596958 - Crash in libxul.so [@ _cairo_hash_table_remove ]

Status: RESOLVED INCOMPLETE

(Core :: Graphics, defect)

Description

[Anton]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.9.2.9) Gecko/20100824 Firefox/3.6.9
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.9.2.9) Gecko/20100824 Firefox/3.6.9

It's crashed on bugzilla.mozilla.org when i oppened page and did nothing then

Reproducible: Always

Steps to Reproduce:
Open page and fo nothing
Actual Results:  
http://crash-stats.mozilla.com/report/index/9e826fd3-844a-45b7-97ab-7d39a2100916


http://crash-stats.mozilla.com/report/index/9e826fd3-844a-45b7-97ab-7d39a2100916

Comment 1

[Ludovic Hirlimann [:Usul]]

Just happened to me with Thunderbird in the background :

0 	XUL 	_cairo_hash_table_remove 	cairo-hash.c:488
1 	XUL 	_cairo_scaled_glyph_page_destroy 	cairo-scaled-font.c:448
2 	XUL 	_cairo_scaled_font_fini_internal 	cairo-scaled-font.c:789
3 	XUL 	_moz_cairo_scaled_font_destroy 	cairo-scaled-font.c:1277
4 	XUL 	gfxMacFont::~gfxMacFont 	gfxMacFont.cpp:145
5 	XUL 	gfxFontCache::NotifyExpired 	gfxFont.cpp:1017
6 	XUL 	nsExpirationTracker<gfxFont,3u>::TimerCallback 	
7 	XUL 	nsTimerImpl::Fire 	nsTimerImpl.cpp:424
8 	XUL 	nsTimerEvent::Run 	nsTimerImpl.cpp:520
9 	XUL 	nsThread::ProcessNextEvent 	nsThread.cpp:631
10 	XUL 	NS_ProcessPendingEvents_P 	nsThreadUtils.cpp:195
11 	XUL 	nsBaseAppShell::NativeEventCallback 	nsBaseAppShell.cpp:130
12 	XUL 	nsAppShell::ProcessGeckoEvents 	nsAppShell.mm:424
13 	CoreFoundation 	CFRunLoopRunSpecific 	
14 	CoreFoundation 	CFRunLoopRunInMode 	
15 	HIToolbox 	RunCurrentEventLoopInMode 	
16 	HIToolbox 	ReceiveNextEventCommon 	
17 	HIToolbox 	BlockUntilNextEventMatchingListInMode 	
18 	AppKit 	_DPSNextEvent 	
19 	AppKit 	-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 	
20 	AppKit 	-[NSApplication run] 	
21 	XUL 	nsAppShell::Run 	nsAppShell.mm:771
22 	XUL 	nsAppStartup::Run 	nsAppStartup.cpp:224
23 	XUL 	XRE_main 	nsAppRunner.cpp:3544
24 	thunderbird-bin 	main 	nsMailApp.cpp:104
25 	thunderbird-bin 	thunderbird-bin@0xc75 	
26 		@0x1

Comment 2

[Christian Riechers]

Another one with TB 24.0.1, Linux OpenSUSE 12.3.
ID: bp-2e564855-a512-4bdd-8d11-94d892131018
Signature: _cairo_hash_table_remove

Comment 3

[Wayne Mery (:wsmwk)]

(In reply to Christian Riechers from comment #2)
> Another one with TB 24.0.1, Linux OpenSUSE 12.3.
> ID: bp-2e564855-a512-4bdd-8d11-94d892131018
> Signature: _cairo_hash_table_remove

Christian, this was your crash?

Comment 4

[Christian Riechers]

Yes, it was.

Comment 5

[Wayne Mery (:wsmwk)]

the stacks don't look to be too helpful

Comment 6

[u279076]

Here is a more recent stack, hopefully it helps:
0 	xul.dll 	_cairo_hash_table_remove 	gfx/cairo/cairo/src/cairo-hash.c
1 	xul.dll 	_cairo_scaled_glyph_page_destroy 	gfx/cairo/cairo/src/cairo-scaled-font.c
2 	xul.dll 	_cairo_cache_remove 	gfx/cairo/cairo/src/cairo-cache.c
3 	xul.dll 	_cairo_scaled_font_reset_cache 	gfx/cairo/cairo/src/cairo-scaled-font.c
4 	xul.dll 	_cairo_scaled_font_fini_internal 	gfx/cairo/cairo/src/cairo-scaled-font.c
5 	xul.dll 	_moz_cairo_scaled_font_destroy 	gfx/cairo/cairo/src/cairo-scaled-font.c
6 	xul.dll 	gfxGDIFont::~gfxGDIFont() 	gfx/thebes/gfxGDIFont.cpp
7 	xul.dll 	gfxGDIFont::`scalar deleting destructor'(unsigned int) 	
8 	xul.dll 	gfxFontCache::DestroyFont(gfxFont*) 	gfx/thebes/gfxFont.cpp
9 	xul.dll 	gfxFontCache::NotifyExpired(gfxFont*) 	gfx/thebes/gfxFont.cpp
10 	xul.dll 	nsExpirationTracker<imgCacheEntry, 3>::AgeOneGeneration() 	xpcom/ds/nsExpirationTracker.h
11 	xul.dll 	nsExpirationTracker<nsSHEntryShared, 3>::TimerCallback(nsITimer*, void*) 	xpcom/ds/nsExpirationTracker.h
12 	xul.dll 	nsTimerImpl::Fire() 	xpcom/threads/nsTimerImpl.cpp
13 	xul.dll 	nsTimerEvent::Run() 	xpcom/threads/nsTimerImpl.cpp
14 	mozglue.dll 	arena_malloc_small 	memory/mozjemalloc/jemalloc.c
15 	mozglue.dll 	arena_malloc 	memory/mozjemalloc/jemalloc.c
16 	xul.dll 	mozilla::MakeUnique<base::StatisticsRecorder>() 	mfbt/UniquePtr.h
17 	ntdll.dll 	GetLCIDFromLangListNodeWithLICCheck 	
18 	xul.dll 	TimerThread::RemoveTimer(nsTimerImpl*) 	xpcom/threads/TimerThread.cpp
19 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
20 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
21 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
22 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp
23 	xul.dll 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp
24 	xul.dll 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
25 	mozglue.dll 	arena_dalloc_small 	memory/mozjemalloc/jemalloc.c
26 	mozglue.dll 	arena_dalloc 	memory/mozjemalloc/jemalloc.c
27 	xul.dll 	nsLocalFile::Release() 	xpcom/io/nsLocalFileWin.cpp
28 	xul.dll 	NS_InitXPCOM2 	xpcom/build/XPCOMInit.cpp
29 	icm32.dll 	TickCount 	
30 	xul.dll 	xul.dll@0x1f3eb93 	
31 	xul.dll 	nsLocalFile::GetParent(nsIFile**) 	xpcom/io/nsLocalFileWin.cpp
32 	xul.dll 	std::basic_string<char, std::char_traits<char>, std::allocator<char> >::_Tidy(bool, unsigned int) 	c:/tools/vs2013/vc/include/xstring:2282
33 	xul.dll 	`anonymous namespace'::HistogramGet(char const*, char const*, unsigned int, unsigned int, unsigned int, unsigned int, bool, base::Histogram**) 	toolkit/components/telemetry/Telemetry.cpp
34 	xul.dll 	xul.dll@0x1f305ab 	
35 		@0x79b7ff 	
36 	xul.dll 	mozilla::Telemetry::Accumulate(mozilla::Telemetry::ID, unsigned int) 	toolkit/components/telemetry/Telemetry.cpp
37 	thunderbird.exe 	NS_internal_main(int, char**) 	c:/builds/moz2_slave/tb-rel-c-esr38-w32_bld-0000000/build/mail/app/nsMailApp.cpp:380
38 	xul.dll 	mozilla::net::Http2Session::Close(nsresult) 	netwerk/protocol/http/Http2Session.cpp
39 	thunderbird.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
40 	thunderbird.exe 	__tmainCRTStartup 	f:/dd/vctools/crt/crtw32/startup/crt0.c:255
41 	kernel32.dll 	BaseThreadInitThunk 	
42 	ntdll.dll 	__RtlUserThreadStart 	
43 	ntdll.dll 	_RtlUserThreadStart 	

Note, we are still seeing this 5 times a day on average.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature '_cairo_hash_table_remove':
 - nightly(version 50):0 crashes from 2016-06-06.
 - aurora (version 49):0 crashes from 2016-06-07.
 - beta   (version 48):16 crashes from 2016-06-06.
 - release(version 47):41 crashes from 2016-05-31.
 - esr    (version 45):5 crashes from 2016-04-07.

Crash volume on the last weeks:
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       0       0       0       0       0       0       0
 - aurora        0       0       0       0       0       0       0
 - beta          3       3       2       1       2       2       3
 - release       7       4       7      12       4       0       7
 - esr           0       2       0       1       0       1       0

Affected platforms: Windows, Linux

Comment 8

[Wayne Mery (:wsmwk)]

no crashes newer than version 68