Closed Bug 526216 Opened 15 years ago Closed 15 years ago

mochitest-browser-chrome: crash [@ nsObjectFrame::IsOpaque() const ] while running browser_pluginnotification.js

Categories

(Core Graveyard :: Plug-ins, defect)

defect
Not set
critical

Tracking

(status1.9.2 .4-fixed)

RESOLVED FIXED
mozilla1.9.3a1
Tracking Status
status1.9.2 --- .4-fixed

People

(Reporter: MatsPalmgren_bugz, Assigned: roc)

References

Details

(Keywords: crash, intermittent-failure, Whiteboard: [fixed-lorentz])

Crash Data

Attachments

(1 file)

mochitest-browser-chrome: crash in nsObjectFrame::IsOpaque() while running browser_pluginnotification.js.

WINNT 5.2 mozilla-central test opt everythingelse on 2009/11/03 04:24:31
http://tinderbox.mozilla.org/showlog.cgi?tree=Firefox-Unittest&errorparser=unittest&logfile=1257251071.1257252568.5519.gz&buildtime=1257251071&buildname=WINNT%205.2%20mozilla-central%20test%20opt%20everythingelse&fulltext=1#err1


Thread 0 (crashed)
 0 nsObjectFrame::IsOpaque()
 1 nsDisplayPlugin::IsOpaque(nsDisplayListBuilder *)
 2 nsDisplayList::ComputeVisibility(nsDisplayListBuilder *, ...)
 3 nsDisplayClip::ComputeVisibility(nsDisplayListBuilder *, ...)
 4 nsDisplayList::ComputeVisibility(nsDisplayListBuilder *, ...)
 5 nsLayoutUtils::PaintFrame(nsIRenderingContext *,nsIFrame *, ...)
 6 PresShell::Paint(nsIView *,nsIRenderingContext *, ...)
 7 nsViewManager::RenderViews(nsView *,nsIRenderingContext &, ...)
 8 nsViewManager::Refresh(nsView *,nsIRenderingContext *, ...)
 9 nsViewManager::DispatchEvent(nsGUIEvent *,nsIView *,nsEventStatus *)
10 HandleEvent
11 nsWindow::DispatchEvent(nsGUIEvent *,nsEventStatus &)
12 nsWindow::DispatchWindowEvent(nsGUIEvent *,nsEventStatus &)
13 nsWindow::OnPaint(HDC__ *)
Whiteboard: [orange]
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1257692110.1257693643.818.gz
WINNT 5.2 mozilla-central opt test everythingelse on 2009/11/08 06:55:10
Blocks: 438871
Version: unspecified → Trunk
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1258075403.1258079561.6199.gz
Linux mozilla-central opt test everythingelse on 2009/11/12 17:23:23
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1258078491.1258080780.19670.gz
WINNT 5.2 mozilla-central opt test everythingelse on 2009/11/12 18:14:51
OS: Windows NT → All
Hardware: x86 → All
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1258410548.1258412853.21733.gz
WINNT 5.2 mozilla-central opt test everythingelse on 2009/11/16 14:29:08
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1259041788.1259043567.18467.gz
WINNT 5.2 mozilla-central opt test everythingelse on 2009/11/23 21:49:48
Component: Layout → Plug-ins
QA Contact: layout → plugins
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1259506300.1259508050.17766.gz#err1
WINNT 5.2 mozilla-central opt test everythingelse on 2009/11/29 06:51:40
Summary: mochitest-browser-chrome: crash in nsObjectFrame::IsOpaque() while running browser_pluginnotification.js → mochitest-browser-chrome: crash [@nsObjectFrame::IsOpaque() const ] while running browser_pluginnotification.js
Only found one instance on crash-stats:
e936158c-71ff-43aa-9cf7-a1ebd2091126
Summary: mochitest-browser-chrome: crash [@nsObjectFrame::IsOpaque() const ] while running browser_pluginnotification.js → mochitest-browser-chrome: crash [@ nsObjectFrame::IsOpaque() const ] while running browser_pluginnotification.js
This might just possibly be related to some of the unexplained display-list crashes on 3.6. I may be able to reproduce it in our VMWare recorder.
Assignee: nobody → roc
Flags: wanted1.9.2?
Chris P, could you set up our recorder VM to run this browser-chrome test over and over?
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260280945.1260283003.6759.gz
WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/08 06:02:25
s: moz2-win32-slave19
I ran this on our test machine 2900 times and wasn't able to reproduce :-(
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260606192.1260608189.15417.gz#err0
WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/12 00:23:12  
s: win32-slave42
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260629381.1260631163.19818.gz
WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/12 06:49:41
s: win32-slave34
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260618385.1260620153.19909.gz
WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/12 03:46:25
s: win32-slave37
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260666211.1260668272.9787.gz
WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/12 17:03:31
s: win32-slave19
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260737447.1260740049.14193.gz
WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/13 12:50:47
s: win32-slave42
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260757183.1260759111.28067.gz
WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/13 18:19:43
s: win32-slave37
roc: I'll note that this only appears to manifest in opt builds, which means it might be sensitive to the optimization (perhaps even the PGO). You might try with a Windows nightly build. Debugging will suck, but it might be reproducible.
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260801290.1260803861.13239.gz
WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/14 06:34:50
s: win32-slave12
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260876307.1260878107.29605.gz
WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/15 03:25:07  
s: win32-slave40
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1260994686.1261000042.3746.gz&fulltext=1#err1
WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/16 12:18:06
s: win32-slave23
I got this in record/replay. The test is disabling some plugin, which kills off all the active instances. But the nsObjectFrame doesn't go away immediately, so we try to paint but in nsObjectFrame::IsOpaque the instance we get from GetInstance is null, and we crash.
When plugins crash in e10s we currently also do SetInstance(NULL).
Attached patch fixSplinter Review
Adds the required null-check and cleans up this function a bit.
Attachment #418077 - Flags: review?(joshmoz)
Whiteboard: [orange] → [orange][needs review]
Comment on attachment 418077 [details] [diff] [review]
fix

Excellent, thanks!
Attachment #418077 - Flags: review?(joshmoz) → review+
Whiteboard: [orange][needs review] → [orange][needs landing]
Josh, you might want to audit to ensure that mInstance and GetInstance calls have appropriate null checks.
http://hg.mozilla.org/mozilla-central/rev/1eb1763c6540
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9.3a1
Should this go on the 1.9.2 branch? We don't null check the result of mInstanceOwner->GetWindow there but the guarantees might be different.
Whiteboard: [orange][needs landing] → [orange]
http://hg.mozilla.org/projects/firefox-lorentz/rev/32a2e349d7cf
Whiteboard: [orange] → [orange][fixed-lorentz]
Note, I had to commit a followup merge fix for nsObjectFrame in Lorentz: on the branch nsIPluginInstance doesn't have IsTransparent. roc/josh, please check this!

http://hg.mozilla.org/projects/firefox-lorentz/rev/ac75b6aa99a4
Blanket approval for Lorentz merge to mozilla-1.9.2
a=beltzner for 1.9.2.4 - please make sure to mark status1.9.2:.4-fixed
Is this just verified by browser_pluginnotification.js running correctly?
Depends on: 558434
Crash Signature: [@ nsObjectFrame::IsOpaque() const ]
Whiteboard: [orange][fixed-lorentz] → [fixed-lorentz]
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: