593511 - Firefox Crash [@ nsDisplayText::Paint(nsDisplayListBuilder*, nsIRenderingContext*) ]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[chris hofmann]

looks like a bug with this signature was tracked as bug 546745 and maybe fixed in bugs 540692 and 541924 eariler this year.

The same signature but probably different bug is showing up again on 3.6.x, and even higher rate on 4.0betas when you consider the size of the user population/total crash count.

checking --- nsDisplayText::Paint.nsDisplayListBuilder. 20100902-crashdata.csv
found in: 3.6.8 4.0b4 3.6.9 3.6.6 4.0b6pre 3.7a2 4.0b5pre 4.0b5 3.6.7 3.6.4 3.6.3
release total-crashes
              nsDisplayText::Paint.nsDisplayListBuilder. crashes
                         pct.
all     293501  276     0.000940372
3.6.8   183658  151     0.00082218
4.0b4   22306   100     0.0044831
3.6.9   9716    8       0.000823384
3.6.6   7964    8       0.00100452
4.0b6pre        872     2       0.00229358
3.7a2   226     2       0.00884956
4.0b5pre        862     1       0.00116009
4.0b5   143     1       0.00699301
3.6.7   1357    1       0.00073692
3.6.4   3276    1       0.00030525
3.6.3   11367   1       8.7974e-05

stack looks like

Frame  	Module  	Signature [Expand]  	Source
0 	xul.dll 	nsDisplayText::Paint 	layout/generic/nsTextFrameThebes.cpp:3961
1 	xul.dll 	mozilla::FrameLayerBuilder::DrawThebesLayer 	layout/base/FrameLayerBuilder.cpp:1436
2 	xul.dll 	mozilla::layers::BasicThebesLayer::PaintBuffer 	gfx/layers/basic/BasicLayers.cpp:329
3 	xul.dll 	mozilla::layers::BasicThebesLayer::Paint 	gfx/layers/basic/BasicLayers.cpp:410
4 	xul.dll 	mozilla::layers::BasicLayerManager::PaintLayer 	gfx/layers/basic/BasicLayers.cpp:1058
5 	xul.dll 	mozilla::layers::BasicLayerManager::PaintLayer 	gfx/layers/basic/BasicLayers.cpp:1066
6 	xul.dll 	mozilla::layers::BasicLayerManager::EndTransaction 	gfx/layers/basic/BasicLayers.cpp:966
7 	xul.dll 	nsDisplayList::PaintForFrame 	layout/base/nsDisplayList.cpp:395
8 	xul.dll 	nsLayoutUtils::PaintFrame 	layout/base/nsLayoutUtils.cpp:1406
9 	xul.dll 	PresShell::Paint 	layout/base/nsPresShell.cpp:5934
10 	xul.dll 	nsViewManager::RenderViews 	view/src/nsViewManager.cpp:459
11 	xul.dll 	nsViewManager::Refresh 	view/src/nsViewManager.cpp:425
12 	xul.dll 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:912
13 	xul.dll 	HandleEvent 	view/src/nsView.cpp:160
14 	xul.dll 	nsWindow::DispatchEvent 	widget/src/windows/nsWindow.cpp:3458
15 	xul.dll 	nsWindow::DispatchWindowEvent 	widget/src/windows/nsWindow.cpp:3486
16 	xul.dll 	nsWindow::OnPaint 	widget/src/windows/nsWindowGfx.cpp:563
17 	xul.dll 	nsWindow::ProcessMessage 	widget/src/windows/nsWindow.cpp:4661
18 	xul.dll 	nsWindow::WindowProcInternal 	widget/src/windows/nsWindow.cpp:4251
19 	xul.dll 	nsWindow::WindowProc 	widget/src/windows/nsWindow.cpp:4206
20 	user32.dll 	InternalCallWinProc 	
21 	user32.dll 	UserCallWinProcCheckWow 	
22 	user32.dll 	DispatchClientMessage 	
23 	user32.dll 	__fnDWORD 	
24 	ntdll.dll 	KiUserCallbackDispatcher 	
25 	xul.dll 	nsWindow::DealWithPopups 	widget/src/windows/nsWindow.cpp:8084
26 	user32.dll 	DispatchMessageW 	
27 	xul.dll 	nsBaseAppShell::OnProcessNextEvent 	widget/src/xpwidgets/nsBaseAppShell.cpp:294
28 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:517
29 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:118
30 	xul.dll 	xul.dll@0xb7a45b 	
31 	xul.dll 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:219
32 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:202
33 	xul.dll 	_SEH_epilog4 	
34 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:176
35 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:175
36 	xul.dll 	nsAppShell::Run 	widget/src/windows/nsAppShell.cpp:243

more reports at

http://crash-stats.mozilla.com/report/list?signature=nsDisplayText%3A%3APaint%28nsDisplayListBuilder*%2C%20nsIRenderingContext*%29

a lot of the comments appear to be in German.

could this be a shifting around of code due to layers landing and maybe another dup of or connected to work planned for bug 593301?

Comment 1

[chris hofmann]

top crashing urls are

   9 http://www.chatroulette.com/
   8 http://chatroulette.com/
   4 http://fr.massivetriviaquiz.com/games
   3 https://webtop.webmail.optimum.net/cerulean/
   3 http://web.de/fm/
   3 http://love.rambler.ru/my/messages.phtml?
   3 http://love.mail.ru/my/messages.phtml?
   3 http://en.massivemusicquiz.com/games/category_change
   2 http://www.juventus.com/site/ita/TAS_primasquadra.asp
   2 http://mamba.ru/my/messages.phtml?

Comment 2

[chris hofmann]

#12 non-plugin related crash in 4.0b4

Comment 3

[chris hofmann]

very strange pattern in the crash volume on this.

for july and august the current 3.6.x release seems to consistently show about 100-150 crashes per day.

but for 4.0betas it first appeared in high volume on august 9 in 4.0b4pre, and remained high volume until aug 22 when it appeared it might be fixed in 4.0b4pre.    then it returned in increasing volume as 4.0b4 gained users.

date    total  , tl  release, tl release, ....

20100807 157   , 145 3.6.8 , 7 3.6.6 , 2 3.7a2 , 2 3.6.3 , 1 3.6.4 ,
20100808 176   , 152 3.6.8 , 16 3.6.6 , 4 3.7a2 , 2 3.6.7 , 2 3.6.3 ,
20100809 235   , 146 3.6.8 , 60 4.0b4pre , 9 3.6.6 , 6 3.7a2 , 4 3.6.4 ,
20100810 252   , 141 3.6.8 , 87 4.0b4pre , 8 3.6.6 , 6 3.6.3 , 3 3.6.4 , 
20100811 237   , 139 3.6.8 , 71 4.0b4pre , 13 3.6.6 , 5 3.6.3 , 3 3.7a2 ,
20100815 438   , 299 4.0b4pre , 125 3.6.8 , 5 3.7a2 , 4 4.0b3 , 3 3.6.4 , ...
20100816 387   , 236 4.0b4pre , 138 3.6.8 , 6 3.6.6 , 4 3.7a2 , 2 3.6.7 , ...
20100817 440   , 267 4.0b4pre , 150 3.6.8 , 9 3.6.6 , 5 4.0b3 , 2 3.7a2 , ...
20100818 344   , 193 4.0b4pre , 134 3.6.8 , 9 3.6.6 , 2 3.6.3 , 1 4.0b5pre , ...
20100819 492   , 332 4.0b4pre , 144 3.6.8 , 7 3.6.6 , 5 3.7a2 , 1 3.6.7 , ...
20100820 245   , 113 4.0b4pre , 109 3.6.8 , 7 3.6.6 , 4 4.0b5pre , 4 4.0b4 ...
20100821 205   , 110 3.6.8 , 80 4.0b4pre , 4 3.7a2 , 3 4.0b4 , 3 3.6.6 ,...
20100822 171   , 119 3.6.8 , 22 4.0b4pre , 7 3.6.6 , 5 4.0b4 , 5 3.6.3 ,
20100823 185   , 143 3.6.8 , 15 4.0b4pre , 7 4.0b5pre , 5 4.0b4 , 5 3.6.3 , 
20100824 196   , 127 3.6.8 , 37 4.0b4 , 14 4.0b4pre , 5 4.0b5pre , 4 3.7a2 ,
20100825 195   , 123 3.6.8 , 59 4.0b4 , 5 4.0b5pre , 2 3.6.7 , 2 3.6.6 ,
20100826 277   , 138 3.6.8 , 110 4.0b4 , 8 4.0b5pre , 6 4.0b4pre , 4 3.6.6 ,
20100827 244   , 139 3.6.8 , 89 4.0b4 , 5 4.0b4pre , 3 3.6.9 , 3 3.6.6 , 
20100828 275   , 144 3.6.8 , 101 4.0b4 , 7 4.0b5pre , 6 3.6.9 , 6 3.6.6 ,
20100829 259   , 133 3.6.8 , 102 4.0b4 , 6 4.0b5pre , 6 4.0b4pre , 5 3.7a2 , 
20100830 280   , 132 3.6.8 , 108 4.0b4 , 10 4.0b5pre , 10 3.7a2 , 9 3.6.6 , 
20100831 275   , 126 4.0b4 , 113 3.6.8 , 9 3.6.9 , 9 3.6.6 , 7 4.0b5pre , 
20100901 292   , 141 3.6.8 , 115 4.0b4 , 9 3.6.9 , 8 3.7a2 , 8 3.6.6 , 

20100902 276   , 151 3.6.8 , 100 4.0b4 , 8 3.6.9 , 8 3.6.6 , 2 4.0b6pre ,...
                 2 3.7a2 , 1 4.0b5pre , 1 4.0b5 , 1 3.6.7 , 1 3.6.4 , 1 3.6.3

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Don't want to block on crashers without testcases

Comment 5

[Sheila Mooney]

I don't see anything past FF5 for this crash in the past 4 weeks. Resolving as works for me.