783528 - Crash in nsIWidget::GetLayerManager at ../../dist/include/nsIWidget.h:1051

Status: RESOLVED WONTFIX

(Core :: Layout, defect)

Description

[Octoploid]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/17.0 Firefox/17.0
Build ID: 20120816224232

Steps to reproduce:

Open http://www.zdf.de/ZDFmediathek/hauptnavigation/startseite 


Actual results:

Firefox (somtimes) crashes:

(firefox:32061): Gdk-WARNING **: Native Windows wider or taller than 65535 pixels are not supported

Program received signal SIGSEGV, Segmentation fault.
nsIWidget::GetLayerManager (this=0x0, aAllowRetaining=0x7fffffffaf77) at ../../dist/include/nsIWidget.h:1051
1051                                   LAYER_MANAGER_CURRENT, aAllowRetaining);
(gdb) bt
#0  nsIWidget::GetLayerManager (this=0x0, aAllowRetaining=0x7fffffffaf77) at ../../dist/include/nsIWidget.h:1051
#1  0x00007ffff58470fb in PresShell::Paint (this=0x7ffff2849f00, aViewToPaint=0x7fffdd19c200, aDirtyRegion=..., 
    aType=nsIPresShell::PaintType_Composite, aWillSendDidPaint=<optimized out>) at /var/tmp/mozilla-central/layout/base/nsPresShell.cpp:5280
#2  0x00007ffff5b01279 in nsViewManager::Refresh (this=this@entry=0x7fffebbbf3d0, aView=0x7fffdd19c200, aRegion=..., 
    aWillSendDidPaint=aWillSendDidPaint@entry=true) at /var/tmp/mozilla-central/view/src/nsViewManager.cpp:362
#3  0x00007ffff5b022f8 in nsViewManager::PaintWindow (this=0x7fffebbbf3d0, aWidget=0x7fffca5f1e00, aRegion=..., aSentWillPaint=<optimized out>, 
    aWillSendDidPaint=<optimized out>) at /var/tmp/mozilla-central/view/src/nsViewManager.cpp:698
#4  0x00007ffff5aff991 in nsView::PaintWindow (this=<optimized out>, aWidget=0x7fffca5f1e00, aRegion=..., aSentWillPaint=<optimized out>, 
    aWillSendDidPaint=<optimized out>) at /var/tmp/mozilla-central/view/src/nsView.cpp:1033
#5  0x00007ffff5f45d6e in nsWindow::OnExposeEvent (this=0x7fffca5f1e00, aEvent=aEvent@entry=0x7fffffffb770)
    at /var/tmp/mozilla-central/widget/gtk2/nsWindow.cpp:2206
#6  0x00007ffff5f46101 in expose_event_cb (widget=<optimized out>, event=0x7fffffffb770) at /var/tmp/mozilla-central/widget/gtk2/nsWindow.cpp:5052
#7  0x00007ffff453aad1 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#8  0x00007ffff4d35359 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#9  0x00007ffff4d461c0 in ?? () from /usr/lib/libgobject-2.0.so.0
#10 0x00007ffff4d4de3d in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#11 0x00007ffff4d4e382 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#12 0x00007ffff464c25e in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#13 0x00007ffff4539763 in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#14 0x00007ffff4220184 in ?? () from /usr/lib/libgdk-x11-2.0.so.0
#15 0x00007ffff421b5f7 in ?? () from /usr/lib/libgdk-x11-2.0.so.0
#16 0x00007ffff421d551 in gdk_window_process_all_updates () from /usr/lib/libgdk-x11-2.0.so.0
#17 0x00007ffff44bfed1 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#18 0x00007ffff41fbc4f in ?? () from /usr/lib/libgdk-x11-2.0.so.0
#19 0x00007ffff4c4b074 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#20 0x00007ffff4c4b3e4 in ?? () from /usr/lib/libglib-2.0.so.0
#21 0x00007ffff4c4b4ac in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#22 0x00007ffff5f466c0 in nsAppShell::ProcessNextNativeEvent (this=<optimized out>, mayWait=<optimized out>)
    at /var/tmp/mozilla-central/widget/gtk2/nsAppShell.cpp:131
#23 0x00007ffff5f5bb1d in nsBaseAppShell::DoProcessNextNativeEvent (this=this@entry=0x7ffff054ff90, mayWait=mayWait@entry=false, 
    recursionDepth=recursionDepth@entry=0) at /var/tmp/mozilla-central/widget/xpwidgets/nsBaseAppShell.cpp:139
#24 0x00007ffff5f5bbe4 in nsBaseAppShell::OnProcessNextEvent (this=0x7ffff054ff90, thr=0x7ffff712a060, mayWait=false, recursionDepth=0)
    at /var/tmp/mozilla-central/widget/xpwidgets/nsBaseAppShell.cpp:280
#25 0x00007ffff607fe15 in nsThread::ProcessNextEvent (this=0x7ffff712a060, mayWait=<optimized out>, result=0x7fffffffbadf)
    at /var/tmp/mozilla-central/xpcom/threads/nsThread.cpp:586
#26 0x00007ffff6057568 in NS_ProcessNextEvent_P (thread=<optimized out>, mayWait=<optimized out>)
    at /var/tmp/moz-build-dir/xpcom/build/nsThreadUtils.cpp:220
#27 0x00007ffff5fb97f6 in mozilla::ipc::MessagePump::Run (this=0x7ffff281f580, aDelegate=0x7ffff7176e00)
    at /var/tmp/mozilla-central/ipc/glue/MessagePump.cpp:82
#28 0x00007ffff609b511 in RunHandler (this=0x7ffff7176e00) at /var/tmp/mozilla-central/ipc/chromium/src/base/message_loop.cc:201
#29 MessageLoop::Run (this=0x7ffff7176e00) at /var/tmp/mozilla-central/ipc/chromium/src/base/message_loop.cc:175
#30 0x00007ffff5f5b64f in nsBaseAppShell::Run (this=0x7ffff054ff90) at /var/tmp/mozilla-central/widget/xpwidgets/nsBaseAppShell.cpp:163
#31 0x00007ffff5e528e1 in nsAppStartup::Run (this=0x7ffff0566bf0) at /var/tmp/mozilla-central/toolkit/components/startup/nsAppStartup.cpp:271
#32 0x00007ffff56e5343 in XREMain::XRE_mainRun (this=this@entry=0x7fffffffbd08) at /var/tmp/mozilla-central/toolkit/xre/nsAppRunner.cpp:3800
#33 0x00007ffff56e5513 in XREMain::XRE_main (this=this@entry=0x7fffffffbd08, argc=argc@entry=1, argv=argv@entry=0x7fffffffe058, 
    aAppData=aAppData@entry=0x4258f0) at /var/tmp/mozilla-central/toolkit/xre/nsAppRunner.cpp:3877
#34 0x00007ffff56e5715 in XRE_main (argc=1, argv=0x7fffffffe058, aAppData=0x4258f0, aFlags=<optimized out>)
    at /var/tmp/mozilla-central/toolkit/xre/nsAppRunner.cpp:3953
#35 0x0000000000402976 in do_main (argv=0x7fffffffe058, argc=1) at /var/tmp/mozilla-central/browser/app/nsBrowserApp.cpp:174
#36 main (argc=<optimized out>, argv=<optimized out>) at /var/tmp/mozilla-central/browser/app/nsBrowserApp.cpp:279

Comment 1

[Octoploid]

Probably introduced by:

commit 52e96e2d622e6a8d1f878008f882654bcc678927
Author: Matt Woodrow <[e-mail]>
Date:   Mon Aug 13 22:10:10 2012 +1200

    Bug 539356 - Part 8b - Move painting of retained layers to the view manager flush, and only composite on the paint event. r=roc
    * * *
    Fix Empty transactions with the new paint timing

Comment 2

[Octoploid]

Attachment: Check that aViewToPaint->GetWidget() is not the nullptr

What about the attached patch?
At least it fixes the issue for me.

Comment 3

[Scoobidiver (away)]

It looks like a dupe of bug 770024.

Comment 4

[Scoobidiver (away)]

(In reply to Scoobidiver from comment #3)
> It looks like a dupe of bug 770024.
I meant bug 770424.

Comment 5

[Matt Woodrow (:mattwoodrow)]

tn: Do you have any ideas here?

It appears that the view we got in PaintWindow via nsView::GetViewFor is returning null for nsIView::GetWidget(). Does that make sense?

Comment 6

[Timothy Nikkel (:tnikkel)]

The problematic view looks to be a view for a plugin. It looks like plugin views have always had their widget field unset (ie null), so I think the problem is that we are getting an expose event at all here, where we didn't get one at all before.

Comment 7

[Octoploid]

Now review for 9 month, closing.

Comment 8

[Timothy Nikkel (:tnikkel)]

If this is still a problem you should leave it open.