crash in gfxTextRun::Create

RESOLVED WORKSFORME

Status

()

Core
Graphics
--
critical
RESOLVED WORKSFORME
6 years ago
6 years ago

People

(Reporter: wsmwk, Unassigned)

Tracking

({crash, topcrash})

Trunk
x86
Windows Vista
crash, topcrash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [tbird crash], crash signature)

(Reporter)

Description

6 years ago
topcrash for version 8.  

for some reason, firefox crashes with this at a far low rate (50x?)

examined about 6 stacks

============================================================= 
about 1/4 are startup 

(1) line 3096 version 7   line 3106 version 8

bp-2575cd01-79d6-4cf3-926b-7ce2d2111027 (jkkwoo) v8
bp-2cf6f190-609a-4b5b-bf26-312052111015 (kybunnies) v7
bp-2cf6f190-609a-4b5b-bf26-312052111015 (caldwell8) v7
0 	mozalloc.dll 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:78
1 	mozalloc.dll 	mozalloc_handle_oom 	memory/mozalloc/mozalloc_oom.cpp:54
2 	mozalloc.dll 	moz_xmalloc 	memory/mozalloc/mozalloc.cpp:103
3 	xul.dll 	gfxTextRun::Create 	gfx/thebes/gfxFont.cpp:3096
4 	xul.dll 	gfxFontGroup::MakeTextRun 	gfx/thebes/gfxFont.cpp:2398
5 	xul.dll 	TextRunWordCache::MakeTextRun 	gfx/thebes/gfxTextRunWordCache.cpp:850
6 	xul.dll 	gfxTextRunWordCache::MakeTextRun 	gfx/thebes/gfxTextRunWordCache.cpp:1046
7 	xul.dll 	MakeTextRun 	layout/generic/nsTextFrameThebes.cpp:580
8 	xul.dll 	BuildTextRunsScanner::BuildTextRunForFrames 	layout/generic/nsTextFrameThebes.cpp:1979
9 	xul.dll 	BuildTextRunsScanner::FlushFrames 	layout/generic/nsTextFrameThebes.cpp:1394

(2) 

bp-de08346e-ebb7-463b-8a26-3ded92111113 (unique) v8

0 	mozalloc.dll 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:77
1 	mozalloc.dll 	mozalloc_handle_oom 	memory/mozalloc/mozalloc_oom.cpp:54
2 	mozalloc.dll 	moz_xmalloc 	memory/mozalloc/mozalloc.cpp:112
3 	xul.dll 	gfxTextRun::Create 	gfx/thebes/gfxFont.cpp:3106
4 	xul.dll 	TextRunWordCache::MakeTextRun 	gfx/thebes/gfxTextRunWordCache.cpp:597
5 	xul.dll 	gfxTextRunWordCache::MakeTextRun 	gfx/thebes/gfxTextRunWordCache.cpp:1035
6 	xul.dll 	gfxTextRunCache::MakeTextRun 	gfx/thebes/gfxTextRunCache.cpp:93
7 	xul.dll 	`anonymous namespace'::AutoTextRun::AutoTextRun 	gfx/src/nsFontMetrics.cpp:66
8 	xul.dll 	nsFontMetrics::GetWidth 	gfx/src/nsFontMetrics.cpp:311
9 	xul.dll 	nsRenderingContext::GetWidth 	gfx/src/nsRenderingContext.cpp:520

============================================================= 

bp-50ecf8e2-8c8d-4ec8-9192-e13ed2111113 looks to be an example of the same crash not going OOM

gfxTextRun::Create(gfxTextRunFactory::Parameters const*, void const*, unsigned int, gfxFontGroup*, unsigned int)
Component: General → Graphics
Product: Thunderbird → Core
QA Contact: general → thebes
There are two OOMs here; one on the same line as bp-50ecf8e2-8c8d-4ec8-9192-e13ed2111113, and one on a different line. I don't know if we should consider them the same.

It's not clear to me why the OOM is definitely a bug, though.
Keywords: needURLs
Summary: crash mozalloc_abort → crash in gfxTextRun::Create

Comment 2

6 years ago
Crash URLs for 2011-11-07 through 2011-11-22 for all signatures containing "gfxTextRun::Create":

 3 about:blank
 2 \N
 1 http://www.nuvid.com/adx_iframe_bottom_4.html
 1 http://www.nipponanime.net/forum/forumdisplay.php?fid=391
 1 http://www.linkbucks.com/link/49349442
 1 http://www.kaixin001.com/home/?l=a
 1 http://www.google.it/
 1 http://www.google.com/
 1 http://www.facebook.com/?ref=tn_tinyman
 1 http://www.facebook.com/profile.php?id=100001252095596
 1 http://www.facebook.com/pages/Ksiaznica-Pomorska/136772876386629
 1 http://www.facebook.com/berrak.armutlu?...
 1 http://www.facebook.com/ajax/pagelet/generic.php/PhotoViewerPagelet?...
 1 http://www.facebook.com/ajax/pagelet/generic.php/pagelet/home/morestories.php...
 1 http://www.facebook.com/ajax/pagelet/generic.php/pagelet/home/morestories.php?...
 1 http://www.facebook.com/ai.php?...
 1 http://www.erepublik.com/en
 1 http://www.ebay.de/itm/PLAYMOBIL-4819-4820-4821-4822-4823-4824-4825-FEUERWEHR-/360341114664?pt=DE_Allesf%C3%BCrKind_Spielzeug_Playmobil&hash=item53e6010f28
 1 http://www.dioxxy.com.br/home/
 1 http://www.darbyandliffenea.co.uk/
 1 http://www.csfd.cz/film/257725-machete/
 1 http://www.blogger.com/blog-options-basic.g?blogID=8654162280395399057
 1 http://www.9evitka.cz/restaurant/daymenu
 1 http://windupurnomo.wordpress.com/tag/mysql/
 1 http://vkontakte.ru/al_profile.php?...
 1 http://tr.wikipedia.org/wiki/Ludwig_van_Beethoven
 1 http://torrentsmd.eu//details.php?id=1092704&filelist=1#filelist
 1 https://www.hvfcu.org/
 1 https://www.facebook.com/dialog/oauth?...&redirect_uri=http%3A%2F%2Fdata.sidebardisabler.net%2Fflfix.htm%23origin%3Dhttps%253A%252F%252Fwww.facebook.com%26frame%3Dxd112552328939
 1 https://www.facebook.com/ajax/pagelet/generic.php/MoreStoriesPagelet?...
 1 http://sports.williamhill.com/bet
 1 http://search.babylon.com/?s=web&babsrc=HP_ss&q=RAPpEr+%27Ducati
 1 https://bugzilla.mozilla.org/show_bug.cgi?id=695421
 1 http://paulmadonna.com/all_over_coffee/
 1 http://otdyh-ua.net/items/712-patkovski-hotel
 1 http://lauxanh.us/diendan/showthread.php?t=546719
 1 http://il-tumen.sakha.ru/?id=18121
 1 http://earthlink.net/
 1 http://au.mc1214.mail.yahoo.com/mc/showMessage?...
 1 http://apps.facebook.com/ai.php?...
 1 http://adult-sex-games.com/page6.html
 1 file:///C:/Documents%20and%20Settings/Admin/%D0%A0%D0%B0%D0%B1%D0%BE%D1%87%D0%B8%D0%B9%20%D1%81%D1%82%D0%BE%D0%BB/play-kingdom-rush.php.htm
 1 

Affected signatures:
mozalloc_abort(char const* const) | mozalloc_handle_oom() | gfxTextRun::Create(gfxTextRunFactory::Parameters const*, void const*, unsigned int, gfxFontGroup*, unsigned int)
mozalloc_abort(char const* const) | mozalloc_handle_oom() | moz_xmalloc | gfxTextRun::Create(gfxTextRunFactory::Parameters const*, void const*, unsigned int, gfxFontGroup*, unsigned int)
mozalloc_abort | mozalloc_handle_oom | moz_xmalloc | gfxTextRun::Create
operator new(unsigned int) | gfxTextRun::Create(gfxTextRunFactory::Parameters const*, void const*, unsigned int, gfxFontGroup*, unsigned int)
gfxTextRun::Create(gfxTextRunFactory::Parameters const*, void const*, unsigned int, gfxFontGroup*, unsigned int)

Comment 3

6 years ago
Just to be clear, text run creation and destruction is done constantly and typically doesn't require gobs of memory.  But if other code is using memory, then there's a much higher chance of hitting an OOM in textrun code.  The fact that we're hitting this on pages like 'google.com', which cause a very minimal amount of textrun creation, indicates that we probably need to look elsewhere to figure out where the memory hog lies.
This isn't *only* an OOM, though. There are crashes like the breakpad URL mentioned at the end of comment 0 that are just crashes at some random address.
(Reporter)

Comment 5

6 years ago
(In reply to Robert Kaiser (:kairo@mozilla.com) from comment #2)
> Crash URLs for 2011-11-07 through 2011-11-22 for all signatures containing
> "gfxTextRun::Create":

kairo, are those from thunderbird crashes ?

I'm not sure what is seen in TB can be correlated to what is seen in firefox ... the crash is almost nonexistent in firefox
Whiteboard: [tbird crash]

Comment 6

6 years ago
(In reply to Wayne Mery (:wsmwk) from comment #5)
> (In reply to Robert Kaiser (:kairo@mozilla.com) from comment #2)
> > Crash URLs for 2011-11-07 through 2011-11-22 for all signatures containing
> > "gfxTextRun::Create":
> 
> kairo, are those from thunderbird crashes ?

No, those are Firefox crashes.

> I'm not sure what is seen in TB can be correlated to what is seen in firefox
> ... the crash is almost nonexistent in firefox

I'm not sure if Thunderbird would even set URLs in the crash reports, and then the CSV files we are using to fetch URL data (intentionally AFAIK) only contain Firefox and Fennec crashes.

Updated

6 years ago
Keywords: needURLs
(Reporter)

Comment 7

6 years ago
nothing on crash-stats after TB11.0.1 
like bp-8922783a-ce9a-41ae-aaf6-815012120624
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.