796115 - Crash in mozilla::FrameLayerBuilder::ClearManagerData with preserve-3d

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Crashes in mozilla::FrameLayerBuilder::ClearManagerData.

Probably a regression from bug 539356.  Same crash signature as bug 795591 and bug 795646, which are fixed.

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Jesse Ruderman]

Only crashes debug builds??

Comment 3

[Scoobidiver (away)]

On Windows: bp-22bcb072-b9ea-4309-aed7-440972121001.

Comment 4

[Matt Woodrow (:mattwoodrow)]

Attachment: Add dumping of DisplayItemData/LayerManagerData

Comment 5

[Matt Woodrow (:mattwoodrow)]

Attachment: Dump of DisplayItemData tree before we remove the frame

This dump shows the problem, because of WrapPreseve3DList, we end up with frames referenced in discrete subtrees.

We only store the LayerManagerData* for one of these on the frame, and the other is left dangling when the frame is removed.

I think we're going to need to store a list of LayerManagerData* per frame. We still want to only store the outermost LMD when we have nested ones though, so I'm going to need to work out a way to detect the difference.

Comment 6

[Matt Woodrow (:mattwoodrow)]

Fixed by bug 795674.

Comment 7

[Scoobidiver (away)]

Bug 795674 was uplifted to Aurora.

Comment 8

[Virgil Dicu [:virgil] [QA]]

Verified the crash for the testcase in comment 1 for 2012-10-01 Nightly
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0
Build ID: 20121001030603

My crash signature is different from the ones mentioned in bug.

 Signature: xul.dll@0x40fd2 | xul.dll@0x40fbe | xul.dll@0x132953 | xul.dll@0x1329d4 | xul.dll@0x2785a | xul.dll@0x1f0e7a | xul.dll@0x730a2 | xul.dll@0x4c01f | xul.dll@0x43d7b2 | xul.dll@0x43d840 | xul.dll@0x115060 | xul.dll@0x1124fd | xul.dll@0x11256c | xul.dll@0x... 

http://crash-stats.mozilla.com/report/index/bp-969a36d8-a194-401d-b870-d31362121128
http://crash-stats.mozilla.com/report/index/bp-a2af3e9f-da2d-4c3b-bdd1-69f332121128


Verified testcase from comment 1 also for
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/18.0 Firefox/18.0 Beta 1
Build ID: 20121121075611

and
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20.0 Firefox/20.0 latest Nightly
Build ID: 20121127030907

No crashes found for these versions.

Can this be moved to "verified" considering that my crash signature is different from the ones mentioned in this bug?