Crash in nsIWidget::GetLayerManager at ../../dist/include/nsIWidget.h:1051

RESOLVED WONTFIX

Status

()

Core
Layout
--
critical
RESOLVED WONTFIX
6 years ago
5 years ago

People

(Reporter: Octoploid, Unassigned)

Tracking

({crash, regression})

17 Branch
x86_64
Linux
crash, regression
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/17.0 Firefox/17.0
Build ID: 20120816224232

Steps to reproduce:

Open http://www.zdf.de/ZDFmediathek/hauptnavigation/startseite 


Actual results:

Firefox (somtimes) crashes:

(firefox:32061): Gdk-WARNING **: Native Windows wider or taller than 65535 pixels are not supported

Program received signal SIGSEGV, Segmentation fault.
nsIWidget::GetLayerManager (this=0x0, aAllowRetaining=0x7fffffffaf77) at ../../dist/include/nsIWidget.h:1051
1051                                   LAYER_MANAGER_CURRENT, aAllowRetaining);
(gdb) bt
#0  nsIWidget::GetLayerManager (this=0x0, aAllowRetaining=0x7fffffffaf77) at ../../dist/include/nsIWidget.h:1051
#1  0x00007ffff58470fb in PresShell::Paint (this=0x7ffff2849f00, aViewToPaint=0x7fffdd19c200, aDirtyRegion=..., 
    aType=nsIPresShell::PaintType_Composite, aWillSendDidPaint=<optimized out>) at /var/tmp/mozilla-central/layout/base/nsPresShell.cpp:5280
#2  0x00007ffff5b01279 in nsViewManager::Refresh (this=this@entry=0x7fffebbbf3d0, aView=0x7fffdd19c200, aRegion=..., 
    aWillSendDidPaint=aWillSendDidPaint@entry=true) at /var/tmp/mozilla-central/view/src/nsViewManager.cpp:362
#3  0x00007ffff5b022f8 in nsViewManager::PaintWindow (this=0x7fffebbbf3d0, aWidget=0x7fffca5f1e00, aRegion=..., aSentWillPaint=<optimized out>, 
    aWillSendDidPaint=<optimized out>) at /var/tmp/mozilla-central/view/src/nsViewManager.cpp:698
#4  0x00007ffff5aff991 in nsView::PaintWindow (this=<optimized out>, aWidget=0x7fffca5f1e00, aRegion=..., aSentWillPaint=<optimized out>, 
    aWillSendDidPaint=<optimized out>) at /var/tmp/mozilla-central/view/src/nsView.cpp:1033
#5  0x00007ffff5f45d6e in nsWindow::OnExposeEvent (this=0x7fffca5f1e00, aEvent=aEvent@entry=0x7fffffffb770)
    at /var/tmp/mozilla-central/widget/gtk2/nsWindow.cpp:2206
#6  0x00007ffff5f46101 in expose_event_cb (widget=<optimized out>, event=0x7fffffffb770) at /var/tmp/mozilla-central/widget/gtk2/nsWindow.cpp:5052
#7  0x00007ffff453aad1 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#8  0x00007ffff4d35359 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#9  0x00007ffff4d461c0 in ?? () from /usr/lib/libgobject-2.0.so.0
#10 0x00007ffff4d4de3d in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#11 0x00007ffff4d4e382 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#12 0x00007ffff464c25e in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#13 0x00007ffff4539763 in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#14 0x00007ffff4220184 in ?? () from /usr/lib/libgdk-x11-2.0.so.0
#15 0x00007ffff421b5f7 in ?? () from /usr/lib/libgdk-x11-2.0.so.0
#16 0x00007ffff421d551 in gdk_window_process_all_updates () from /usr/lib/libgdk-x11-2.0.so.0
#17 0x00007ffff44bfed1 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#18 0x00007ffff41fbc4f in ?? () from /usr/lib/libgdk-x11-2.0.so.0
#19 0x00007ffff4c4b074 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#20 0x00007ffff4c4b3e4 in ?? () from /usr/lib/libglib-2.0.so.0
#21 0x00007ffff4c4b4ac in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#22 0x00007ffff5f466c0 in nsAppShell::ProcessNextNativeEvent (this=<optimized out>, mayWait=<optimized out>)
    at /var/tmp/mozilla-central/widget/gtk2/nsAppShell.cpp:131
#23 0x00007ffff5f5bb1d in nsBaseAppShell::DoProcessNextNativeEvent (this=this@entry=0x7ffff054ff90, mayWait=mayWait@entry=false, 
    recursionDepth=recursionDepth@entry=0) at /var/tmp/mozilla-central/widget/xpwidgets/nsBaseAppShell.cpp:139
#24 0x00007ffff5f5bbe4 in nsBaseAppShell::OnProcessNextEvent (this=0x7ffff054ff90, thr=0x7ffff712a060, mayWait=false, recursionDepth=0)
    at /var/tmp/mozilla-central/widget/xpwidgets/nsBaseAppShell.cpp:280
#25 0x00007ffff607fe15 in nsThread::ProcessNextEvent (this=0x7ffff712a060, mayWait=<optimized out>, result=0x7fffffffbadf)
    at /var/tmp/mozilla-central/xpcom/threads/nsThread.cpp:586
#26 0x00007ffff6057568 in NS_ProcessNextEvent_P (thread=<optimized out>, mayWait=<optimized out>)
    at /var/tmp/moz-build-dir/xpcom/build/nsThreadUtils.cpp:220
#27 0x00007ffff5fb97f6 in mozilla::ipc::MessagePump::Run (this=0x7ffff281f580, aDelegate=0x7ffff7176e00)
    at /var/tmp/mozilla-central/ipc/glue/MessagePump.cpp:82
#28 0x00007ffff609b511 in RunHandler (this=0x7ffff7176e00) at /var/tmp/mozilla-central/ipc/chromium/src/base/message_loop.cc:201
#29 MessageLoop::Run (this=0x7ffff7176e00) at /var/tmp/mozilla-central/ipc/chromium/src/base/message_loop.cc:175
#30 0x00007ffff5f5b64f in nsBaseAppShell::Run (this=0x7ffff054ff90) at /var/tmp/mozilla-central/widget/xpwidgets/nsBaseAppShell.cpp:163
#31 0x00007ffff5e528e1 in nsAppStartup::Run (this=0x7ffff0566bf0) at /var/tmp/mozilla-central/toolkit/components/startup/nsAppStartup.cpp:271
#32 0x00007ffff56e5343 in XREMain::XRE_mainRun (this=this@entry=0x7fffffffbd08) at /var/tmp/mozilla-central/toolkit/xre/nsAppRunner.cpp:3800
#33 0x00007ffff56e5513 in XREMain::XRE_main (this=this@entry=0x7fffffffbd08, argc=argc@entry=1, argv=argv@entry=0x7fffffffe058, 
    aAppData=aAppData@entry=0x4258f0) at /var/tmp/mozilla-central/toolkit/xre/nsAppRunner.cpp:3877
#34 0x00007ffff56e5715 in XRE_main (argc=1, argv=0x7fffffffe058, aAppData=0x4258f0, aFlags=<optimized out>)
    at /var/tmp/mozilla-central/toolkit/xre/nsAppRunner.cpp:3953
#35 0x0000000000402976 in do_main (argv=0x7fffffffe058, argc=1) at /var/tmp/mozilla-central/browser/app/nsBrowserApp.cpp:174
#36 main (argc=<optimized out>, argv=<optimized out>) at /var/tmp/mozilla-central/browser/app/nsBrowserApp.cpp:279
(Reporter)

Comment 1

6 years ago
Probably introduced by:

commit 52e96e2d622e6a8d1f878008f882654bcc678927
Author: Matt Woodrow <mwoodrow@mozilla.com>
Date:   Mon Aug 13 22:10:10 2012 +1200

    Bug 539356 - Part 8b - Move painting of retained layers to the view manager flush, and only composite on the paint event. r=roc
    * * *
    Fix Empty transactions with the new paint timing
(Reporter)

Comment 2

6 years ago
Created attachment 652743 [details] [diff] [review]
Check that aViewToPaint->GetWidget() is not the nullptr

What about the attached patch?
At least it fixes the issue for me.

Comment 3

6 years ago
It looks like a dupe of bug 770024.
Blocks: 539956
Severity: normal → critical
Status: UNCONFIRMED → NEW
Crash Signature: [@ nsIWidget::GetLayerManager]
Component: Untriaged → Layout
Ever confirmed: true
Keywords: crash, regression
Product: Firefox → Core

Comment 4

6 years ago
(In reply to Scoobidiver from comment #3)
> It looks like a dupe of bug 770024.
I meant bug 770424.
tn: Do you have any ideas here?

It appears that the view we got in PaintWindow via nsView::GetViewFor is returning null for nsIView::GetWidget(). Does that make sense?
The problematic view looks to be a view for a plugin. It looks like plugin views have always had their widget field unset (ie null), so I think the problem is that we are getting an expose event at all here, where we didn't get one at all before.
(Reporter)

Comment 7

5 years ago
Now review for 9 month, closing.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → WONTFIX
If this is still a problem you should leave it open.
You need to log in before you can comment on or make changes to this bug.