606475 - crash in D3D10 layers [@ nsRefPtr<nsBarProp>::assign_with_AddRef(nsBarProp*) | mozilla::layers::PlanarYCbCrImageD3D10::PlanarYCbCrImageD3D10(mozilla::layers::LayerManagerD3D10*) ]

Status: RESOLVED DUPLICATE of bug 606411

(Core :: Graphics, defect)

Description

[Matthias Versen [:Matti]]

Using Seamonkey trunk on Win7 classic UI, Nvidia310M with the latest driver i got 2 crashes in the last 2 days at the same place.

The last crash happened after I switched to a newsgroup in Mailnews.
bp-2403a96f-2d6e-42b9-a61d-21df02101022
bp-67e39b28-37d0-4b8f-80b6-34fc42101021

Stack Trace:
0 	xul.dll 	nsRefPtr<nsBarProp>::assign_with_AddRef 	objdir/mozilla/dist/include/nsAutoPtr.h:940
1 	xul.dll 	mozilla::layers::PlanarYCbCrImageD3D10::PlanarYCbCrImageD3D10 	gfx/layers/d3d10/ImageLayerD3D10.cpp:219
2 	xul.dll 	mozilla::layers::ImageContainerD3D10::CreateImage 	gfx/layers/d3d10/ImageLayerD3D10.cpp:62
3 	xul.dll 	VideoData::Create 	content/media/nsBuiltinDecoderReader.cpp:132
4 	xul.dll 	nsWebMReader::DecodeVideoFrame 	content/media/webm/nsWebMReader.cpp:669
5 	xul.dll 	nsBuiltinDecoderStateMachine::DecodeLoop 	content/media/nsBuiltinDecoderStateMachine.cpp:276
6 	xul.dll 	nsRunnableMethodImpl<void 	objdir/mozilla/dist/include/nsThreadUtils.h:347
7 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:547
8 	xul.dll 	NS_ProcessNextEvent_P 	objdir/mozilla/xpcom/build/nsThreadUtils.cpp:250
9 	xul.dll 	nsThread::ThreadFunc 	xpcom/threads/nsThread.cpp:263
10 	nspr4.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c:426
11 	nspr4.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c:122

Comment 1

[Bas Schouten (:bas.schouten)]

Hrm, this is tricky, I'll have to somehow notify containers of the manager's destruction. I'm not sure yet how to do this.

Comment 2

[Matthias Versen [:Matti]]

You have an idea why this happens ?
This seems to happen randomly for me and I don't know where this WebM video comes from. That could be from planet.mozilla.org but I'm sure that I have closed planet a few seconds before I got the crash.
The top of the stack is sometimes different -> bp-b579582d-2f65-4c1b-9c51-580792101023

Comment 3

[Bas Schouten (:bas.schouten)]

It's a race condition where an ImageContainer's requested to create an image after the manager has already been taken down.

Comment 4

[Bas Schouten (:bas.schouten)]

This should block Beta 8.

Comment 5

[Bas Schouten (:bas.schouten)]

This should block beta 8.