619621 - crash [@ nsDisplayList::DeleteAll()]

Status: RESOLVED DUPLICATE of bug 1198710

(Core :: Layout, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ nsDisplayList::DeleteAll()]

bp-fbcbdc9b-d9e8-4c19-ae03-065392101109
EXCEPTION_ACCESS_VIOLATION_READ
0x0
0	thunderbird.exe	nsDisplayList::DeleteAll	layout/base/nsDisplayList.cpp:441
1	thunderbird.exe	nsDisplayWrapList::~nsDisplayWrapList	layout/base/nsDisplayList.cpp:961
2	thunderbird.exe	nsDisplaySVGEffects::`scalar deleting destructor'	
3	thunderbird.exe	nsDisplayList::DeleteAll	layout/base/nsDisplayList.cpp:441
4	thunderbird.exe	nsLayoutUtils::PaintFrame	layout/base/nsLayoutUtils.cpp:1163
5	thunderbird.exe	PresShell::Paint	layout/base/nsPresShell.cpp:5844
6	thunderbird.exe	nsViewManager::RenderViews	view/src/nsViewManager.cpp:533
7	thunderbird.exe	nsViewManager::Refresh	view/src/nsViewManager.cpp:492
8	thunderbird.exe	nsViewManager::DispatchEvent	view/src/nsViewManager.cpp:1008
9	thunderbird.exe	HandleEvent	view/src/nsView.cpp:167
10	thunderbird.exe	nsWindow::DispatchEvent	widget/src/windows/nsWindow.cpp:2979
11	thunderbird.exe	nsWindow::DispatchWindowEvent	widget/src/windows/nsWindow.cpp:3012
12	thunderbird.exe	nsWindow::OnPaint	widget/src/windows/nsWindowGfx.cpp:563
13	thunderbird.exe	nsWindow::ProcessMessage	widget/src/windows/nsWindow.cpp:4028
14	thunderbird.exe	nsWindow::WindowProc	widget/src/windows/nsWindow.cpp:3727
15	user32.dll	InternalCallWinProc

Comment 1

[timeless]

440  while ((item = RemoveBottom()) != nsnull) {
441    item->~nsDisplayItem();

Processor Notes	This dump is too long and has triggered the automatic truncation routine

ted: where's the truncation? (it needs to be colored orange so i can find it)

23	thunderbird.exe	nsContentTreeOwner::ShowAsModal	xpfe/appshell/src/nsContentTreeOwner.cpp:528

78	thunderbird.exe	nsContentTreeOwner::ShowAsModal	xpfe/appshell/src/nsContentTreeOwner.cpp:528

133	thunderbird.exe	nsContentTreeOwner::ShowAsModal	xpfe/appshell/src/nsContentTreeOwner.cpp:528

That's a lot of modal dialogs, do you guys have any idea what they are from?

Comment 2

[Ludovic Hirlimann [:Usul]]

(In reply to comment #1)
 
> That's a lot of modal dialogs, do you guys have any idea what they are from?

Multiple thread selections - a popup per thread that we are going to delete or something similar.

Comment 3

[timeless]

that should be reworked into an async prompt so that the stack can unwind

Comment 4

[(not currently active) Ted Mielczarek]

I don't know, it doesn't look particularly truncated. Feel free to file a Socorro bug for highlighting. It looks like the default configuration wants to save the top 100 frames, drop anything after that, but save the bottom 10 frames:
http://www.google.com/codesearch/p?hl=en#UQ9I60Nw8Yk/scripts/config/processorconfig.py.dist&q=crashingThreadFrameThreshold%20package:http://socorro\.googlecode\.com&sa=N&cd=4&ct=rc&l=71

Comment 5

[Wayne Mery (:wsmwk)]

still occurs for firefox and thunderbird
bp-56f0b813-35bd-4fd3-a847-41dc02130416 TB17.0.5
0	xul.dll	nsDisplayList::DeleteAll	layout/base/nsDisplayList.cpp:1082
1	xul.dll	nsDisplayWrapList::~nsDisplayWrapList	layout/base/nsDisplayList.cpp:2195
2	xul.dll	nsDisplayOptionEventGrabber::`scalar deleting destructor'	
3	xul.dll	nsDisplayList::DeleteAll	layout/base/nsDisplayList.cpp:1082
4	xul.dll	nsDisplayWrapList::~nsDisplayWrapList	layout/base/nsDisplayList.cpp:2195
5	xul.dll	nsDisplayOptionEventGrabber::`scalar deleting destructor'	
6	xul.dll	nsDisplayList::DeleteAll	layout/base/nsDisplayList.cpp:1082
7	xul.dll	nsLayoutUtils::PaintFrame	layout/base/nsLayoutUtils.cpp:1907
8	xul.dll	PresShell::Paint	layout/base/nsPresShell.cpp:5345
9	xul.dll	nsViewManager::Refresh	view/src/nsViewManager.cpp:367
10	xul.dll	nsViewManager::PaintWindow	view/src/nsViewManager.cpp:717
11	xul.dll	nsView::PaintWindow	view/src/nsView.cpp:1035
12	xul.dll	nsWindow::OnPaint	widget/windows/nsWindowGfx.cpp:430 

hg@1 1079 void nsDisplayList::DeleteAll() {
hg@1 1080 nsDisplayItem* item;
ayg@106310 1081 while ((item = RemoveBottom()) != nullptr) {
hg@1 1082 item->~nsDisplayItem(); 


bp-8fc87bb5-e485-45b8-ad38-9005a2130418 FF23.0a1

Comment 6

[Mats Palmgren (inactive)]

Still occurs in 39.0a1: bp-c75ba589-f606-4b67-84bd-f477f2150225