Closed Bug 547230 Opened 14 years ago Closed 13 years ago

Scrolling causes crash [both mouse roller and vertical scroll bar] [@ PaintBackgroundLayer ]

Categories

(Core :: Web Painting, defect)

Product:
Core
Component:
Web Painting
Version:
1.9.2 Branch
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED INCOMPLETE

People

(Reporter: educmale, Unassigned)

References

(
URL
)

Details

(Keywords: crash, Whiteboard: [closeme 2011-05-21])

Crash Data

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)

I was tracking a crash, the 8:05 am crash:

bp-03d02247-ba9c-4c2c-9d49-5014e2100219	2/19/2010	8:21 AM
bp-57704675-dc59-4765-9df6-71b092100219	2/19/2010	8:14 AM
bp-2a02b654-09a8-43f3-b6f4-d88e62100219	2/19/2010	8:05 AM

I noticed the fault, EXCEPTION_ACCESS_VIOLATION, and searched it on google, and went to the Mozilla page which I note, above.   There, I started reading the page [during its rendition, though not sure if it may have completed], and a mouse scroll at 8 14 caused a crash.  I went back to the moz support page after the start up, and at 8 21 forced the crash, again, using the vert. scroll bar.  I had deliberately waited for rendition to complete, and to the best of my knowledge, it had.

I can -not- attribute the following to the crash, but many lines of this notation appear on the error console:

     Warning: Expected declaration but found '*'.  Skipped to next declaration.
Source File: http://support.mozilla.com/minify.php/css_styles_mozcommon;css_styles_mozfr
Line: 1

Reproducible: Sometimes




The crash occurs in standard mode, I have not duplicated this, yet, in safe mode.  I am using the startup profile, not a new one.

This pattern of crash occurs frequently enough to annoy, where I scroll and a crash occurs.   These crashes occur with both a mouse scroll and a vertical bar scroll.  This is not a constant thing, but happens now and then during the day.   Has happened in prior Fox versions, as a problem that appeared with new version [sorry can't be specific right now].   No other software has a scroll-associated crash.   

Prior bug filed in this Fox version as Bug 546859.   
Bug report Prior Ver 3.0.8 https://bugzilla.mozilla.org/show_bug.cgi?id=486232 -- this bug reported wide range of crash type, including the scrolling.   My current intuitive sense is now this is a rendition problem, which scrolling catches more often, and sometimes just happens without scrolling.
So you are saying this is the same as bug 486232, just more details? Or what?

Also, you say this doesn't happen in safe mode? try a new profile then to double check.
Keywords: crash
Summary: Scrolling causes crash [both mouse roller and vertical scroll bar] → Scrolling causes crash [both mouse roller and vertical scroll bar] [@ PaintBackgroundLayer ]
Version: unspecified → 3.6 Branch
On filing the above bug report, I closed all Fox tabs/windows except the support page, and closed yahoo/aim, and then went to the support page.   Scrolled.   Crashed at 8:57am.   

Then opened in SAFE MODE, and that support page loaded fine, and appeared happy with scrolling, and then used the scroll bar, and scrolled up/down, dragging the bar at .75-1 sec intervals, and it crashed at 9:01am

SAFE MODE CRASH:
bp-095fa8dd-9cd4-456e-841c-7c6ca2100219	2/19/2010	9:01 AM

Another Std Mode crash:
bp-d44d136f-8b7e-4cb7-97ec-218582100219	2/19/2010	8:57 AM

-------------------
Additional Info on Error Console:
No new errors related to the support page that caused the crash
However, these two sets of errors show in two repeated piles:

     Warning: Error in parsing value for 'white-space'.  Declaration dropped.
Source File: https://bugzilla.mozilla.org/skins/standard/global.css
Line: 278 [and 7, 278-280, etc., also for calendar.css at line 7]
     Warning: Unknown property 'zoom'.  Declaration dropped.
Source File: http://crash-stats.mozilla.com/css/screen.css
Line: 15 [many at 15, and one at Line 1222]
     and 4 or so for flora.tabs.css and datepicker.
And now, on thinking, Bug 546859 has the same user feel for the crash [scrolling], except the crash occurred in the layout tables, not the painting background.   For that reason, I started another bug.   Was this an error, and should it be the same bug or a different one?
Signature	PaintBackgroundLayer
UUID	095fa8dd-9cd4-456e-841c-7c6ca2100219
Time 	2010-02-19 07:01:49.200620
Uptime	39
Last Crash	233 seconds before submission
Product	Firefox
Version	3.6
Build ID	20100115144158
Branch	1.9.2
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 15 model 2 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x5146589c
User Comments	
Processor Notes 	
Related Bugs

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	PaintBackgroundLayer 	layout/base/nsCSSRendering.cpp:2472
1 	xul.dll 	nsCSSRendering::PaintBackgroundWithSC 	layout/base/nsCSSRendering.cpp:2194
2 	xul.dll 	nsDisplayBackground::Paint 	layout/base/nsDisplayList.cpp:716
3 	xul.dll 	nsDisplayList::Paint 	layout/base/nsDisplayList.cpp:405
4 	xul.dll 	nsDisplayClip::Paint 	layout/base/nsDisplayList.cpp:1200
5 	xul.dll 	nsLayoutUtils::PaintFrame 	layout/base/nsLayoutUtils.cpp:1145
6 	xul.dll 	PresShell::Paint 	layout/base/nsPresShell.cpp:5839
7 	xul.dll 	nsViewManager::RenderViews 	view/src/nsViewManager.cpp:533
8 	xul.dll 	nsViewManager::Refresh 	view/src/nsViewManager.cpp:492
9 	xul.dll 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:1008
10 	xul.dll 	HandleEvent 	view/src/nsView.cpp:167
11 	xul.dll 	nsWindow::DispatchEvent 	widget/src/windows/nsWindow.cpp:2952
12 	xul.dll 	nsWindow::DispatchWindowEvent 	widget/src/windows/nsWindow.cpp:2985
13 	xul.dll 	nsWindow::OnPaint 	widget/src/windows/nsWindowGfx.cpp:517
14 	xul.dll 	nsWindow::ProcessMessage 	widget/src/windows/nsWindow.cpp:3887
15 	xul.dll 	nsWindow::WindowProc 	widget/src/windows/nsWindow.cpp:3587
16 	user32.dll 	InternalCallWinProc 	
17 	user32.dll 	UserCallWinProcCheckWow 	
18 	user32.dll 	DispatchClientMessage 	
19 	user32.dll 	__fnDWORD 	
20 	ntdll.dll 	KiUserCallbackDispatcher 	
21 	xul.dll 	nsGenericDOMDataNode::cycleCollection::RootAndUnlinkJSObjects 	
22 	xul.dll 	nsWindow::Update 	widget/src/windows/nsWindow.cpp:2126
23 	mozcrt19.dll 	arena_dalloc 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:4227
24 	xul.dll 	nsViewManager::Composite 	view/src/nsViewManager.cpp:587
25 	xul.dll 	nsViewManager::UpdateViewAfterScroll 	view/src/nsViewManager.cpp:690
26 	xul.dll 	nsScrollPortView::Scroll 	view/src/nsScrollPortView.cpp:717
27 	xul.dll 	nsScrollPortView::ScrollToImpl 	
28 	xul.dll 	nsScrollPortView::ScrollTo 	view/src/nsScrollPortView.cpp:243
29 	xul.dll 	nsGfxScrollFrameInner::ScrollbarChanged 	layout/generic/nsGfxScrollFrame.cpp:2629
30 	xul.dll 	nsGfxScrollFrameInner::CurPosAttributeChanged 	
31 	xul.dll 	nsXULScrollFrame::CurPosAttributeChanged 	layout/generic/nsGfxScrollFrame.cpp:1285
32 	xul.dll 	nsScrollbarFrame::AttributeChanged 	layout/xul/base/src/nsScrollbarFrame.cpp:140
33 	xul.dll 	nsCSSFrameConstructor::AttributeChanged 	layout/base/nsCSSFrameConstructor.cpp:8128
34 	xul.dll 	PresShell::AttributeChanged 	layout/base/nsPresShell.cpp:5012
35 	xul.dll 	nsNodeUtils::AttributeChanged 	content/base/src/nsNodeUtils.cpp:124
36 	xul.dll 	nsGenericElement::SetAttrAndNotify 	content/base/src/nsGenericElement.cpp:4372
37 	xul.dll 	nsGenericElement::SetAttr 	content/base/src/nsGenericElement.cpp:4305
38 	xul.dll 	nsString::AppendInt 	xpcom/string/src/nsStringObsolete.cpp:1217
39 		@0x10010 	
40 	js3250.dll 	MonthFromTime 	js/src/jsdate.cpp:241
41 	xul.dll 	SearchTable 	obj-firefox/xpcom/build/pldhash.c:472
42 	xul.dll 	nsRuleNode::GetStylePadding 	layout/style/nsStyleStructList.h:132
43 	xul.dll 	nsSliderFrame::SetCurrentPositionInternal 	layout/xul/base/src/nsSliderFrame.cpp:836
44 	xul.dll 	nsSliderFrame::SetCurrentPosition 	layout/xul/base/src/nsSliderFrame.cpp:800
45 	xul.dll 	nsSliderFrame::SetCurrentThumbPosition 	layout/xul/base/src/nsSliderFrame.cpp:771
46 	xul.dll 	nsSliderFrame::HandleEvent 	layout/xul/base/src/nsSliderFrame.cpp:516
Component: General → Layout: View Rendering
Product: Firefox → Core
QA Contact: general → layout.view-rendering
Version: 3.6 Branch → 1.9.2 Branch
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.2pre) Gecko/20100217 Namoroka/3.6.2pre

I tested this quite some times even with Tab Mix Plus installed, but was not able to reproduce.
I respect that, but do note that this is not a constant problem; it behaves [there error] almost like there is a timing issue....  i.e.: If I scroll just at the right time, or a secondary page updates in the background that has helper applications embedded on the page [eg: NYTimes.Com].   As I've said, sometimes, I am doing nothing... [other than reading a page which is not scrolling.]
That stack reentering event processing under frame code doesn't look very happy to me....
That's what, Boris ?  I'm curious.
[" stack reentering event processing under frame code "]
roughly frames 38/39/40 and 19/20/21 are strange. the minidump is available, so someone can ask windbg for more info...
The synchronously-notifying update of 'curpos' in UpdateAttribute is probably causing the problem here. Probably need to do it off a scriptrunner. Maybe Mats can look at it...
Robert....   Would you hazard a translation?   I'm curious.

Though I am an engr. by background, I've no inside experience with the specifics of the Fox engine...

Are you saying that there is a timing issue, here?   If so, would you think that whatever style of programming that allowed that type error ... exists in the style of other parts of the Fox engine?  Though my programming experience is low, presently, in days past, timing issues and software did catch my attention.  And I've mentioned my intuitive sense that such a thing is an issue, with Fox, in prior bugs I've posted.
It's not really a timing issue. The issue is that certain kinds of synchronous (notifying) DOM changes are unsafe when executed by certain object methods (methods of ns*Frame classes, typically) because those synchronous notifications can result in destruction of ns*Frame objects.
My sense of what you're saying still aligns with me intuitively -- in that it sounds like you have object methods kill their underlying objects ungracefully.  Constructed the phrasing like that [do I have it right?] still implies that there are a broad range of methods that might operate like that, outside of expected behavior, and that there could be a reason to hunt them down....
Do you still see this crash? 

there are no PaintBackgroundLayer crashes for version 4 since 4.0b8 20101214170338.
Whiteboard: [closeme 2011-05-21]
No response to requested information. Closing as incomplete report.
Status: UNCONFIRMED → RESOLVED
Closed: 13 years ago
Resolution: --- → INCOMPLETE
Crash Signature: [@ PaintBackgroundLayer ]
Windows xp sp3, INTEl P4 3.2GHZ, 4GB Ram, Intel Perl865 Mother Board. Using FF 16.02 and clicking on the verical scrool bar, using the key board arrow keys or the page up/ down causes a shut down of of my PC and corruption of disk files files as reported by Windows checking disk after unctrolled shut down. This event is potentially damaging to disk since its flying heads do not have a chance to park. Becuse of this I have not done many of the TS steps requested. 
I have removed FF 16.02, reloaded 3.2.6.2 and it works fine. In addition IE 9 works fine on the same web pages
Reinstalled Windows xp sp3 and Fire Fox 16.02 has no crashes now when using the vertical scroll bars
Component: Layout: View Rendering → Layout: Web Painting
You need to log in before you can comment on or make changes to this bug.