618261 - crash [@ gfxContext::SetOperator ][@ gfxContext::SetOperator | ShadowBufferOGL::Upload ] with null dest

Status: RESOLVED DUPLICATE of bug 613000

(Core :: Graphics, defect)

Description

[Scoobidiver (away)]

It is a new crash signature in Fennec 4.0b3pre.
It is #6 top crasher in Fennec 4.0b3pre for the last week.

Signature	gfxContext::SetOperator
UUID	a2313565-f315-40c5-b539-3f1512101209
Time 	2010-12-09 21:18:56.937653
Uptime	32
Last Crash	84 seconds before submission
Install Age	44077 seconds (12.2 hours) since version was first installed.
Product	Fennec
Version	4.0b3pre
Build ID	20101209042810
Branch	2.0
OS	Linux
OS Version	0.0.0 Linux 2.6.32.9 #3 Tue Oct 12 21:33:42 KST 2010 armv7l
CPU	arm
CPU Info	
Crash Reason	SIGSEGV
Crash Address	0xc
User Comments	
App Notes 	samsung SCH-I800
verizon/SCH-I800/SCH-I800/SCH-I800:2.2/FROYO/DJ11:user/release-keys

Frame 	Module 	Signature [Expand] 	Source
0 	libxul.so 	gfxContext::SetOperator 	gfx/thebes/gfxContext.cpp:554
1 	libxul.so 	mozilla::layers::ShadowBufferOGL::Upload 	gfx/layers/opengl/ThebesLayerOGL.cpp:629
2 	libxul.so 	mozilla::layers::ShadowThebesLayerOGL::Swap 	nsAutoPtr.h:968
3 	libxul.so 	mozilla::layers::ShadowLayersParent::RecvUpdate 	PLayers.h:532
4 	libxul.so 	mozilla::layers::PLayersParent::OnMessageReceived 	PLayersParent.cpp:221
5 	libxul.so 	mozilla::dom::PContentParent::OnMessageReceived 	PContentParent.cpp:1196
6 	libxul.so 	mozilla::ipc::SyncChannel::OnDispatchMessage 	ipc/glue/SyncChannel.cpp:172
7 	libxul.so 	mozilla::ipc::RPCChannel::OnMaybeDequeueOne 	ipc/glue/RPCChannel.cpp:436
8 	libxul.so 	RunnableMethod<mozilla::ipc::RPCChannel, bool , Tuple0>::Run 	ipc/chromium/src/base/task.h:308
9 	libxul.so 	mozilla::ipc::RPCChannel::DequeueTask::Run 	RPCChannel.h:475
10 	libxul.so 	MessageLoop::RunTask 	ipc/chromium/src/base/message_loop.cc:344
11 	libxul.so 	MessageLoop::DeferOrRunPendingTask 	ipc/chromium/src/base/message_loop.cc:354
12 	libxul.so 	MessageLoop::DoWork 	ipc/chromium/src/base/message_loop.cc:451
13 	libxul.so 	mozilla::ipc::DoWorkRunnable::Run 	ipc/glue/MessagePump.cpp:71
14 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:626
15 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:250
16 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:134
17 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:220
18 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:512
19 	libxul.so 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:198
20 	libxul.so 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:192
21 	libxul.so 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3693
22 	libxul.so 	GeckoStart 	toolkit/xre/nsAndroidStartup.cpp:131
23 	libc.so 	libc.so@0x111b3 	
24 	libc.so 	libc.so@0x10ca3 

More reports at:
http://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=gfxContext%3A%3ASetOperator&version=Fennec%3A4.0b3pre

Comment 1

[timeless]

617 ShadowBufferOGL::Upload(gfxASurface* aUpdate, const nsIntRegion& aUpdated,
618                         const nsIntRect& aRect, const nsIntPoint& aRotation)
645   nsRefPtr<gfxContext> dest = mTexImage->BeginUpdate(scaledDestRegion);
647   dest->SetOperator(gfxContext::OPERATOR_SOURCE);

dest is null

Comment 2

[timeless]

Attachment: proposal

Comment 3

[Josh Matthews [:jdm]]

Jeff told me that this was actually a symptom of bug 613000.

Comment 4

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Comment on attachment 496787 [details] [diff] [review]
proposal

This is a dup of bug 613000, and not the right fix.