618730 - Crash [@ mozilla::layers::BasicThebesLayer::Paint] (almost permaorange on Thunderbird)

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Mark Banner (:standard8)]

Attachment: Crash Log

Since bug 615870 landed on trunk, 4 out of 5 of our Thunderbird MozMill runs on windows have been crashing with the same stack.

Top 6 frames:

 0  0x0
    eip = 0x00000000   esp = 0x0012aadc   ebp = 0x0012aaf8   ebx = 0x00001000
    esi = 0x091f8a80   edi = 0x091f8ba8   eax = 0x10c38474   ecx = 0x091f8a80
    edx = 0x00000000   efl = 0x00010246
    Found by: given as instruction pointer in context
 1  xul.dll!mozilla::layers::BasicThebesLayer::Paint(gfxContext *,void (*)(mozilla::layers::ThebesLayer *,gfxContext *,nsIntRegion const &,nsIntRegion const &,void *),void *) [BasicLayers.cpp:bdfc000c60fe : 542 + 0x20]
    eip = 0x108a40b1   esp = 0x0012ab00   ebp = 0x0012ab90
    Found by: previous frame's frame pointer
 2  xul.dll!mozilla::layers::BasicLayerManager::PaintLayer(mozilla::layers::Layer *,void (*)(mozilla::layers::ThebesLayer *,gfxContext *,nsIntRegion const &,nsIntRegion const &,void *),void *) [BasicLayers.cpp:bdfc000c60fe : 1326 + 0xd]
    eip = 0x108a3d5c   esp = 0x0012ac04   ebp = 0x0012ac48   ebx = 0x0a68ee20
    Found by: call frame info
 3  xul.dll!mozilla::layers::BasicLayerManager::PaintLayer(mozilla::layers::Layer *,void (*)(mozilla::layers::ThebesLayer *,gfxContext *,nsIntRegion const &,nsIntRegion const &,void *),void *) [BasicLayers.cpp:bdfc000c60fe : 1333 + 0xd]
    eip = 0x108a3d72   esp = 0x0012acbc   ebp = 0x0012ad00   ebx = 0x0a68ee20
    Found by: call frame info
 4  xul.dll!mozilla::layers::BasicLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer *,gfxContext *,nsIntRegion const &,nsIntRegion const &,void *),void *) [BasicLayers.cpp:bdfc000c60fe : 1236 + 0xf]
    eip = 0x108a460d   esp = 0x0012ad74   ebp = 0x0012ae20   ebx = 0x0a68ee48
    Found by: call frame info
 5  xul.dll!PresShell::Paint(nsIView *,nsIView *,nsIWidget *,nsRegion const &,nsIntRegion const &,int,int) [nsPresShell.cpp:bdfc000c60fe : 6082 + 0x8]
    eip = 0x101dd432   esp = 0x0012ae98   ebp = 0x0012aec4   ebx = 0x00000000
    Found by: call frame info

Full stack attached.

Comment 1

[Oleg Romashin (:romaxa)]

Attachment: Probably this should help

Comment 2

[Oleg Romashin (:romaxa)]

Don't know why it crashes on BasicThebesLayer::Paint, http://mxr.mozilla.org/mozilla-central/source/gfx/layers/basic/BasicLayers.cpp#542

probably it has inlined BasicThebesLayer::PaintBuffer ...

Comment 3

[Mark Banner (:standard8)]

I've pushed this to Thunderbird try servers, should have results in about 3-6 hours.

Comment 4

[Mark Banner (:standard8)]

Results from Thunderbird try servers show that without the patch on this bug we crashed on all runs (10) that I told it to do.

With the patch we didn't crash on any of the test runs (10 of them again).

So the suggested fix looks good from Thunderbird's point of view.

Comment 5

[[e-mail]]

(In reply to comment #2)
> Don't know why it crashes on BasicThebesLayer::Paint,
> http://mxr.mozilla.org/mozilla-central/source/gfx/layers/basic/BasicLayers.cpp#542
> 
> probably it has inlined BasicThebesLayer::PaintBuffer ...

I can confirm that in a debug build it crashes in PaintBuffer.

Comment 6

[Mark Banner (:standard8)]

I know this is likely to get reviewed today, but it should probably block as its a regression that causes a crash.

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Anyone can land this.

Comment 9

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Fixed by backout.