crash [@ gfxASurface::GetType (_moz_cairo_scaled_font_status)] with Tab Sidebar installed

VERIFIED FIXED

Status

()

Core
Graphics
--
critical
VERIFIED FIXED
11 years ago
7 years ago

People

(Reporter: Peter6, Assigned: vlad)

Tracking

({crash, regression})

Trunk
x86
Windows XP
crash, regression
Points:
---
Bug Flags:
blocking1.9 +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

11 years ago
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a7pre) Gecko/2007080204 Minefield/3.0a7pre ID:2007080204

repro:
Install TabSidebar (latest @ http://www.oxymoronical.com/web/firefox/TabSidebar/development )
restart and press ctrl+shift+e (to get the TabPreview sidebar)
Open http://tinderbox.mozilla.org/showbuilds.cgi?tree=Firefox

result:
The page loads and displays... untill the final reflow when it crashes FF

this regressed after Cairo 1.5 landed

breakpad: 5e38c0fd-4119-11dc-a709-001a4bd43ed6
(Reporter)

Updated

11 years ago
Blocks: 383960
0  	_moz_cairo_scaled_font_status  	
1 	gfxASurface::GetType() 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\gfx\thebes\src\gfxasurface.cpp:199
2 	gfxWindowsNativeDrawing::BeginNativeDrawing() 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\gfx\thebes\src\gfxwindowsnativedrawing.cpp:87
3 	nsNativeThemeWin::ClassicDrawWidgetBackground(nsIRenderingContext*, nsIFrame*, unsigned char, nsRect const&, nsRect const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\widget\src\windows\nsnativethemewin.cpp:2013
4 	nsNativeThemeWin::DrawWidgetBackground(nsIRenderingContext*, nsIFrame*, unsigned char, nsRect const&, nsRect const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\widget\src\windows\nsnativethemewin.cpp:835
5 	nsCSSRendering::PaintBackgroundWithSC(nsPresContext*, nsIRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleBackground const&, nsStyleBorder const&, nsStylePadding const&, int, nsRect*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssrendering.cpp:3418
6 	nsCSSRendering::PaintBackground(nsPresContext*, nsIRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleBorder const&, nsStylePadding const&, int, nsRect*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssrendering.cpp:3302
7 	nsDisplayBackground::Paint(nsDisplayListBuilder*, nsIRenderingContext*, nsRect const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nsdisplaylist.cpp:532
8 	nsDisplayList::Paint(nsDisplayListBuilder*, nsIRenderingContext*, nsRect const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nsdisplaylist.cpp:292
9 	PresShell::RenderDocument(nsRect const&, int, int, unsigned int, gfxContext*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nspresshell.cpp:4790
10 	nsCanvasRenderingContext2D::DrawWindow(nsIDOMWindow*, int, int, int, int, nsAString_internal const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\canvas\src\nscanvasrenderingcontext2d.cpp:2344
11 	NS_InvokeByIndex_P 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp:101
12 	JS_SuspendRequest 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\jsapi.c:940
13 	@0x285fdef 	
Severity: normal → critical
Keywords: crash
Summary: crash with Tab Sidebar installed → crash [@ _moz_cairo_scaled_font_status] with Tab Sidebar installed
(Reporter)

Comment 3

11 years ago
I get it w/o the extension aswell

It seems to happen on pages that were zoomed in/out using ctrl++/ctrl+-.
These crashes seem random though, sometimes they occur, sometimes not.

http://crash-stats.mozilla.com/report/index/04a96517-411c-11dc-a03f-001a4bd43e5c

0  	_moz_cairo_scaled_font_status  	
1 	gfxASurface::GetType() 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\gfx\thebes\src\gfxasurface.cpp:199
2 	gfxWindowsNativeDrawing::BeginNativeDrawing() 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\gfx\thebes\src\gfxwindowsnativedrawing.cpp:87
3 	nsNativeThemeWin::ClassicDrawWidgetBackground(nsIRenderingContext*, nsIFrame*, unsigned char, nsRect const&, nsRect const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\widget\src\windows\nsnativethemewin.cpp:2013
4 	nsNativeThemeWin::DrawWidgetBackground(nsIRenderingContext*, nsIFrame*, unsigned char, nsRect const&, nsRect const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\widget\src\windows\nsnativethemewin.cpp:835
5 	nsCSSRendering::PaintBackgroundWithSC(nsPresContext*, nsIRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleBackground const&, nsStyleBorder const&, nsStylePadding const&, int, nsRect*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssrendering.cpp:3418
6 	nsCSSRendering::PaintBackground(nsPresContext*, nsIRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleBorder const&, nsStylePadding const&, int, nsRect*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssrendering.cpp:3302
7 	nsDisplayBackground::Paint(nsDisplayListBuilder*, nsIRenderingContext*, nsRect const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nsdisplaylist.cpp:532
8 	nsDisplayList::Paint(nsDisplayListBuilder*, nsIRenderingContext*, nsRect const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nsdisplaylist.cpp:292
9 	PresShell::RenderDocument(nsRect const&, int, int, unsigned int, gfxContext*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nspresshell.cpp:4790
10 	nsCanvasRenderingContext2D::DrawWindow(nsIDOMWindow*, int, int, int, int, nsAString_internal const&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\canvas\src\nscanvasrenderingcontext2d.cpp:2344
11 	NS_InvokeByIndex_P 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp:101
12 	JS_SuspendRequest 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\jsapi.c:940
13 	ComputeThis 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\jsinterp.c:579
14 	PR_DestroyTrace 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\nsprpub\pr\src\misc\prtrace.c:348
15 	PR_Unlock 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\nsprpub\pr\src\threads\combined\prulock.c:355
16 	nsScriptSecurityManager::CheckPropertyAccessImpl(unsigned int, nsIXPCNativeCallContext*, JSContext*, JSObject*, nsISupports*, nsIURI*, nsIClassInfo*, char const*, long, void**) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\caps\src\nsscriptsecuritymanager.cpp:855
17 	js_Invoke 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\jsinterp.c:1378
18 	nsBaseHashtable<nsISupportsHashKey, nsTemplateMatch*, nsTemplateMatch*>::Put(nsISupports*, nsTemplateMatch*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\obj-fx-trunk\dist\include\xpcom\nsbasehashtable.h:145
19 	nsCycleCollectingAutoRefCnt::decr(nsISupports*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\obj-fx-trunk\dist\include\xpcom\nsisupportsimpl.h:162
20 	@0x12f6ef

Comment 4

11 years ago
Maybe also see Bug 390720 on this.

Comment 6

11 years ago
From my post in the daily Trunk thread, re: these type crashes:

I just installed your Ctrl-Tab add-on and restarted Minefield. When I tried to use "Ctrl+Tab" to switch between different tabs, boom! Minefield crashed. Having just placed a copy of dbghelp.dll in my program folder I was able to get my first occasion of crash reporter. (I'm on Windoze 2000 OS.) My Trunk build is Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a8pre) Gecko/2007080505 Minefield/3.0a8pre ID:2007080505.

I will try to replicate the crash, but wanted to post this for your information.

Edited to add: Crash Report ID's with comments
http://crash-stats.mozilla.com/report/index/dd201cdc-4383-11dc-8a48-001a4bd46e84 (First)
http://crash-stats.mozilla.com/report/index/c8e735ee-4385-11dc-946e-001a4bd43ef6 (Second)
http://crash-stats.mozilla.com/report/index/1682d1e8-4386-11dc-a6b7-001a4bd43ef6 (with only Ctrl-Tab enabled)
http://crash-stats.mozilla.com/report/index/b4d0bb94-4386-11dc-ac08-001a4bd43ed6 (an additional one)
http://crash-stats.mozilla.com/report/index/798cfaf3-4386-11dc-943d-001a4bd46e84 (and another)

Hope this helps.

Updated

11 years ago
Flags: blocking1.9?
Assignee: nobody → vladimir
Flags: blocking1.9? → blocking1.9+
Summary: crash [@ _moz_cairo_scaled_font_status] with Tab Sidebar installed → crash [@ gfxASurface::GetType (_moz_cairo_scaled_font_status)] with Tab Sidebar installed
Created attachment 275565 [details] [diff] [review]
patch

Problem is that the win32 surface doesn't implement clone_similar, and so when we have to do a deep clone of the clip (which has a mask set, because we're clipping with a scale when we drawWindow), we blow up -- because there's no fallback from clone_similar.  SO, this implements that fallback.

Also adds some bulletproofing code so that we don't crash in this case if it's ever hit for some reason later on.

Waiting for review from cairo folks as well.
Attachment #275565 - Flags: review?(pavlov)

Updated

11 years ago
Attachment #275565 - Flags: review?(pavlov) → review+
Checked in.
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
(Reporter)

Comment 9

11 years ago
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007080912 Minefield/3.0a8pre ID:2007080912

VERIFIED
Status: RESOLVED → VERIFIED
Crash Signature: [@ gfxASurface::GetType (_moz_cairo_scaled_font_status)]
You need to log in before you can comment on or make changes to this bug.