770424 - crash in PresShell::Paint

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

It's #6 top crasher in today's build and first appeared in 16.0a1/20120701. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=f08d285b63b0&tochange=d9d61d199b11
It's likely a regression from bug 539356.

One comment says: "View a picture in Facebook overlay with Tetris battle running in the background".

Signature 	PresShell::Paint More Reports Search
UUID	cad2614e-59af-431b-9123-91b642120703
Date Processed	2012-07-03 05:29:55
Uptime	809
Last Crash	13.5 minutes before submission
Install Age	6.1 hours since version was first installed.
Install Time	2012-07-02 23:24:23
Product	Firefox
Version	16.0a1
Build ID	20120702030551
Release Channel	nightly
OS	Linux
OS Version	0.0.0 Linux 3.1.10-1.13-desktop #1 SMP PREEMPT Tue Jun 12 13:11:31 UTC 2012 (44a489e) x86_64
Build Architecture	amd64
Build Architecture Info	family 6 model 15 stepping 13
Crash Reason	SIGSEGV
Crash Address	0x0
App Notes 	
OpenGL: Tungsten Graphics, Inc -- Mesa DRI Intel(R) 965GM  -- 2.1 Mesa 7.11 -- texture_from_pixmap
EMCheckCompatibility	True

Frame 	Module 	Signature 	Source
0 	libxul.so 	PresShell::Paint 	nsIWidget.h:1045
1 	libxul.so 	nsViewManager::Refresh 	view/src/nsViewManager.cpp:346
2 	libxul.so 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:798
3 	libxul.so 	HandleEvent 	view/src/nsView.cpp:127
4 	libxul.so 	nsWindow::OnExposeEvent 	widget/gtk2/nsWindow.cpp:474
5 	libxul.so 	expose_event_cb 	widget/gtk2/nsWindow.cpp:5091
6 	libgtk-x11-2.0.so.0.2400.7 	libgtk-x11-2.0.so.0.2400.7@0x140957 	
7 	libgobject-2.0.so.0.3000.1 	libgobject-2.0.so.0.3000.1@0xfa13 	
8 	firefox 	malloc 	jemalloc.c:1629
9 	libglib-2.0.so.0.3000.1 	libglib-2.0.so.0.3000.1@0x359c2 	
10 	libglib-2.0.so.0.3000.1 	libglib-2.0.so.0.3000.1@0x2f683f 	
11 	libpthread-2.14.1.so 	libpthread-2.14.1.so@0xb1af 
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=PresShell%3A%3APaint

Comment 1

[Scoobidiver (away)]

Crashes are gone after 16.0a1/20120703110846. The working range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1d370ca5bb8d&tochange=675f55c4310c
It's caused by the backout of bug 539356.

Comment 2

[Scoobidiver (away)]

Crashes are back from 17.0a1/20120814 with about 25 crashes per build. The new regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=f89feda9d997&tochange=22288130fea2
It's likely a regression from bug 539356.

One comment says: "Resizing a window, 3rd time it crashed today."

Comment 3

[Scoobidiver (away)]

Again, crashes went away after 17.0a1/20120821.

Comment 4

[Scoobidiver (away)]

It's no longer a top crasher in 17.0a2 or 18.0a1.

Comment 5

[Scoobidiver (away)]

There are only two crashes over the last week.

Comment 6

[Lukas Blakk [:lsblakk] use ?needinfo]

Given the reduction in crash volume, untracking.

Comment 7

[Stefan]

2012-08-14-03-05-21-mozilla-central + libflash.so 11.2.202.238 (64 bit) crashes.

Comment 8

[Scoobidiver (away)]

(In reply to Scoobidiver from comment #3)
> Again, crashes went away after 17.0a1/20120821.
That is on Linux. On Windows, it appeared in 17.0a1/20120822. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=360ab7771e27&tochange=abc17059522b

It's #42 top browser crasher in 17.0a2 and #83 in 18.0a1.

Here is the stack trace:
Frame 	Module 	Signature 	Source
0 	xul.dll 	PresShell::Paint 	layout/base/nsPresShell.cpp:5275
1 	xul.dll 	nsViewManager::Refresh 	view/src/nsViewManager.cpp:369
2 	xul.dll 	nsViewManager::PaintWindow 	view/src/nsViewManager.cpp:709
3 	xul.dll 	nsView::PaintWindow 	view/src/nsView.cpp:1034
4 	xul.dll 	nsWindow::OnPaint 	widget/windows/nsWindowGfx.cpp:419
5 	xul.dll 	nsWindow::ProcessMessage 	widget/windows/nsWindow.cpp:4727
6 	xul.dll 	nsWindow::WindowProcInternal 	widget/windows/nsWindow.cpp:4336
7 	xul.dll 	CallWindowProcCrashProtected 	xpcom/base/nsCrashOnException.cpp:32
8 	xul.dll 	nsWindow::WindowProc 	widget/windows/nsWindow.cpp:4278
9 	user32.dll 	InternalCallWinProc 	
10 	user32.dll 	UserCallWinProcCheckWow 	
11 	user32.dll 	DispatchClientMessage 	
12 	user32.dll 	__fnDWORD 	
13 	ntdll.dll 	KiUserCallbackDispatcher 	
14 	xul.dll 	nsIMM32Handler::ProcessMessage 	widget/windows/nsIMM32Handler.cpp:353
15 	user32.dll 	DispatchMessageW 	
16 	xul.dll 	nsAppShell::ProcessNextNativeEvent 	widget/windows/nsAppShell.cpp:322
17 	xul.dll 	nsBaseAppShell::OnProcessNextEvent 	widget/xpwidgets/nsBaseAppShell.cpp:280
18 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:586
19 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:82
20 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:201
21 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:175
22 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:163
23 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:232
24 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:273
25 	xul.dll 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3835
26 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3912
27 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3988

More reports at https://crash-stats.mozilla.com/report/list?signature=PresShell%3A%3APaint%28nsIView*%2C+nsRegion+const%26%2C+nsIPresShell%3A%3APaintType%2C+bool%29

Comment 9

[Matt Woodrow (:mattwoodrow)]

Attachment: Check for null widget after we call ProcessPendingUpdates

Stack looks like we're crashing with a null widget in PresShell::Paint.

I guess calling ProcessPendingUpdates could cause our widget to go away, so this just moves the null check to after that call.

Comment 10

[Matt Woodrow (:mattwoodrow)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/34a36c8a9ebe

Comment 11

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/34a36c8a9ebe