733324 - Crash in nsWindow::GetClientOffset with abort message: "X_CreatePixmap: BadAlloc (insufficient resources for operation)"

Status: RESOLVED INCOMPLETE

(Core :: Graphics, defect)

Description

[Scoobidiver (away)]

Some comments say:
"zooming in on a bing map, birds-eye view, causes a minute or more period of unresponsiveness of browser and all of windowing environment. I was clicking around, probably just queueing up more refresh work, then ff crashed."
"freshly looked up bing street map (just line drawing map) tried to zoom in several times. map zoomed slightly, entire ff and linux desktop unresponsive for over a minute, then ff crashed."
"www.bing.com/maps look up 265 thoma, reno, nv click ONCE on zoom in -- unresonsive desktop for over a minute but zoom eventually redraws correctly. click several times to zoom in farther, where clicks are queued up because redraws are so slow, ff crashes."

Signature 	TouchBadMemory More Reports Search
UUID	71e9ce2c-b549-4368-894d-d1ad32120221
Date Processed	2012-02-21 12:13:56
Uptime	1446
Last Crash	1.9 weeks before submission
Install Age	1.7 weeks since version was first installed.
Install Time	2012-02-09 15:34:54
Product	Firefox
Version	13.0a1
Build ID	20120209031242
Release Channel	nightly
OS	Linux
OS Version	0.0.0 Linux 3.0.0-16-generic #28-Ubuntu SMP Fri Jan 27 17:50:54 UTC 2012 i686
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 14 stepping 8
Crash Reason	SIGSEGV
Crash Address	0x0
User Comments	zooming in on a bing map, birds-eye view, causes a minute or more period of unresponsiveness of browser and all of windowing environment. I was clicking around, probably just queueing up more refresh work, then ff crashed.
App Notes 	
OpenGL: Brian Paul -- Mesa X11 -- 2.1 Mesa 7.11 -- texture_from_pixmap
X_CreatePixmap: BadAlloc (insufficient resources for operation); 240 requests agoxpcom_runtime_abort(###!!! ABORT: X_CreatePixmap: BadAlloc (insufficient resources for operation); 240 requests ago: file /builds/slave/m-cen-lnx-ntly/build/toolkit/xre/nsX11ErrorHandler.cpp, line 190)
EMCheckCompatibility	True

Frame 	Module 	Signature 	Source
0 	libmozalloc.so 	TouchBadMemory 	memory/mozalloc/mozalloc_abort.cpp:68
1 	libmozalloc.so 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:89
2 	libxul.so 	NS_DebugBreak_P 	xpcom/base/nsDebugImpl.cpp:388
3 	libxul.so 	X11Error 	toolkit/xre/nsX11ErrorHandler.cpp:190
4 	libbonoboui-2.so.0.0.0 	libbonoboui-2.so.0.0.0@0x1ea74 	
5 	libX11.so.6.3.0 	_XError 	XlibInt.c:1583
6 	libX11.so.6.3.0 	handle_error 	xcb_io.c:212
7 	libX11.so.6.3.0 	handle_response 	xcb_io.c:324
8 	libX11.so.6.3.0 	_XReply 	xcb_io.c:626
9 	libX11.so.6.3.0 	XGetWindowProperty 	GetProp.c:61
10 	libgdk-x11-2.0.so.0.2400.6 	IA__gdk_property_get 	gdkproperty-x11.c:593
11 	libxul.so 	nsWindow::GetClientOffset 	widget/gtk2/nsWindow.cpp:1600
12 	libxul.so 	nsWindow::GetClientBounds 	widget/gtk2/nsWindow.cpp:1571
13 	libxul.so 	nsView::DoResetWidgetBounds 	view/src/nsView.cpp:443
14 	libxul.so 	nsViewManager::ProcessPendingUpdatesForView 	view/src/nsViewManager.cpp:401
15 	libxul.so 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:1351
16 	libxul.so 	HandleEvent 	view/src/nsView.cpp:158
17 	libxul.so 	nsWindow::OnExposeEvent 	widget/gtk2/nsWindow.cpp:572
18 	libxul.so 	expose_event_cb 	widget/gtk2/nsWindow.cpp:5578
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=TouchBadMemory

Comment 1

[Karl Tomlinson (:karlt)]

I'm not reproducing the BadAlloc, but I'm on a 64-bit system.
I do see unresponsive periods of many seconds.

Attaching a debugger at a random time of unresponsiveness shows drawing a small surface (256x256) from an image to a very large surface (16006x8004) with a large mask (8004x8004), with this stack:

> #6  0x00007faaac50a446 in _cairo_xlib_surface_composite (op=CAIRO_OPERATOR_ADD, src_pattern=0x7fffeb5b58a0, mask_pattern=0x7fffeb5b4cd0, abstract_dst=0x7faa91f25b00, src_x=8002, src_y=0, mask_x=0, mask_y=0, dst_x=8002, dst_y=0, width=8004, height=8004, clip_region=0x0) at /home/karl/moz/dev/gfx/cairo/cairo/src/cairo-xlib-surface.c:2519
> #7  0x00007faaac4d14f8 in _cairo_surface_composite (op=CAIRO_OPERATOR_ADD, src=0x7fffeb5b58a0, mask=0x7fffeb5b4cd0, dst=0x7faa91f25b00, src_x=8002, src_y=0, mask_x=0, mask_y=0, dst_x=8002, dst_y=0, width=8004, height=8004, clip_region=0x0) at /home/karl/moz/dev/gfx/cairo/cairo/src/cairo-surface.c:1889
> #8  0x00007faaac4d40b6 in _clip_and_composite_source (clip=0x0, src=0x7fffeb5b58a0, draw_func=0x7faaac4d446d <_composite_traps_draw_func>, draw_closure=0x7fffeb5b4e40, dst=0x7faa91f25b00, extents=0x7fffeb5b4f00) at /home/karl/moz/dev/gfx/cairo/cairo/src/cairo-surface-fallback.c:379
> #9  0x00007faaac4d417f in _clip_and_composite (clip=0x0, op=CAIRO_OPERATOR_SOURCE, src=0x7fffeb5b58a0, draw_func=0x7faaac4d446d <_composite_traps_draw_func>, draw_closure=0x7fffeb5b4e40, dst=0x7faa91f25b00, extents=0x7fffeb5b4f00) at /home/karl/moz/dev/gfx/cairo/cairo/src/cairo-surface-fallback.c:440
> #10 0x00007faaac4d504a in _clip_and_composite_trapezoids (src=0x7fffeb5b58a0, op=CAIRO_OPERATOR_SOURCE, dst=0x7faa91f25b00, traps=0x7fffeb5b5130, antialias=CAIRO_ANTIALIAS_DEFAULT, clip=0x0, extents=0x7fffeb5b4f00) at /home/karl/moz/dev/gfx/cairo/cairo/src/cairo-surface-fallback.c:875
> #11 0x00007faaac4d5d44 in _cairo_surface_fallback_fill (surface=0x7faa91f25b00, op=CAIRO_OPERATOR_SOURCE, source=0x7fffeb5b58a0, path=0x7faaadf9f9e8, fill_rule=CAIRO_FILL_RULE_WINDING, tolerance=0.10000000000000001, antialias=CAIRO_ANTIALIAS_DEFAULT, clip=0x0) at /home/karl/moz/dev/gfx/cairo/cairo/src/cairo-surface-fallback.c:1213
> #12 0x00007faaac4d21c6 in _cairo_surface_fill (surface=0x7faa91f25b00, op=CAIRO_OPERATOR_SOURCE, source=0x7fffeb5b58a0, path=0x7faaadf9f9e8, fill_rule=CAIRO_FILL_RULE_WINDING, tolerance=0.10000000000000001, antialias=CAIRO_ANTIALIAS_DEFAULT, clip=0x7fffeb5b59c0) at /home/karl/moz/dev/gfx/cairo/cairo/src/cairo-surface.c:2357
> #13 0x00007faaac49eeb6 in _cairo_gstate_fill (gstate=0x7faaadf9f6b0, path=0x7faaadf9f9e8) at /home/karl/moz/dev/gfx/cairo/cairo/src/cairo-gstate.c:1290
> #14 0x00007faaac48bb4f in *INT__moz_cairo_fill_preserve (cr=0x7faaadf9f680) at /home/karl/moz/dev/gfx/cairo/cairo/src/cairo.c:2459
> #15 0x00007faaac3d1ea7 in gfxContext::Fill (this=0x7faa91bff5f0) at /home/karl/moz/dev/gfx/thebes/gfxContext.cpp:329
> #16 0x00007faaac3db59f in gfxSurfaceDrawable::Draw (this=0x7faa91e70070, aContext=0x7faa91bff5f0, aFillRect=..., aRepeat=false, aFilter=@0x7fffeb5b5cec: gfxPattern::FILTER_GOOD, aTransform=...) at /home/karl/moz/dev/gfx/thebes/gfxDrawable.cpp:187
> #17 0x00007faaac405557 in gfxUtils::DrawPixelSnapped (aContext=0x7faa91bff5f0, aDrawable=0x7faa91e70070, aUserSpaceToImageSpace=..., aSubimage=..., aSourceRect=..., aImageRect=..., aFill=..., aFormat=gfxASurface::ImageFormatRGB24, aFilter=@0x7fffeb5b5cec: gfxPattern::FILTER_GOOD) at /home/karl/moz/dev/gfx/thebes/gfxUtils.cpp:422
> #18 0x00007faaaade1ae6 in imgFrame::Draw (this=0x7faa91519770, aContext=0x7faa91bff5f0, aFilter=gfxPattern::FILTER_GOOD, aUserSpaceToImageSpace=..., aFill=..., aPadding=..., aSubimage=...) at /home/karl/moz/dev/image/src/imgFrame.cpp:472
> #19 0x00007faaaadd513b in mozilla::image::RasterImage::Draw (this=0x7faa90f276d0, aContext=0x7faa91bff5f0, aFilter=gfxPattern::FILTER_GOOD, aUserSpaceToImageSpace=..., aFill=..., aSubimage=..., aFlags=0) at /home/karl/moz/dev/image/src/RasterImage.cpp:2609
> #20 0x00007faaaaec1885 in DrawImageInternal (aRenderingContext=0x7faa90b50a10, aImage=0x7faa90f276d0, aGraphicsFilter=gfxPattern::FILTER_GOOD, aDest=..., aFill=..., aAnchor=..., aDirty=..., aImageSize=..., aImageFlags=0) at /home/karl/moz/dev/layout/base/nsLayoutUtils.cpp:3591
> #21 0x00007faaaaec1fdb in nsLayoutUtils::DrawSingleImage (aRenderingContext=0x7faa90b50a10, aImage=0x7faa90f276d0, aGraphicsFilter=gfxPattern::FILTER_GOOD, aDest=..., aDirty=..., aImageFlags=0, aSourceArea=0x0) at /home/karl/moz/dev/layout/base/nsLayoutUtils.cpp:3708
> #22 0x00007faaaafa368a in nsImageFrame::PaintImage (this=0x7faa92278168, aRenderingContext=..., aPt=..., aDirtyRect=..., aImage=0x7faa90f276d0, aFlags=0) at /home/karl/moz/dev/layout/generic/nsImageFrame.cpp:1262
> #23 0x00007faaaafa3151 in nsDisplayImage::Paint (this=0x7faa91620ce0, aBuilder=0x7fffeb5b7ce0, aCtx=0x7faa90b50a10) at /home/karl/moz/dev/layout/generic/nsImageFrame.cpp:1210
> #24 0x00007faaaae35925 in mozilla::FrameLayerBuilder::DrawThebesLayer (aLayer=0x7faa91a88210, aContext=0x7faa91bff5f0, aRegionToDraw=..., aRegionToInvalidate=..., aCallbackData=0x7fffeb5b7ce0) at /home/karl/moz/dev/layout/base/FrameLayerBuilder.cpp:2179
> #25 0x00007faaac425ed4 in mozilla::layers::BasicThebesLayer::PaintBuffer (this=0x7faa91a88210, aContext=0x7faa91bff5f0, aRegionToDraw=..., aExtendedRegionToDraw=..., aRegionToInvalidate=..., aDidSelfCopy=false, aCallback=0x7faaaae34fbe <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0x7fffeb5b7ce0) at /home/karl/moz/dev/gfx/layers/basic/BasicLayers.cpp:564
> #26 0x00007faaac42d193 in mozilla::layers::BasicShadowableThebesLayer::PaintBuffer (this=0x7faa91a88210, aContext=0x7faa91bff5f0, aRegionToDraw=..., aExtendedRegionToDraw=..., aRegionToInvalidate=..., aDidSelfCopy=false, aCallback=0x7faaaae34fbe <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0x7fffeb5b7ce0) at /home/karl/moz/dev/gfx/layers/basic/BasicLayers.cpp:2366
> #27 0x00007faaac426bbd in mozilla::layers::BasicThebesLayer::PaintThebes (this=0x7faa91a88210, aContext=0x7faa91f7f880, aCallback=0x7faaaae34fbe <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0x7fffeb5b7ce0, aReadback=0x7fffeb5b6f30) at /home/karl/moz/dev/gfx/layers/basic/BasicLayers.cpp:754
> #28 0x00007faaac42b69d in mozilla::layers::BasicLayerManager::PaintLayer (this=0x16e5820, aTarget=0x7faa91f7f880, aLayer=0x7faa91a88210, aCallback=0x7faaaae34fbe <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0x7fffeb5b7ce0, aReadback=0x7fffeb5b6f30) at /home/karl/moz/dev/gfx/layers/basic/BasicLayers.cpp:1923
> #29 0x00007faaac42b7a0 in mozilla::layers::BasicLayerManager::PaintLayer (this=0x16e5820, aTarget=0x7faa91f7f880, aLayer=0x7faa90e8cd30, aCallback=0x7faaaae34fbe <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0x7fffeb5b7ce0, aReadback=0x7fffeb5b72d0) at /home/karl/moz/dev/gfx/layers/basic/BasicLayers.cpp:1938
> #30 0x00007faaac42b7a0 in mozilla::layers::BasicLayerManager::PaintLayer (this=0x16e5820, aTarget=0x7faa91f7f880, aLayer=0x7faa922c4830, aCallback=0x7faaaae34fbe <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0x7fffeb5b7ce0, aReadback=0x7fffeb5b7670) at /home/karl/moz/dev/gfx/layers/basic/BasicLayers.cpp:1938
> #31 0x00007faaac42b7a0 in mozilla::layers::BasicLayerManager::PaintLayer (this=0x16e5820, aTarget=0x7faa915201d0, aLayer=0x7faa909aba80, aCallback=0x7faaaae34fbe <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0x7fffeb5b7ce0, aReadback=0x0) at /home/karl/moz/dev/gfx/layers/basic/BasicLayers.cpp:1938
> #32 0x00007faaac42a274 in mozilla::layers::BasicLayerManager::EndTransactionInternal (this=0x16e5820, aCallback=0x7faaaae34fbe <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0x7fffeb5b7ce0, aFlags=mozilla::layers::LayerManager::END_DEFAULT) at /home/karl/moz/dev/gfx/layers/basic/BasicLayers.cpp:1632
> #33 0x00007faaac429dea in mozilla::layers::BasicLayerManager::EndTransaction (this=0x16e5820, aCallback=0x7faaaae34fbe <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0x7fffeb5b7ce0, aFlags=mozilla::layers::LayerManager::END_DEFAULT) at /home/karl/moz/dev/gfx/layers/basic/BasicLayers.cpp:1583
> #34 0x00007faaac431d82 in mozilla::layers::BasicShadowLayerManager::EndTransaction (this=0x16e5820, aCallback=0x7faaaae34fbe <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0x7fffeb5b7ce0, aFlags=mozilla::layers::LayerManager::END_DEFAULT) at /home/karl/moz/dev/gfx/layers/basic/BasicLayers.cpp:3366
> #35 0x00007faaaae872fa in nsDisplayList::PaintForFrame (this=0x7fffeb5b8320, aBuilder=0x7fffeb5b7ce0, aCtx=0x0, aForFrame=0x7faa9010f8b8, aFlags=5) at /home/karl/moz/dev/layout/base/nsDisplayList.cpp:637
> #36 0x00007faaaae86cc6 in nsDisplayList::PaintRoot (this=0x7fffeb5b8320, aBuilder=0x7fffeb5b7ce0, aCtx=0x0, aFlags=5) at /home/karl/moz/dev/layout/base/nsDisplayList.cpp:542
> #37 0x00007faaaaebc648 in nsLayoutUtils::PaintFrame (aRenderingContext=0x0, aFrame=0x7faa9010f8b8, aDirtyRegion=..., aBackstop=4294967295, aFlags=260) at /home/karl/moz/dev/layout/base/nsLayoutUtils.cpp:1812
> #38 0x00007faaaaee77a4 in PresShell::Paint (this=0x7faa9011a580, aViewToPaint=0x7faa90119d70, aWidgetToPaint=0x7faa90119e10, aDirtyRegion=..., aIntDirtyRegion=..., aWillSendDidPaint=true) at /home/karl/moz/dev/layout/base/nsPresShell.cpp:5523
> #39 0x00007faaab5c6772 in nsViewManager::Refresh (this=0x7faa90119d10, aView=0x7faa90119d70, aWidget=0x7faa90119e10, aRegion=..., aWillSendDidPaint=true) at /home/karl/moz/dev/view/src/nsViewManager.cpp:377

The destination surface is a very large buffer for a thebes layer.

Comment 2

[Joe Drew (not getting mail)]

Pretty sure this is a dupe of bug 717521.

Comment 3

[Karl Tomlinson (:karlt)]

Looks like it, thanks.

FWIW, this is the layer tree.  The buffer is large, even though transforms are only translations.

> BasicLayerManager (0x16e5820)
>   BasicContainerLayer (0x7faa909aba80) [visible=< (x=0, y=0, w=1418, h=926); >] [opaqueContent] [metrics={ viewport=(x=0, y=0, w=1418, h=926) viewportScroll=(x=0, y=0) displayport=(x=0, y=0, w=0, h=0) scrollId=0 }] [usesTmpSurf]
>     BasicThebesLayer (0x7faa909a5700) [visible=< (x=0, y=0, w=1418, h=87); >] [opaqueContent] [isFixedPosition] [valid=< (x=0, y=0, w=1418, h=87); >]
>     BasicContainerLayer (0x7faa922c4830) [clip=(x=0, y=87, w=1418, h=839)] [visible=< (x=0, y=87, w=1418, h=839); >] [opaqueContent] [isFixedPosition]
>       BasicThebesLayer (0x7faa922caea0) [transform=[ 1 0; 0 1; 0 87; ]] [visible=< (x=0, y=0, w=1418, h=839); >] [opaqueContent] [isFixedPosition] [valid=< (x=0, y=0, w=1418, h=839); >]
>       BasicThebesLayer (0x7faa9229f610) [opaqueContent] [isFixedPosition]
>       BasicContainerLayer (0x7faa90e8cd30) [clip=(x=351, y=187, w=1067, h=739)] [transform=[ 1 0; 0 1; -31651.4 -21098.6; ]] [visible=< (x=32002, y=21315, w=1068, h=710); >] [isFixedPosition]
>         BasicThebesLayer (0x7faa91a88210) [transform=[ 1 0; 0 1; 0 2724; ]] [visible=< (x=27648, y=14675, w=16006, h=8004); >] [isFixedPosition]
>       BasicThebesLayer (0x7faa909c3620) [transform=[ 1 0; 0 1; 0 87; ]] [visible=< (x=351, y=100, w=1067, h=140); (x=349, y=240, w=1069, h=56); (x=351, y=296, w=1067, h=525); (x=351, y=821, w=1067, h=18); >] [componentAlpha] [isFixedPosition]
>     BasicThebesLayer (0x7faa91ad4af0) [visible=< (x=0, y=905, w=180, h=21); >] [isFixedPosition] [valid=< (x=0, y=905, w=180, h=21); >]

Comment 5

[Henry Wertz]

     I typed this up for Bug 768174, but it was marked a dup of this bug (and I must agree it probably is the same root cause.)
Here's some bug submissions with firefox 14 (the Ubuntu'ized Ubuntu 13 fails to submit, but it crashed plenty too).  
bp-ee6dbe77-a84f-4f79-bdc4-7e45a2120625
bp-c2cd1723-5582-49fc-87f4-919b72120625
bp-134de989-519b-40a5-83a7-393392120625

      Also, I found a "fix" for this that stopped the crashing for me (*and* prevented a visual corruption on a few >4096 pixel tall images):  
MOZ_DISABLE_IMAGE_OPTIMIZE=1
      On pages where I saw gfx-graphics-xlib exceeding 40MB, with this setting it stays very near to zero.  (I've got http://romanticallyapocalyptic.com/61 open in a second window -- not a tab since I know that'd be flushed...and I have  0.33MB gfx-surface-xlib and 58.91MB gfx-surface-image.)  I haven't noticed any performance difference (other than not crashing!), I think this just plays the old shell game of shifting a similar amount of ram usage off Xorg and onto firefox.
     http://www.uiowa.edu/homepage/central-photos/ makes a very good test case, I think.  Rather than one huge image, it has loads of thumbnails.  While reading (big image) comics i could go minutes before I crash, this load of thumbnails crashes FF within seconds.

Comment 7

[Scoobidiver (away)]

In addition to comment 5, Bug 851771 has also STR.

Comment 9

[Raul Nicolae Malea]

Related crash report or not? https://crash-stats.mozilla.com/report/index/c85372a4-002f-4546-8c74-b22d72140117
Thanks.

Comment 10

[Karl Tomlinson (:karlt)]

(In reply to Raul Malea from comment #9)
> Related crash report or not?
> https://crash-stats.mozilla.com/report/index/c85372a4-002f-4546-8c74-
> b22d72140117

That looks a bit different to me.  Perhaps a problem in 
liboxygen-gtk.so or perhaps Gecko is providing unexpected parameters to liboxygen-gtk.