934250 - crash in mozilla::layers::ThebesLayerBuffer::BeginPaint(mozilla::layers::ThebesLayer*, gfxContentType, unsigned int)

Status: VERIFIED FIXED

(Core :: Graphics: Layers, defect)

Description

[Robert Kaiser]

This bug was filed from the Socorro interface and is 
report bp-f47ed489-2a14-413f-9004-19f322131103.
=============================================================

I'm seeing crashes all the time just during normal browser usage recently - usually I'm on my own builds but I switched to official Nightly to get crash reports from this, and this one is the first one. As I expected, I'm not the only person seeing this recently.

I have OMTC enabled, so that could definitely be a factor here.


More crash reports with this signature can be found at https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozilla%3A%3Alayers%3A%3AThebesLayerBuffer%3A%3ABeginPaint%28mozilla%3A%3Alayers%3A%3AThebesLayer%2A%2C+gfxContentType%2C+unsigned+int%29

From those, it looks like this is happening on Linux since the 10/27 build of Nightly 27.0a1, and it's happening on Nightly 28.0a1 now. I haven't seen any reports from Aurora yet (but updates have only been enabled recently and if this is OMTC-specific I expect more people testing that on Nightly than Aurora, even if 27 might be affected). There also have been a few reports on Windows (8.1 and 7) dating back to 10/21-10/28 Nightly builds.

This is the #3 crash on Nightly 28.0a1 Linux right now, so marking as topcrash-linux as well.

Comment 1

[Matt Woodrow (:mattwoodrow)]

I guess this is a problem with bug 921212. That landed earlier, so something else must have actually regressed it.

Comment 2

[Robert Kaiser]

When I get to another state where I can reliably trigger it (I had some tab set today where I could trigger it at every session restore), I'll look into testing a few older nightly builds to try and find a regression window. I'm pretty busy usually, though, so I'm happy if someone else finds one before I get to this. :)

Comment 3

[Nick Cameron [:nrc]]

Attachment: patch

Well, I couldn't repro this bug, so I have no idea if this will help, but logically it ought to and I'd be very surprised if it made anything worse...

Comment 4

[Nick Cameron [:nrc]]

If you could test a build with this patch applied and see if it helps the problem, that would be very useful, thanks!

Comment 5

[Robert Kaiser]

I have been running with this patch for a couple hours yesterday and a few more today and haven't seen another crash so far even though i performed all the kinds of actions that were more likely to provoke it (like scrolling on a particular image-heavy page). I would guess that means that the patch is likely to work correctly. Thanks!

Comment 6

[Nick Cameron [:nrc]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/db179bcdc5bf

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/db179bcdc5bf

Comment 8

[u279076]

Flagging for verification by checking crashstats.

Comment 9

[Bogdan Maris, Desktop Test Engineering]

No crashes were recorded in Aurora 28.0a2 based on Socorro in the last 3 weeks:
https://crash-stats.mozilla.com/query/?product=Firefox&version=Firefox%3A28.0a2&platform=lin&range_value=3&range_unit=weeks&date=12%2F18%2F2013+13%3A00%3A00&query_search=signature&query_type=contains&query=mozilla%3A%3Alayers%3A%3AThebesLayerBuffer%3A%3ABeginPaint%28mozilla%3A%3Alayers%3A%3AThebesLayer*%2C+gfxContentType%2C+unsigned+int&reason=&release_channels=&build_id=&process_type=any&hang_type=any

Comment 10

[Joshua Mitchell (Inactive)]

Issue is resolved - clearing old keywords - qa-wanted clean-up