Closed Bug 426369 Opened 16 years ago Closed 16 years ago

crash @ [_cairo_win32_surface_create_similar_internal]

Categories

(Core :: Graphics, defect, P2)

x86
Windows XP
defect

Tracking

()

VERIFIED FIXED

People

(Reporter: aha, Assigned: vlad)

References

()

Details

(Keywords: crash, regression, topcrash)

Previous crash bug report with this signature - bug 348644

Signature	_cairo_win32_surface_create_similar_internal	
UUID		f9d4aefd-0001-11dd-b1e3-001a4bd43ef6	
Time		2008-04-01 08:38:41-07:00	
Uptime		696	
Product		Firefox
Version		3.0pre	
Build ID	2008040106	
OS		Windows NT	
OS Version	5.1.2600 
Service Pack 	2	
CPU		x86	
CPU Info	GenuineIntel family 6 model 14 stepping 8	
Crash Reason	EXCEPTION_ACCESS_VIOLATION	
Crash Address	0x60b3fad0	

Firefox crashed on Opera DHTML performance test, when it has about 355 balls. I wasn't working with Firefox in time of crash. I didn't try to reproduce it.

Incident info:
http://crash-stats.mozilla.com/report/index/f9d4aefd-0001-11dd-b1e3-001a4bd43ef6
Myself and Littlemutt have both crashed today with similar stacks

http://crash-stats.mozilla.com/report/index/204f3a63-0006-11dd-a742-001a4bd43ef6
http://crash-stats.mozilla.com/report/index/bf09e8c7-0006-11dd-b562-001a4bd43e5c

Signature	_cairo_win32_surface_create_similar_internal
UUID	f9d4aefd-0001-11dd-b1e3-001a4bd43ef6
Time	2008-04-01 08:38:41-07:00
Uptime	696
Product	Firefox
Version	3.0pre
Build ID	2008040106
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 6 model 14 stepping 8
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x60b3fad0
Comments	http://people.opera.com/~pettern/performance-1.html around 355 balls

Frame  	Signature  	Source
0 	_cairo_win32_surface_create_similar_internal 	mozilla/gfx/cairo/cairo/src/cairo-win32-surface.c:413
1 	_cairo_win32_surface_create_similar 	mozilla/gfx/cairo/cairo/src/cairo-win32-surface.c:427
2 	_cairo_surface_create_similar_scratch 	mozilla/gfx/cairo/cairo/src/cairo-surface.c:239
3 	_cairo_surface_create_similar_solid 	mozilla/gfx/cairo/cairo/src/cairo-surface.c:322
4 	_moz_cairo_surface_create_similar 	mozilla/gfx/cairo/cairo/src/cairo-surface.c:305
5 	_moz_cairo_push_group_with_content 	mozilla/gfx/cairo/cairo/src/cairo.c:496
6 	gfxContext::PushGroup(gfxASurface::gfxContentType) 	mozilla/gfx/thebes/src/gfxContext.cpp:712
7 	xul.dll@0x2d6146 	
8 	nsWindow::ProcessMessage(unsigned int, unsigned int, long, long*) 	mozilla/widget/src/windows/nsWindow.cpp:4074
9 	nsWindow::WindowProc(HWND__*, unsigned int, unsigned int, long) 	mozilla/widget/src/windows/nsWindow.cpp:1188
10 	InternalCallWinProc 	
11 	UserCallWinProcCheckWow 	
12 	DispatchClientMessage 	
13 	__fnDWORD 	
14 	KiUserCallbackDispatcher 	
15 	nsParserService::CheckQName(nsAString_internal const&, int, unsigned short const**) 	
16 	DispatchMessageW 	
17 	nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, int, unsigned int) 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:278
18 	nsBaseAppShell::Release() 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:50
19 	nsBaseAppShell::Run() 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:170
20 	PR_GetEnv 	

For me and Jim, these crashes appear totally random. No crash in last night's nightly build, so this is a recent regression

Works: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008033105 Minefield/3.0pre ID:2008033105
Crashy: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008040106 Minefield/3.0pre ID:2008040106

Checkins to module PhoenixTinderbox between 2008-03-31 04:00 and 2008-04-01 07:00 :
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2008-03-31+04&maxdate=2008-04-01+07&cvsroot=%2Fcvsroot
Severity: normal → critical
Flags: blocking1.9?
Keywords: regression
Version: 1.8 Branch → Trunk
Status: UNCONFIRMED → NEW
Ever confirmed: true
Blocks: 382392
Confirming same issue here, regression is indeed very recent.
Here is a trace from devenv:

>	xul.dll!_cairo_win32_surface_create_similar_internal(void * abstract_src=0x002f0040, _cairo_content content=55, int width=116, int height=1622407664, int force_dib=0)  Line 413	C
 	xul.dll!_cairo_win32_surface_create_similar(void * abstract_src=0x063083a0, _cairo_content content=CAIRO_CONTENT_COLOR, int width=116, int height=18)  Line 427 + 0x18 bytes	C
 	xul.dll!_cairo_surface_create_similar_scratch(_cairo_surface * other=0x063083a0, _cairo_content content=CAIRO_CONTENT_COLOR, int width=116, int height=18)  Line 239 + 0x6 bytes	C
 	xul.dll!_cairo_surface_create_similar_solid(_cairo_surface * other=0x063083a0, _cairo_content content=CAIRO_CONTENT_COLOR, int width=116, int height=18, const _cairo_color * color=0x60b42910, _cairo_pattern * pattern=0x00000000)  Line 322 + 0x1b bytes	C
 	xul.dll!_moz_cairo_surface_create_similar(_cairo_surface * other=0x063083a0, _cairo_content content=CAIRO_CONTENT_COLOR, int width=116, int height=18)  Line 305 + 0x1e bytes	C
 	xul.dll!_moz_cairo_push_group_with_content(_cairo * cr=0x099c2c04, _cairo_content content=CAIRO_CONTENT_COLOR)  Line 496 + 0x21 bytes	C
 	xul.dll!gfxContext::PushGroup(gfxASurface::gfxContentType content=CONTENT_COLOR)  Line 712 + 0xc bytes	C++
 	xul.dll!__aulldiv()  + 0xa8df7 bytes	C++
 	xul.dll!nsWindow::ProcessMessage(unsigned int msg=15, unsigned int wParam=0, long lParam=0, long * aRetValue=0x0012f738)  Line 4074 + 0xb bytes	C++
 	xul.dll!nsWindow::WindowProc(HWND__ * hWnd=0x19741858, unsigned int msg=15, unsigned int wParam=0, long lParam=0)  Line 1188 + 0x15 bytes	C++
 	user32.dll!_InternalCallWinProc@20()  + 0x28 bytes	
 	user32.dll!_UserCallWinProcCheckWow@32()  + 0xb7 bytes	
 	user32.dll!_DispatchClientMessage@20()  + 0x4d bytes	
 	user32.dll!___fnDWORD@4()  + 0x24 bytes	
 	ntdll.dll!_KiUserCallbackDispatcher@12()  + 0x13 bytes	
 	user32.dll!_NtUserCallHwndLock@8()  + 0xc bytes	
 	xul.dll!nsWindow::DispatchStarvedPaints(HWND__ * aWnd=0x19741858, long aMsg=0)  Line 3883	C++
 	user32.dll!_InternalEnumWindows@24()  + 0x54 bytes	
 	user32.dll!_EnumChildWindows@12()  + 0x19 bytes	
 	xul.dll!nsWindow::DispatchPendingEvents()  Line 3917	C++
 	xul.dll!__aulldiv()  + 0xa9757 bytes	C++
 	xul.dll!nsWindow::WindowProc(HWND__ * hWnd=0x19741858, unsigned int msg=512, unsigned int wParam=0, long lParam=0)  Line 1188 + 0x15 bytes	C++
 	user32.dll!_InternalCallWinProc@20()  + 0x28 bytes	
 	user32.dll!_UserCallWinProcCheckWow@32()  + 0xb7 bytes	
 	user32.dll!_DispatchMessageWorker@8()  + 0xdc bytes	
 	user32.dll!_DispatchMessageW@4()  + 0xf bytes	
 	xul.dll!nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal * thr=0x604e64dc, int mayWait=23200324, unsigned int recursionDepth=3261152)  Line 296 + 0x29 bytes	C++
 	xul.dll!nsBaseAppShell::Release()  Line 50 + 0x10 bytes	C++
 	xul.dll!nsBaseAppShell::Run()  Line 169	C++
 	xul.dll!nsAppStartup::Run()  Line 182	C++
 	xul.dll!XRE_main(int argc=, char * * argv=, const nsXREAppData * aAppData=)  Line 3158	C++
 	mozcrt19.dll!arena_dalloc_small(arena_s * arena=0x00000040, arena_chunk_s * chunk=0x60006944, void * ptr=0x002f0040, unsigned int pageind=0, unsigned char mapelm=0)  Line 4017	C
 	mozcrt19.dll!arena_dalloc_small(arena_s * arena=0x002f0040, arena_chunk_s * chunk=0x00000000, void * ptr=0x00000044, unsigned int pageind=0, unsigned char mapelm=0)  Line 4017	C
 	mozcrt19.dll!arena_malloc(arena_s * arena=0x00000000, unsigned int size=0, int zero=0)  Line 3717 + 0x7 bytes	C
 	xul.dll!nsLocalFile::Release()  Line 753 + 0x13 bytes	C++
 	xul.dll!nsCOMPtr_base::~nsCOMPtr_base()  Line 82	C++
 	xul.dll!XRE_CreateAppData(nsILocalFile * aINIFile=0x00000001, nsXREAppData * * aAppData=0x003130a0)  Line 139	C++
 	firefox.exe!wmain(int argc=1, wchar_t * * argv=0x003160e0)  Line 87 + 0xe6 bytes	C++
 	firefox.exe!__tmainCRTStartup()  Line 591 + 0x19 bytes	C
 	kernel32.dll!_BaseProcessStart@4()  + 0x23 bytes	
Will be fixed by cairo upgrade; I think this is a dup, but can't find the existing bug at the moment.
Assignee: nobody → vladimir
Depends on: 419715
Flags: blocking1.9? → blocking1.9+
Priority: -- → P2
Looks like reed backed out bug 382392 to fix this bug.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008040110 Minefield/3.0pre ID:2008040110

Yes, no more crashes in the latest build.
Yeah I see the problem, so this is definitely fixed by backout.
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
I don't seem to be able to reach the Opera site right now, but I guess that wouldn't reproduce reliably anyway...
verified fixed using the testcase url and Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008041217 Minefield/3.0pre ID:2008041217

-> Verified fixed
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.