654485 - Content crash [@ libc.so@0x11c80] (ABORT: creating ThebesLayer 'back buffer' failed!) zooming with background-attachment:fixed

Status: RESOLVED DUPLICATE of bug 653133

(Core :: Graphics, defect)

Description

[Matt Brubeck (:mbrubeck)]

Steps to reproduce:
1. Open http://dvcs.w3.org/hg/webevents/raw-file/default/touchevents.html in Fennec.
2. Pinch to zoom in as far as possible.

Results: https://crash-stats.mozilla.com/report/index/bp-3c9e8b7d-5416-423c-931d-85a772110503  (Note: The stack trace in the crash report appears incorrect.)

This is reproducible for me in the 2011-05-03 fennec nightly on T-Mobile G2 (Android 2.2).

Comment 1

[Matt Brubeck (:mbrubeck)]

This also happens in the latest Fennec Aurora build, but not in Firefox 4.0 (all on the same Android device).

Comment 2

[Matt Brubeck (:mbrubeck)]

I can reproduce this in Linux x86 Fennec too (using the scroll wheel to zoom in).  It does not actually seem to be an OOM crash, since my laptop still had plenty of free memory during the crash.

Comment 3

[Matt Brubeck (:mbrubeck)]

Here's a stack from desktop Fennec (see attachment for the full stack):

#0  0xb7827832 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1  0xb4cc61a6 in nanosleep () at ../sysdeps/unix/syscall-template.S:82
#2  0xb4cc5fa0 in __sleep (seconds=0)
    at ../sysdeps/unix/sysv/linux/sleep.c:138
#3  0xb52402d5 in ah_crap_handler (signum=6)
    at /home/mbrubeck/src/mozilla/mozilla-central/toolkit/xre/nsSigHandlers.cpp:119
#4  0xb524032e in child_ah_crap_handler (signum=6)
    at /home/mbrubeck/src/mozilla/mozilla-central/toolkit/xre/nsSigHandlers.cpp:131
#5  <signal handler called>
#6  0xb7827832 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#7  0xb4c57941 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#8  0xb4c5ae42 in abort () at abort.c:92
#9  0xb77ec020 in mozalloc_abort (
    msg=0xbffe7fd0 "###!!! ABORT: creating ThebesLayer 'back buffer' failed!: file /home/mbrubeck/src/mozilla/mozilla-central/gfx/layers/basic/BasicLayers.cpp, line 1913")
    at /home/mbrubeck/src/mozilla/mozilla-central/memory/mozalloc/mozalloc_abort.cpp:75
#10 0xb6910ad9 in Abort (
    aMsg=0xbffe7fd0 "###!!! ABORT: creating ThebesLayer 'back buffer' failed!: file /home/mbrubeck/src/mozilla/mozilla-central/gfx/layers/basic/BasicLayers.cpp, line 1913")
    at /home/mbrubeck/src/mozilla/mozilla-central/xpcom/base/nsDebugImpl.cpp:388
#11 0xb69109e4 in NS_DebugBreak_P (aSeverity=3, 
    aStr=0xb755859c "creating ThebesLayer 'back buffer' failed!", aExpr=0x0, 
    aFile=0xb7557d24 "/home/mbrubeck/src/mozilla/mozilla-central/gfx/layers/basic/BasicLayers.cpp", aLine=1913)
    at /home/mbrubeck/src/mozilla/mozilla-central/xpcom/base/nsDebugImpl.cpp:345
#12 0xb6a37729 in mozilla::layers::BasicShadowableThebesLayer::CreateBuffer (
    this=0xb3a640a0, aType=gfxASurface::CONTENT_COLOR, aSize=...)
    at /home/mbrubeck/src/mozilla/mozilla-central/gfx/layers/basic/BasicLayers.cpp:1913

Comment 4

[Matt Brubeck (:mbrubeck)]

Attachment: stack trace

Comment 5

[Matt Brubeck (:mbrubeck)]

This crashed trying to allocate a 2656x45216 buffer:

#12 0xb6a5a729 in mozilla::layers::BasicShadowableThebesLayer::CreateBuffer (this=0xb3a64a60, aType=gfxASurface::CONTENT_COLOR, aSize=...)
    at /home/mbrubeck/src/mozilla/mozilla-central/gfx/layers/basic/BasicLayers.cpp:1913
1913	      NS_RUNTIMEABORT("creating ThebesLayer 'back buffer' failed!");
(gdb) p aSize
$2 = (const nsIntSize &) @0xbfbf23c8: {<mozilla::BaseSize<int, nsIntSize>> = {width = 2656, height = 45216}, <No data fields>}

Comment 6

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Is the frontend asking for the 2656x45216 buffer?  That would be undesirable :).  Regression range might be helpful.