268 win32k!xxxUpdateWindow2+0xfa b3b1dd28 bf8370dd bbe7ec30 00000001 b3b1dd54 win32k!xxxInternalUpdateWindow+0x6f FOLLOWUP_IP: win32k!vSrcCopyS32D32Identity+5b bf83a167 83c40c add esp,0xc SYMBOL_STACK_INDEX: 1 FOLLOWUP_NAME: MachineOwner SYMBOL_NAME: win32k!vSrcCopyS32D32Identity+5b MODULE_NAME: win32k IMAGE_NAME: win32k.sys DEBUG_FLR_IMAGE_TIMESTAMP: 43446a58 STACK_COMMAND: .trap ffffffffb3b1d100 ; kb FAILURE_BUCKET_ID: 0x50_win32k!vSrcCopyS32D32Identity+5b BUCKET_ID: 0x50_win32k!vSrcCopyS32D32Identity+5b Followup: MachineOwner ---------
140 #define NS_THEME_SCROLLBAR_TRACK_VERTICAL 87 looks like it's SP_TRACKSTARTVERT aka SBP_THUMBBTNVERT kd> dv -t class nsNativeThemeWin * this = 0x01db1408 class nsIRenderingContext * aContext = 0x0a657590 class nsIFrame * aFrame = 0x0af9c5b4 unsigned char aWidgetType = 0x57 'W' struct nsRect * aRect = 0x0012da70 struct nsRect * aClipRect = 0x0012db28 int state = 1 struct tagRECT clipRect = struct tagRECT void * theme = 0x00010002 int part = 6 struct tagRECT widgetRect = struct tagRECT struct nsRect tr = struct nsRect struct nsRect cr = struct nsRect class nsTransform2D * transformMatrix = 0x0b48f0cc kd> dt -b gkgfxwin!nsRenderingContextWin 0x0a657590 +0x000 __VFN_table : 0x00d579d0 +0x004 mTranMatrix : 0x0b48f0cc +0x008 mLineStyle : 1 ( nsLineStyle_kSolid ) +0x00c mAct : 0 +0x010 mActive : (null) +0x014 mPenMode : 0 ( nsPenMode_kNone ) =00d5fcd4 nsRenderingContextImpl::gBackbuffer : 0x0af72288 =00d5fce0 nsRenderingContextImpl::gBackbufferBounds : nsRect +0x000 x : 0 +0x004 y : 0 +0x008 width : 896 +0x00c height : 625 =00d5fcd8 nsRenderingContextImpl::gLargestRequestedSize : nsSize +0x000 width : 0 +0x004 height : 0 +0x018 __VFN_table : 0x00d579c0 +0x01c mRefCnt : +0x000 mValue : 5 +0x020 mCurrentColor : 0 +0x024 mFontMetrics : (null) +0x028 mDC : 0x090113c6 +0x02c mMainDC : 0x05011e63 +0x030 mSurface : 0x0af72288 +0x034 mMainSurface : 0x0a82afc8 +0x038 mColor : 0 +0x03c mDCOwner : (null) +0x040 mContext : 0x0aff3768 +0x044 mP2T : 15 +0x048 mClipRegion : (null) +0x04c mOrigSolidBrush : 0x01900010 +0x050 mOrigFont : 0x018a0021 +0x054 mOrigSolidPen : 0x01b00017 +0x058 mOrigPalette : (null) +0x05c mStates : 0x0b48f0c8 +0x060 mStateCache : 0x09ffafa8 +0x064 mCurrBrushColor : 0xffd8e9ec +0x068 mCurrBrush : 0x441029cf +0x06c mCurrFontWin : (null) +0x070 mCurrFont : (null) +0x074 mCurrPenColor : 0 +0x078 mCurrPen : (null) +0x07c mNullPen : (null) +0x080 mGammaTable : (null) +0x084 mCurrTextColor : 0 +0x088 mCurrLineStyle : 1 ( nsLineStyle_kSolid ) +0x08c mRightToLeftText : 0 '' clipRect: kd> dt nsRect 0x0012d8c0 +0x000 x : 876 +0x004 y : 0 +0x008 width : 895 +0x00c height : 605 widgetRect: kd> dt nsRect 0x0012d8f0 +0x000 x : 876 +0x004 y : 0 +0x008 width : 895 +0x00c height : 605
*** Bug 317379 has been marked as a duplicate of this bug. ***
Assignee | ||
Updated•16 years ago
|
Product: Core → Core Graveyard
Assignee | ||
Updated•13 years ago
|
Crash Signature: [@ nsNativeThemeWin::DrawWidgetBackground]
![]() |
||
Updated•12 years ago
|
Assignee: win32 → nobody
Component: GFX: Win32 → Widget: Win32
Product: Core Graveyard → Core
QA Contact: ian
![]() |
||
Comment 3•12 years ago
|
||
Crashes with this function still happen, see https://crash-stats.mozilla.com/report/list?signature=nsNativeThemeWin%3A%3ADrawWidgetBackground%28nsRenderingContext%2A%2C+nsIFrame%2A%2C+unsigned+char%2C+nsRect+const%26%2C+nsRect+const%26%29
Crash Signature: [@ nsNativeThemeWin::DrawWidgetBackground] → [@ nsNativeThemeWin::DrawWidgetBackground]
[@ nsNativeThemeWin::DrawWidgetBackground(nsRenderingContext*, nsIFrame*, unsigned char, nsRect const&, nsRect const&) ]
Approval Request Comment [Feature/regressing bug #]: [User impact if declined]: [Describe test coverage new/current, TreeHerder]: [Risks and why]: [String/UUID change made/needed]:
Updated•8 years ago
|
Whiteboard: tpi:-
Comment 5•3 years ago
|
||
No crashes since Firefox version 94.0.2.
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → WORKSFORME
You need to log in
before you can comment on or make changes to this bug.
Description
•