390668 - crash [@ gfxASurface::GetType (_moz_cairo_scaled_font_status)] with Tab Sidebar installed

Status: VERIFIED FIXED

(Core :: Graphics, defect)

Description

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a7pre) Gecko/2007080204 Minefield/3.0a7pre ID:2007080204

repro:
Install TabSidebar (latest @ http://www.oxymoronical.com/web/firefox/TabSidebar/development )
restart and press ctrl+shift+e (to get the TabPreview sidebar)
Open http://tinderbox.mozilla.org/showbuilds.cgi?tree=Firefox

result:
The page loads and displays... untill the final reflow when it crashes FF

this regressed after Cairo 1.5 landed

breakpad: 5e38c0fd-4119-11dc-a709-001a4bd43ed6

Comment 1

[Peter van der Woude [:Peter6]]

http://crash-stats.mozilla.com/report/index/5e38c0fd-4119-11dc-a709-001a4bd43ed6

Comment 2

[Martijn Wargers (dead)]

0  	_moz_cairo_scaled_font_status  	
1 	gfxASurface::GetType() 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\gfx\thebes\src\gfxasurface.cpp:199
2 	gfxWindowsNativeDrawing::BeginNativeDrawing() 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\gfx\thebes\src\gfxwindowsnativedrawing.cpp:87
3 	nsNativeThemeWin::ClassicDrawWidgetBackground(nsIRenderingContext*, nsIFrame*, unsigned char, nsRect const&, nsRect const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\widget\src\windows\nsnativethemewin.cpp:2013
4 	nsNativeThemeWin::DrawWidgetBackground(nsIRenderingContext*, nsIFrame*, unsigned char, nsRect const&, nsRect const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\widget\src\windows\nsnativethemewin.cpp:835
5 	nsCSSRendering::PaintBackgroundWithSC(nsPresContext*, nsIRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleBackground const&, nsStyleBorder const&, nsStylePadding const&, int, nsRect*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssrendering.cpp:3418
6 	nsCSSRendering::PaintBackground(nsPresContext*, nsIRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleBorder const&, nsStylePadding const&, int, nsRect*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssrendering.cpp:3302
7 	nsDisplayBackground::Paint(nsDisplayListBuilder*, nsIRenderingContext*, nsRect const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nsdisplaylist.cpp:532
8 	nsDisplayList::Paint(nsDisplayListBuilder*, nsIRenderingContext*, nsRect const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nsdisplaylist.cpp:292
9 	PresShell::RenderDocument(nsRect const&, int, int, unsigned int, gfxContext*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nspresshell.cpp:4790
10 	nsCanvasRenderingContext2D::DrawWindow(nsIDOMWindow*, int, int, int, int, nsAString_internal const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\canvas\src\nscanvasrenderingcontext2d.cpp:2344
11 	NS_InvokeByIndex_P 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp:101
12 	JS_SuspendRequest 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\jsapi.c:940
13 	@0x285fdef 	

Comment 3

[Peter van der Woude [:Peter6]]

I get it w/o the extension aswell

It seems to happen on pages that were zoomed in/out using ctrl++/ctrl+-.
These crashes seem random though, sometimes they occur, sometimes not.

http://crash-stats.mozilla.com/report/index/04a96517-411c-11dc-a03f-001a4bd43e5c

0  	_moz_cairo_scaled_font_status  	
1 	gfxASurface::GetType() 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\gfx\thebes\src\gfxasurface.cpp:199
2 	gfxWindowsNativeDrawing::BeginNativeDrawing() 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\gfx\thebes\src\gfxwindowsnativedrawing.cpp:87
3 	nsNativeThemeWin::ClassicDrawWidgetBackground(nsIRenderingContext*, nsIFrame*, unsigned char, nsRect const&, nsRect const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\widget\src\windows\nsnativethemewin.cpp:2013
4 	nsNativeThemeWin::DrawWidgetBackground(nsIRenderingContext*, nsIFrame*, unsigned char, nsRect const&, nsRect const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\widget\src\windows\nsnativethemewin.cpp:835
5 	nsCSSRendering::PaintBackgroundWithSC(nsPresContext*, nsIRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleBackground const&, nsStyleBorder const&, nsStylePadding const&, int, nsRect*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssrendering.cpp:3418
6 	nsCSSRendering::PaintBackground(nsPresContext*, nsIRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleBorder const&, nsStylePadding const&, int, nsRect*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssrendering.cpp:3302
7 	nsDisplayBackground::Paint(nsDisplayListBuilder*, nsIRenderingContext*, nsRect const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nsdisplaylist.cpp:532
8 	nsDisplayList::Paint(nsDisplayListBuilder*, nsIRenderingContext*, nsRect const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nsdisplaylist.cpp:292
9 	PresShell::RenderDocument(nsRect const&, int, int, unsigned int, gfxContext*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nspresshell.cpp:4790
10 	nsCanvasRenderingContext2D::DrawWindow(nsIDOMWindow*, int, int, int, int, nsAString_internal const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\canvas\src\nscanvasrenderingcontext2d.cpp:2344
11 	NS_InvokeByIndex_P 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp:101
12 	JS_SuspendRequest 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\jsapi.c:940
13 	ComputeThis 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\jsinterp.c:579
14 	PR_DestroyTrace 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\nsprpub\pr\src\misc\prtrace.c:348
15 	PR_Unlock 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\nsprpub\pr\src\threads\combined\prulock.c:355
16 	nsScriptSecurityManager::CheckPropertyAccessImpl(unsigned int, nsIXPCNativeCallContext*, JSContext*, JSObject*, nsISupports*, nsIURI*, nsIClassInfo*, char const*, long, void**) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\caps\src\nsscriptsecuritymanager.cpp:855
17 	js_Invoke 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\jsinterp.c:1378
18 	nsBaseHashtable<nsISupportsHashKey, nsTemplateMatch*, nsTemplateMatch*>::Put(nsISupports*, nsTemplateMatch*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\obj-fx-trunk\dist\include\xpcom\nsbasehashtable.h:145
19 	nsCycleCollectingAutoRefCnt::decr(nsISupports*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\obj-fx-trunk\dist\include\xpcom\nsisupportsimpl.h:162
20 	@0x12f6ef

Comment 4

[Frank Wein [:mcsmurf]]

Maybe also see Bug 390720 on this.

Comment 5

[Dão Gottwald [:dao]]

I crash with the extension at http://en.design-noir.de/mozilla/ctrl-tab/

http://crash-stats.mozilla.com/report/index/2e4a84a6-42e9-11dc-9ab0-001a4bd43ef6?date=2007-08-05-00

Comment 6

[WildcatRay]

From my post in the daily Trunk thread, re: these type crashes:

I just installed your Ctrl-Tab add-on and restarted Minefield. When I tried to use "Ctrl+Tab" to switch between different tabs, boom! Minefield crashed. Having just placed a copy of dbghelp.dll in my program folder I was able to get my first occasion of crash reporter. (I'm on Windoze 2000 OS.) My Trunk build is Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a8pre) Gecko/2007080505 Minefield/3.0a8pre ID:2007080505.

I will try to replicate the crash, but wanted to post this for your information.

Edited to add: Crash Report ID's with comments
http://crash-stats.mozilla.com/report/index/dd201cdc-4383-11dc-8a48-001a4bd46e84 (First)
http://crash-stats.mozilla.com/report/index/c8e735ee-4385-11dc-946e-001a4bd43ef6 (Second)
http://crash-stats.mozilla.com/report/index/1682d1e8-4386-11dc-a6b7-001a4bd43ef6 (with only Ctrl-Tab enabled)
http://crash-stats.mozilla.com/report/index/b4d0bb94-4386-11dc-ac08-001a4bd43ed6 (an additional one)
http://crash-stats.mozilla.com/report/index/798cfaf3-4386-11dc-943d-001a4bd46e84 (and another)

Hope this helps.

Comment 7

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: patch

Problem is that the win32 surface doesn't implement clone_similar, and so when we have to do a deep clone of the clip (which has a mask set, because we're clipping with a scale when we drawWindow), we blow up -- because there's no fallback from clone_similar.  SO, this implements that fallback.

Also adds some bulletproofing code so that we don't crash in this case if it's ever hit for some reason later on.

Waiting for review from cairo folks as well.

Comment 8

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Checked in.

Comment 9

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007080912 Minefield/3.0a8pre ID:2007080912

VERIFIED