793983 - Firefox 17 crash in nsWindow::OnPaint

Status: VERIFIED FIXED

(Core :: Widget: Win32, defect)

Description

[Scoobidiver (away)]

It's currently #59 top browser crasher in Aurora and first appeared in 17.0a2/20120918. The regression range is:
http://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?fromchange=88b15f553474&tochange=7676a9a06403

Signature 	nsView::DidPaintWindow() More Reports Search
UUID	65ec623f-e3e4-418b-b28a-8f7ab2120925
Date Processed	2012-09-25 03:08:46
Uptime	32861
Install Age	12.6 hours since version was first installed.
Install Time	2012-09-24 14:29:12
Product	Firefox
Version	17.0a2
Build ID	20120923042010
Release Channel	aurora
OS	Windows NT
OS Version	6.1.7600
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x1c
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x06e1, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.17.12.8026
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True
Adapter Vendor ID	0x10de
Adapter Device ID	0x06e1
Total Virtual Memory	2147352576
Available Virtual Memory	1221611520
System Memory Use Percentage	80
Available Page File	347336704
Available Physical Memory	212111360

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsView::DidPaintWindow 	view/src/nsView.cpp:1040
1 	xul.dll 	nsWindow::OnPaint 	widget/windows/nsWindowGfx.cpp:600
2 	xul.dll 	nsWindow::ProcessMessage 	widget/windows/nsWindow.cpp:4727
3 	xul.dll 	nsWindow::WindowProcInternal 	widget/windows/nsWindow.cpp:4336
4 	xul.dll 	CallWindowProcCrashProtected 	xpcom/base/nsCrashOnException.cpp:32
5 	xul.dll 	nsWindow::WindowProc 	widget/windows/nsWindow.cpp:4278
6 	user32.dll 	InternalCallWinProc 	
7 	user32.dll 	GetRealWindowOwner 	
8 	user32.dll 	DispatchClientMessage 	
9 	user32.dll 	__fnDWORD 	
10 	ntdll.dll 	KiUserCallbackDispatcher 	
11 	ntdll.dll 	KiUserApcDispatcher 	
12 	user32.dll 	DispatchMessageW 	
13 	xul.dll 	nsAppShell::ProcessNextNativeEvent 	widget/windows/nsAppShell.cpp:322
14 	xul.dll 	nsBaseAppShell::OnProcessNextEvent 	widget/xpwidgets/nsBaseAppShell.cpp:280
15 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:586
16 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:82
17 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:201
18 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:175
19 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:163
20 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:232
21 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:273
22 	xul.dll 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3800
23 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3877
24 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3953

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsView%3A%3ADidPaintWindow%28%29

Comment 1

[Scoobidiver (away)]

Bug 805745 comment 10 has STR.

More reports also at:
https://crash-stats.mozilla.com/report/list?signature=nsWindow%3A%3AOnPaint%28HDC__*%2C+unsigned+int%29

Comment 2

[Saurabh Anand [:sawrubh]]

Attachment: Patch v1

Most probably a null-deref error.

Comment 3

[Timothy Nikkel (:tnikkel)]

Comment on attachment 688674 [details] [diff] [review]
Patch v1

I think there is more going wrong here than just a null-check can fix.

Comment 4

[Scoobidiver (away)]

STR from bug 805745 comment 19:
1. Go to http://shop.ubi.com/
2. Select platform 'PC'
3. Pre-order FarCry 3
4. Go to check-out
5. Select one of the drop-down listboxes

Comment 5

[Scoobidiver (away)]

With combined signatures, it's #9 top browser crasher in 17.0.1 and #26 in 18.0b3.

Comment 6

[Lukas Blakk [:lsblakk] use ?needinfo]

Saurabh - can you create a tryserver build with your patch and test if the steps in comment 4 reproduce?  If comment 3 is correct, then it looks like a different fix is needed here - we'll track this reproducible crash for 18 but a low risk solution would have to be found within the coming week to make it to branches.

Comment 7

[Scoobidiver (away)]

Timothy Nikkel says it's a duplicate of bug 805745 but I am not so sure about that because it's #29 top browser crasher in 18.0b3 (non startup crashes) and #2 in 19.0a2 (startup crashes).

Comment 8

[Timothy Nikkel (:tnikkel)]

805745 should fix this.

Comment 9

[Saurabh Anand [:sawrubh]]

Clearing needinfo since Timothy is already fixing this somewhere.

Comment 10

[Alex Keybl [:akeybl]]

We've approved bug 805745 for landing.

Comment 11

[Timothy Nikkel (:tnikkel)]

Should be fixed by bug 805745.

Comment 12

[Ioana (away)]

There are no crashes with this signature past 12/13: nsViewManager::DidPaintWindow(), but there are new crashes for the other two signatures:
nsView::DidPaintWindow() - https://crash-stats.mozilla.com/report/list?signature=nsView%3A%3ADidPaintWindow%28%29
nsWindow::OnPaint(HDC__*, unsigned int) - https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&query=nsWindow%3A%3AOnPaint%28HDC__%2A%2C%20unsigned%20int%29&reason_type=contains&date=12%2F19%2F2012%2013%3A50%3A48&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=nsWindow%3A%3AOnPaint%28HDC__%2A%2C%20unsigned%20int%29

I should mention I don't have access to bug 805745 to see when each push was made.

When trying to verify manually with the steps in comment 4, I got the following results:
- 12/18 Nightly - no issues appeared.
- 12/18 Aurora - Firefox crashed at step 5, but the crash had another signature - https://crash-stats.mozilla.com/report/index/bp-399ed1c5-ec50-447d-8ca0-749632121219
- Firefox 18b4 - Firefox crashed at step 5, but the crash had another signature (different from the Aurora one too) - https://crash-stats.mozilla.com/report/index/bp-faec7d57-e4d2-49ce-9e15-9617f2121219

Please take a look at the recent crashes with the signatures in this bug and let me know if they are the same bug (crash reports links at the begging of this comment).

Comment 13

[Scoobidiver (away)]

(In reply to Ioana Budnar [QA] from comment #12)
> I should mention I don't have access to bug 805745 to see when each push was
> made.
It's fixed in 18.0b5, 19.0a2/20121219 and 20.0a1/20121214.

Comment 14

[Virgil Dicu [:virgil] [QA]]

I reproduced the crash following the STR from comment 4 for 2012-09-18 Aurora.

No crashes found, using the same STR and some exploratory around, for the following:

Firefox 18.0.2
Mozilla/5.0 (Windows NT 6.1; rv:18.0) Gecko/20100101 Firefox/18.0
Build ID: 20130201065344

Firefox 19.0 beta 5
Mozilla/5.0 (Windows NT 6.1; rv:19.0) Gecko/20100101 Firefox/19.0
Build ID: 20130206083616

Latest Aurora 20.0a2
Mozilla/5.0 (Windows NT 6.1; rv:20.0) Gecko/20130207 Firefox/20.0
Build ID: 20130207042017

Latest Nightly 21.0a1
Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20130207 Firefox/21.0
Build ID: 20130207030936

Comment 15

[Mihai Morar, (:MihaiMorar)]

Works as expected following STR from Comment 4 on FF 20.b2 Windows 7 x64:

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0(20130227063501)