70424 - M094 & Trunk N620 Linux crash [@ nsRenderingContextGTK::CopyOffScreenBits]

Status: VERIFIED FIXED

(Core Graveyard :: GFX, defect)

Description

[Curt Patrick (gone)]

This crash has been hovering around #10-15 on the topcrash lists. Not much in 
the way of user comment. Not yet reproduced. Here's a stack trace and some 
comments to help reproduce it.

nsRenderingContextGTK::CopyOffScreenBits()  
         nsViewManager2::Refresh()  
         nsViewManager2::DispatchEvent()  
         HandleEvent()  
         nsWidget::DispatchEvent()  
         nsWidget::DispatchWindowEvent()  
         nsWindow::DoPaint()  
         nsWindow::Update()  
         nsWindow::UpdateIdle()  
         libglib-1.2.so.0 + 0x12a8f (0x40712a8f)  
         libglib-1.2.so.0 + 0x11987 (0x40711987)  
         libglib-1.2.so.0 + 0x12001 (0x40712001)  
         libglib-1.2.so.0 + 0x121cc (0x407121cc)  
         libgtk-1.2.so.0 + 0x93e57 (0x4062be57)  
         nsAppShell::Run()  
         nsAppShellService::Run()  
         main1()  
         main()  
         libc.so.6 + 0x1bb65 (0x4026fb65)

        URL:(26951744) tdwaterhouse.com
        URL:(26899803) www.octfcu.org
        URL:(26969348) http://www.pjgrady.com/
        URL:(26973240) http://www.amazon.com/
        Comment: (26951744) clicked on Login button
        Comment: (26899803) attemting to go to www.octfcu.org from my netscape 
home page
        Comment: (26969348) I clicked on the 'products' link
        Comment: (26973240) I tried to sign in with amazon. This is an SSL 
session. Apparently NS 6.01 is having trouble with SSL connections here.
        Comment: (26890162) Adding a bookmerk

Comment 1

[Curt Patrick (gone)]

Adding "crash" to the keywords for tracking.

Comment 2

[Kevin McCluskey (gone)]

Reassigning to Waqar. Setting milestone to mozilla0.9.1

Comment 3

[Kevin McCluskey (gone)]

Reassigning to Waqar

Comment 4

[Kevin McCluskey (gone)]

Setting milestone to Mozilla0.9

Comment 5

[waqar]

I cant seem to crash with 03/26/01 build, I tried all the url's given in the bug.

Comment 6

[Chris Petersen]

Marking verified in the May 30th Linux build

Comment 7

[greer]

Reopening bug. Seeing the same stack trace in the M091 Linux build 
(2001060713). Comments are:

(31556346) Comments: Trying to load URL from
GAIM:http://www.cdnow.com/cgi-
bin/mserver/SID=925781270/pagename=/RP/CDN/FIND/album.html/artistid=EMERSON+LAKE
+&+PALMER/itemid=632588
     (31528370) Comments: Closing popups
     (31494662) Comments: sent a Destroy signal to one of the windows. This
should not kill the program.

Unsuccessful at reproducing the crash with the above URL. 
Adding keyword: qawanted
Changing summary to M091

Comment 8

[Kevin McCluskey (gone)]

Reassinging to Don. Marking 0.9.0 nsbranch.

Comment 9

[greer]

Still seeing this one in M092 and a few incidents in the trunk.
Adding kw: topcrash

Trunk builds 6-30 to 7-02 have two crashes with this one comment:

(32462740) Comments: Clicked the "Web Site" button in gAIM's "About Gaim" 
window. The browser window started to come up and crashed. That page
works fine normally.

M092 has 19 incidents with the following comments:

(32378635) URL: x.themes.org
(32378635) Comments: downloading / autoinstalling

(32375442) URL: ftp.netscape.com
(32375442) Comments: installing jre.xpi from fp.netscape.comstalled and mozilla 
stoped responding

Comment 10

[Jay Patel [:jay]]

Here are a few detailed entries for crashes with M092:

Incident ID 32820374 
 Stack Signature
              nsRenderingContextGTK::CopyOffScreenBits() 5726d719 
 Bug ID
 Trigger Time 
              2001-07-12 10:37:09 
 User Comments 
              When switching virtual desktops under XFree86 4.0.3 using the 
sawfish window manager and Gnome 1.2, Mozilla usually crashes after switching 
away from the virtual desktop that it is on and then back
              again. Usually the amount of time with the browser on a 
 Build ID
              2001062823 
 Product ID
              Netscape6.10 
 Platform ID
              LinuxIntel 

Incident ID 32820374 
 Stack Signature
              nsRenderingContextGTK::CopyOffScreenBits() 5726d719 
 Bug ID
 Trigger Time 
              2001-07-12 10:37:09 
 User Comments 
              When switching virtual desktops under XFree86 4.0.3 using the 
sawfish window manager and Gnome 1.2, Mozilla usually crashes after switching 
away from the virtual desktop that it is on and then back
              again. Usually the amount of time with the browser on a 
 Build ID
              2001062823 
 Product ID
              Netscape6.10 
 Platform ID
              LinuxIntel 

Incident ID 32789115 
 Stack Signature
              nsRenderingContextGTK::CopyOffScreenBits() 05207855 
 Bug ID
 Trigger Time 
              2001-07-11 17:32:00 
 User Comments 
              Clicked on a link from gaim to the page. I had clicked on it 
previously and gotten it to come up fine, then closed the window. The mail 
window was still open. Clicking on the link a second time caused
              mozilla to crash. 
 Build ID
              2001062823 
 Product ID
              Netscape6.10 
 Platform ID
              LinuxIntel 
 Stack Trace

nsRenderingContextGTK::CopyOffScreenBits() 
nsViewManager::Refresh() 
nsViewManager::DispatchEvent() 
HandleEvent() 
nsWidget::DispatchEvent() 
nsWidget::DispatchWindowEvent() 
nsWindow::DoPaint() 
nsWindow::Update() 
nsWindow::UpdateIdle() 
libglib-1.2.so.0 + 0x10ff0 (0x4036eff0) 
libglib-1.2.so.0 + 0x10055 (0x4036e055) 
libglib-1.2.so.0 + 0x10659 (0x4036e659) 
libglib-1.2.so.0 + 0x107e8 (0x4036e7e8) 
libgtk-1.2.so.0 + 0x9165b (0x4028365b) 
nsAppShell::Run() 
nsAppShellService::Run() 
main1() 
main() 
libc.so.6 + 0x1c177 (0x404a5177) 


As Tom mentioned, there are a few crashes on the MozillaTrunk, but I haven't 
seen any in th branch Talkback data...but then again, we don't have a lot of 
crash data for branch builds yet.

Comment 11

[Pjotr Prins]

Confirm bug switching virtual desktops under XFree86 4.0.2 using the 
sawfish window manager 0.37.3 and Gnome 1.3.0, Mozilla 0.9.2 and recent
nightlies.

Comment 12

[dcone (gone)]

I can not reproduce this.. at all.  Is there a URL to go to.. does a popup come 
up, is there a version of linux..HELP.. I am pounding and nothing bad happens.

Comment 13

[dcone (gone)]

another thought. maybe there is something wrong with Sawfish.. one of there 
versions is bad.. can you use another version of sawfish see if it gets fixed.  
Also, how do you check to see what version is running.

Comment 14

[Pjotr Prins]

OK, I'll upgrade sawfish and maybe X/gnome later this week. See what it gives.
The bug could be with sawfish - I noticed that X starts crashing 
randomly too, once I have started a Mozilla session, even after killing it. 

With Mozilla X crashes 4 times a day. Without Mozilla it does not crash.

If you get a core dump of X - would that help? 

Oh yeah, I am running on ROCK Linux, Linux version 2.4.2 (root@genova) (gcc
version 2.95.2 19991024 (release)).

Comment 15

[greer]

41 incidents in the M094 data. Updating the summary to M094. Not seeing it in 
the Trunk or N620 however.

A few comments:
     (35870159) URL: http://www.securityfocus.com
     (35869609) URL: http://www.securityfocus.com
     (35859828) URL: http://www.svd.se
     (35859828) Comments: Got rid of an ad window (annihilated or closed it  
don't remember)
     (35857621) Comments: Was pressing the home button.
     (35840735) Comments: I was reading mail and then switched over to a 
browser window andclicked on the "Bookmarks" button the the Personal Bar (?) 
and it crashed.
     (35623115) Comments: Sawfish 0.38 destroy window from linux vanilla RH 7.1 
kills not only one window  but whole browser.
     (35548103) URL: http://www.marko.net/gaim
     (35482022) Comments: Absolutely nothing
     (35476066) URL: typing in web.icq.com  (never got there)
     (35476066) Comments: Typing in a new url.  I selected the http:// part by 
accident (I think) and then deleted the rest.started typing in web.icq.com and 
kaboom.I do really like 094 guys (and gals) thanks!

Comment 16

[Kevin McCluskey (gone)]

Attachment: Add passing of error when allocating offscreen fails on GTK

Comment 17

[Kevin McCluskey (gone)]

I haven't been able to reproduce the crash, but inspection of stack trace
indicates allocating the offscreen for the backbuffer may be failing. I attached
a patch which fixes up the error handling on GTK when it fails to allocate an
offscreen. 

Comment 18

[Kevin McCluskey (gone)]

Taking this bug.

Comment 19

[Stuart Parmenter]

Comment on attachment 51905 [details] [diff] [review]
Add passing of error when allocating offscreen fails on GTK

r=pavlov

Comment 20

[Marc Attinasi]

Comment on attachment 51905 [details] [diff] [review]
Add passing of error when allocating offscreen fails on GTK

sr=attinasi - 

Nit: indenting is bad at

+      rv = surf->Init(..)

also, does g_return_val_if_fail need the global scoping '::'?

Comment 21

[Kevin McCluskey (gone)]

Attachment: Same as previous patch with the global scoping operator removed as suggested by Marc

Comment 22

[Kevin McCluskey (gone)]

marking nsbranch+

PDT: Very simple patch which returns an error code when allocating an offscreen
failed. Should fix this topcrash bug.

Comment 23

[Jaime Rodriguez, Jr.]

nice. sending this one aroudn to see if we can get + this morning (if not, let's 
talk about it @ 3 p.m. today).

Comment 24

[Jaime Rodriguez, Jr.]

pls check this in today, if you can - PDT+

Comment 25

[Kevin McCluskey (gone)]

Checked patch 52122 into Mozilla0.9.4 branch.

Comment 26

[Kevin McCluskey (gone)]

Fix checked into trunk. 

Comment 27

[lchiang]

talkback staff - is this still a Linux topcrash reported after 10-6?  I couldn't
tell when I went to the Talkback pages although I went to the Linux Simple Crash
Analysis page and still saw this stack trace in the reports, but it showed Crash
data range: 2001-10-04 to 2001-10-14 and Build ID range: 2001091311 to 2001091311

Comment 28

[greer]

Trunk does not show any incidents of this signature in the last ten days. All of 
the crashes in the data are in M094 and previous milestones. It hasn't appeared 
yet in M095. Marking Verified.

Comment 29

[Jan Carpenter]

Reopening as N620 topcrash on the stack signature: 
nsRenderingContextGTK::CopyOffScreenBits

Stack Trace: 

	 nsRenderingContextGTK::CopyOffScreenBits()
	 nsViewManager::Refresh()
	 nsViewManager::DispatchEvent()
	 HandleEvent()
	 nsWidget::DispatchEvent()
	 nsWidget::DispatchWindowEvent()
	 nsWindow::DoPaint()
	 nsWindow::Update()
	 nsWindow::UpdateIdle()
	 libglib-1.2.so.0 + 0x112f2 (0x403432f2)
	 libglib-1.2.so.0 + 0x102d9 (0x403422d9)
	 libglib-1.2.so.0 + 0x108e3 (0x403428e3)
	 libglib-1.2.so.0 + 0x10995 (0x40342995)
	 nsAppShell::DispatchNativeEvent()
	 nsXULWindow::ShowModal()
	 nsWebShellWindow::ShowModal()
	 nsContentTreeOwner::ShowAsModal()
	 nsWindowWatcher::OpenWindowJS()
	 nsWindowWatcher::OpenWindow()
	 nsPromptService::DoDialog()
	 nsPromptService::PromptPassword()
	 nsPrompt::PromptPassword()
	 si_CheckGetPassword()
	 SINGSIGN_PromptPassword()
	 nsSingleSignOnPrompt::PromptPassword()
	 nsMsgIncomingServer::GetPasswordWithUI()
	 nsPop3Protocol::GetPassword()
	 nsPop3Protocol::SendPassword()
	 nsPop3Protocol::ProcessProtocolState()
	 nsMsgProtocol::OnDataAvailable()
	 nsOnDataAvailableEvent::HandleEvent()
	 nsARequestObserverEvent::HandlePLEvent()
	 PL_HandleEvent()
	 PL_ProcessPendingEvents()
	 nsEventQueueImpl::ProcessPendingEvents()
	 event_processor_callback()
	 our_gdk_io_invoke()
	 libglib-1.2.so.0 + 0xec10 (0x40340c10)
	 libglib-1.2.so.0 + 0x102d9 (0x403422d9)
	 libglib-1.2.so.0 + 0x108e3 (0x403428e3)
	 libglib-1.2.so.0 + 0x10a7c (0x40342a7c)
	 libgtk-1.2.so.0 + 0x8dd97 (0x40265d97)
	 nsAppShell::Run()
	 nsAppShellService::Run()
	 main1()
	 main()
	 libc.so.6 + 0x18a42 (0x40437a42)

COMMENTS/URLs:

     (37572002)	Comments: Trying netscape 6.2
     (37512026)	Comments: sucks
     (37506921)	Comments: fuck 2
     (37505377)	Comments: netscape sucks i ve spent 2houres to activate an acount and now
netscape goes down i m verry angry 

Comment 30

[Kevin McCluskey (gone)]

Since it crashes in nsRenderingContextGTK::CopyOffScreenBits

It is probable that one of the following calls within CopyOffScreenBits is
causing the crash:

destsurf->GetDrawable(...)  (destsurf is set to mOffscreenSurface)
aSrcSurf->GetDrawable(...)
mTranMatrix->TransformCoord(...)

There are null checks at the top of CopyOffScreenBits for 
aSrcSurf
mTranMatrix 
mSurface

so either 
destsurf is null because mOffscreenSurface is null which causes
destsurf->GetDrawable to crash 

or one of the following has a stale pointer
-----------------
aSrcSurf 
mOffScreenSurface
mTranMatrix

Comment 31

[Kevin McCluskey (gone)]

Attachment: Check for null mOffscreenSurface in CopyOffScreenBits

Another attempt to prevent this topcrasher

Comment 32

[Roland Mainz]

Comment on attachment 69367 [details] [diff] [review]
Check for null mOffscreenSurface in CopyOffScreenBits

1. What about turning this into
-- snip --
NS_ENSURE_TRUE(mOffscreenSurface != nsnull, NS_ERROR_NULL_POINTER);
/* much shorter */
-- snip --
2. Can you patch nsRenderingContextXlib.cpp, too - or should I provide a patch
?

Comment 33

[Kevin McCluskey (gone)]

Attachment: patch using Roland's suggestion

Comment 34

[Kevin McCluskey (gone)]

I'm not sure if this is causing a problem on the XLIB implementation, but it
wouldn't hurt to check for a null mOffscreenSurface anyway. Roland: Could you
provide the patch for the XLIB implementation within a separate bug?

Comment 35

[Roland Mainz]

Kevin McCluskey wrote:
> I'm not sure if this is causing a problem on the XLIB implementation, but it
> wouldn't hurt to check for a null mOffscreenSurface anyway.

Xlib gfx works exactly like GTK+ gfx code except that
1. It does not use GDK/GTK+ libraries
2. Implements support for printer devices ("Xprint" - but those changes are very
small and mainly offloaded into subclasses of the Xlib gfx classes (e.g.
|nsRenderingContextXp| is a subclass of |nsRenderingContextXlib|)) ...

> Roland: Could you
> provide the patch for the XLIB implementation within a separate bug?

Filing a seperate bug is always bad. It makes searching for bugs harder and
causes "bloat" in bugzilla as each GTK+ change would need a Xlib gfx counterpart
(==twice the bugs). See the note above about how Xlib gfx compares to GTK+ gfx -
Xlib is nearly line-by-line the same code.
If you do not have the time to look at the XLib gfx code then CC: me to the
bugs, I'll file the patches... :)

Comment 36

[Roland Mainz]

Attachment: Patch for both GTK+ and Xlib gfx

Comment 37

[Marc Attinasi]

Comment on attachment 69586 [details] [diff] [review]
Patch for both GTK+ and Xlib gfx

sr=attinasi

Comment 38

[Stuart Parmenter]

Comment on attachment 69586 [details] [diff] [review]
Patch for both GTK+ and Xlib gfx

r=pavlov

Comment 39

[Kevin McCluskey (gone)]

Checked in patch 69586

Marking fixed.

Comment 40

[Chris Petersen]

Marking verified in the April 7th Linux Red hat build (2002-04-07-06).