583496 - crash [@ nsTreeBodyFrame::PaintColumn(nsTreeColumn*, nsRect const&, nsPresContext*, nsIRenderingContext&, nsRect const&)]

Status: RESOLVED WORKSFORME

(Core :: XUL, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ nsTreeBodyFrame::PaintColumn(nsTreeColumn*, nsRect const&, nsPresContext*, nsIRenderingContext&, nsRect const&)]

#10 crash for Thunderbird v3.1.1, windows and Mac. I don't know where it falls for firefox.
sig does not exist in v3.0.x => regression
not comments with STR

bp-5d81245d-9ed3-4b06-955b-e6e2b2100719 (ghgemcutter)
0	thunderbird.exe	nsTreeBodyFrame::PaintColumn	 layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:2916
1	thunderbird.exe	nsTreeBodyFrame::PaintTreeBody	layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:2873
2	thunderbird.exe	PaintTreeBody	layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:2811
3	thunderbird.exe	nsDisplayGeneric::Paint	layout/base/nsDisplayList.h:968
4	thunderbird.exe	nsDisplayList::Paint	layout/base/nsDisplayList.cpp:405
5	thunderbird.exe	nsDisplayClip::Paint	layout/base/nsDisplayList.cpp:1200
6	thunderbird.exe	nsDisplayList::Paint	layout/base/nsDisplayList.cpp:405
7	thunderbird.exe	nsLayoutUtils::PaintFrame	layout/base/nsLayoutUtils.cpp:1145
8	thunderbird.exe	PresShell::Paint	layout/base/nsPresShell.cpp:5844
9	thunderbird.exe	nsViewManager::RenderViews	view/src/nsViewManager.cpp:533
10	thunderbird.exe	nsViewManager::Refresh	view/src/nsViewManager.cpp:492
11	thunderbird.exe	nsViewManager::DispatchEvent	view/src/nsViewManager.cpp:1008 


@0x0 | nsTreeBodyFrame::PaintColumn(nsTreeColumn*, nsRect const&, nsPresContext*, nsIRenderingContext&, nsRect const&) 
appears to be same crash, on Mac only
bp-5bf46caa-36cc-4663-b3ce-a08c92100729
0		@0x0	
1	thunderbird-bin	nsTreeBodyFrame::PaintColumn	layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:2915
2	thunderbird-bin	nsTreeBodyFrame::PaintTreeBody	layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:2873
3	thunderbird-bin	PaintTreeBody	layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:2811
4	thunderbird-bin	nsDisplayGeneric::Paint	layout/base/nsDisplayList.h:968
5	thunderbird-bin	nsDisplayClip::Paint	layout/base/nsDisplayList.cpp:405
6	thunderbird-bin	thunderbird-bin@0x2e286f	
7	thunderbird-bin	nsLayoutUtils::PaintFrame	layout/base/nsLayoutUtils.cpp:1161
8	thunderbird-bin	PresShell::Paint	layout/base/nsPresShell.cpp:5844

Comment 1

[Mason]

I think I've seen this stack in venkman-related crashes.

cf. bug 666277

bp-fc22b706-fcfa-4a9a-bfdc-d02c72110622  22/06/2011  18:04
bp-e631c4c4-3f6a-43ea-8150-9b96c2110622  22/06/2011  18:01

Comment 2

[Wayne Mery (:wsmwk)]

No TB5 or TB6 crashes. So something has made this go away for thunderbird - no longer appears as of TB v3.1.2.  The topcrashers were certainly not venkman related.

However, I don't know what the Firefox landscape has been like in the past.  FF now, is only 1 v4 and 1 v5 crash in the past month.
bp-7190fa5d-ea76-4456-8826-e55c32110825 is FF5

Comment 3

[Wayne Mery (:wsmwk)]

reconfirmed. TB crash is mostly gone after 3.1.2, and none for v5 or newer.

plenty of other treebody signatures though...but only one with PaintColumn and it's rare

nsTreeBodyFrame::PaintCell(int, nsTreeColumn*, nsRect const&, nsPresContext*, nsRenderingContext&, nsRect const&, int&, nsPoint)
nsTreeBodyFrame::PaintText(int, nsTreeColumn*, nsRect const&, nsPresContext*, nsRenderingContext&, nsRect const&, int&, int)
nsTreeBodyFrame::PaintTwisty(int, nsTreeColumn*, nsRect const&, nsPresContext*, nsRenderingContext&, nsRect const&, int&, int&)
nsTreeBodyFrame::PaintColumn(nsTreeColumn*, nsRect const&, nsPresContext*, nsRenderingContext&, nsRect const&)
nsTreeBodyFrame::PaintTreeBody(nsRenderingContext&, nsRect const&, nsPoint)
nsTreeBodyFrame::PaintBackgroundLayer(nsStyleContext*, nsPresContext*, nsRenderingContext&, nsRect const&, nsRect const&)
@0x0 | nsTreeBodyFrame::PaintTreeBody(nsRenderingContext&, nsRect const&, nsPoint)
nsTreeBodyFrame::PaintRow(int, nsRect const&, nsPresContext*, nsRenderingContext&, nsRect const&, nsPoint)
nsTreeBodyFrame::PaintImage(int, nsTreeColumn*, nsRect const&, nsPresContext*, nsRenderingContext&, nsRect const&, int&, int&)
@0x0 | nsTreeBodyFrame::PaintBackgroundLayer(nsStyleContext*, nsPresContext*, nsRenderingContext&, nsRect const&, nsRect const&)
@0x0 | nsTreeBodyFrame::PaintCell(int, nsTreeColumn*, nsRect const&, nsPresContext*, nsRenderingContext&, nsRect const&, int&, nsPoint)
nsRefPtr<nsTypedSelection>::~nsRefPtr<nsTypedSelection>() | nsTreeBodyFrame::PaintCheckbox(int, nsTreeColumn*, nsRect const&, nsPresContext*, nsRenderingContext&, nsRect const&)