787017 - crash in nsBaseWidget::CreateCompositor with abort message: "failed to construct LayersChild: file ../../../widget/xpwidgets/nsBaseWidget.cpp"

Status: RESOLVED FIXED

(Core :: Widget, defect)

Description

[Scoobidiver (away)]

It's similar to bug 776109.
There are currently about 320 crashes with many dupes, making it #7 top crasher in 15.0.

It might be fixed by bug 766251.

Signature 	TouchBadMemory | mozalloc_abort | system@[e-mail]@classes.dex@0x2cd6a More Reports Search
UUID	2120cc43-17e5-4273-b009-484352120830
Date Processed	2012-08-30 12:02:46
Uptime	4
Last Crash	10 seconds before submission
Install Age	2.2 minutes since version was first installed.
Install Time	2012-08-30 12:00:24
Product	FennecAndroid
Version	15.0
Build ID	20120824153430
Release Channel	release
OS	Linux
OS Version	0.0.0 Linux 2.6.32.9-perf #1 PREEMPT Mon Sep 19 08:03:47 2011 armv7l
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGSEGV
Crash Address	0x0
App Notes 	
AdapterVendorID: semc, AdapterDeviceID: R800a.
AdapterDescription: 'Model: 'R800a', Product: 'R800a_1247-6272', Manufacturer: 'Sony Ericsson', Hardware: 'semc''.
xpcom_runtime_abort(###!!! ABORT: failed to construct LayersChild: file /builds/slave/rel-m-rel-andrd-bld/build/widget/xpwidgets/nsBaseWidget.cpp, line 903)
Sony Ericsson R800a
SEMC/R800a_1247-6272/R800a:2.3.4/4.0.2.A.0.42/1f_v3w:user/release-keys
EMCheckCompatibility	True
Adapter Vendor ID	semc
Adapter Device ID	R800a

Frame 	Module 	Signature 	Source
0 	libmozalloc.so 	TouchBadMemory 	memory/mozalloc/mozalloc_abort.cpp:68
1 	libmozalloc.so 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:89
2 	system@[e-mail]@classes.dex 	system@[e-mail]@classes.dex@0x2cd6a 	
3 	system@[e-mail]@classes.dex 	system@[e-mail]@classes.dex@0x20570 	
4 	mnt@[e-mail][e-mail] 	mnt@[e-mail][e-mail]@0xe2c67 	
5 	libmozglue.so 	imalloc 	memory/jemalloc/jemalloc.c:4211
6 	libmozglue.so 	__wrap_malloc 	memory/jemalloc/jemalloc.c:6293
7 	libmozalloc.so 	moz_malloc 	memory/mozalloc/mozalloc.cpp:97
8 	libxul.so 	nsStringBuffer::Alloc 	xpcom/string/src/nsSubstring.cpp:177
9 	libxul.so 	nsAString_internal::MutatePrep 	xpcom/string/src/nsTSubstring.cpp:130
10 	libxul.so 	nsAString_internal::ReplacePrepInternal 	xpcom/string/src/nsTSubstring.cpp:189
11 		@0x3383d4e6 	
12 	libxul.so 	nsAString_internal::Assign 	xpcom/string/src/nsTSubstring.cpp:582
13 	libxul.so 	nsAString_internal::Assign 	xpcom/string/src/nsTSubstring.cpp:347
14 	libxul.so 	mozilla::widget::GfxDriverInfo::~GfxDriverInfo 	nsTSubstring.h:83
15 	libxul.so 	mozilla::widget::GfxInfo::GetGfxDriverInfo 	widget/android/GfxInfo.cpp:262
16 	libxul.so 	mozilla::widget::GfxInfoBase::GetFeatureStatusImpl 	nsTSubstring.h:83
17 	libmozglue.so 	imalloc 	memory/jemalloc/jemalloc.c:4211
18 		@0x33b54506 	
19 	libxul.so 	nsBaseWidget::CreateCompositor 	widget/xpwidgets/nsBaseWidget.cpp:903
20 	libxul.so 	nsWindow::GetLayerManager 	widget/android/nsWindow.cpp:698
21 	libxul.so 	nsWindow::DrawTo 	widget/android/nsWindow.cpp:992
22 	libxul.so 	nsWindow::DrawTo 	widget/android/nsWindow.cpp:1050
23 	libxul.so 	nsWindow::OnDraw 	widget/android/nsWindow.cpp:1102
24 	libxul.so 	nsWindow::OnGlobalAndroidEvent 	widget/android/nsWindow.cpp:862
25 	libxul.so 	nsAppShell::ProcessNextNativeEvent 	widget/android/nsAppShell.cpp:604
26 	libxul.so 	nsBaseAppShell::DoProcessNextNativeEvent 	widget/xpwidgets/nsBaseAppShell.cpp:139
27 	libxul.so 	nsBaseAppShell::OnProcessNextEvent 	widget/xpwidgets/nsBaseAppShell.cpp:280
28 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:586
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=TouchBadMemory+|+mozalloc_abort+|+imalloc
https://crash-stats.mozilla.com/report/list?signature=TouchBadMemory+|+mozalloc_abort+|+system%40framework%40ext.jar%40classes.dex%400x2cd6a
https://crash-stats.mozilla.com/report/list?signature=TouchBadMemory+|+mozalloc_abort+|+0+%28deleted%29%400x11f811f
https://crash-stats.mozilla.com/report/list?signature=TouchBadMemory+|+mozalloc_abort+|+system%40framework%40ext.jar%40classes.dex%400x2dd6a
https://crash-stats.mozilla.com/report/list?signature=TouchBadMemory+|+mozalloc_abort+|+libq3dtools_adreno200.so%400x211f

Comment 1

[Scoobidiver (away)]

With combined signatures, it's #3 top crasher in 15.0. There are many dupes.

Comment 2

[Scoobidiver (away)]

It doesn't seem to be a topcrasher although we can't say for sure because of numerous mozalloc_abort signatures.

Comment 3

[Scoobidiver (away)]

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozalloc_abort+|+nsAString_internal%3A%3ASetCapacity
https://crash-stats.mozilla.com/report/list?signature=mozalloc_abort+|+nsAString_internal%3A%3ASetCapacity%28unsigned+int%2C+mozilla%3A%3Afallible_t+const%26%29

Comment 4

[Scoobidiver (away)]

Here is a non-buggy stack trace:
Frame 	Module 	Signature 	Source
0 	libmozalloc.so 	mozalloc_abort 	mozalloc_abort.cpp:30
1 	libxul.so 	NS_DebugBreak_P 	nsDebugImpl.cpp:422
2 	libxul.so 	nsBaseWidget::CreateCompositor 	nsBaseWidget.cpp:896
3 	libxul.so 	nsWindow::GetLayerManager 	nsWindow.cpp:699
4 	libxul.so 	PresShell::Paint 	nsIWidget.h:1121
5 	libxul.so 	nsViewManager::ProcessPendingUpdatesForView 	nsViewManager.cpp:401
6 	libxul.so 	nsRefreshDriver::Tick 	nsRefreshDriver.cpp:955
7 	libxul.so 	mozilla::RefreshDriverTimer::TimerTick 	nsRefreshDriver.cpp:164
8 	libxul.so 	nsTimerImpl::Fire 	nsTimerImpl.cpp:482
9 	libxul.so 	nsTimerEvent::Run 	nsTimerImpl.cpp:565
10 	libxul.so 	nsThread::ProcessNextEvent 	nsThread.cpp:627
11 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:238
12 	libxul.so 	mozilla::ipc::MessagePump::Run 	MessagePump.cpp:82
13 	libxul.so 	MessageLoop::RunInternal 	message_loop.cc:215
14 	libxul.so 	MessageLoop::Run 	message_loop.cc:208
15 	libxul.so 	nsBaseAppShell::Run 	nsBaseAppShell.cpp:163
16 	libxul.so 	nsAppStartup::Run 	nsAppStartup.cpp:288
17 	libxul.so 	XREMain::XRE_mainRun 	nsAppRunner.cpp:3823
18 	libxul.so 	XREMain::XRE_main 	nsAppRunner.cpp:3890
19 	libxul.so 	XRE_main 	nsAppRunner.cpp:4093 

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozalloc_abort%28char+const*%29+|+NS_DebugBreak_P+|+nsBaseWidget%3A%3ACreateCompositor%28%29

Comment 5

[Jeff Muizelaar [:jrmuizel]]

Attachment: Die more verbosely on Android

This might give us some more information on what's happening.

Comment 6

[Benoit Jacob [:bjacob] (mostly away)]

Comment on attachment 712568 [details] [diff] [review]
Die more verbosely on Android

Review of attachment 712568 [details] [diff] [review]:
-----------------------------------------------------------------

Seems safe --- we can't survive much longer anyway on android if this fails.

Comment 7

[Jeff Muizelaar [:jrmuizel]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/24f879564f43

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/24f879564f43