974656 - Linux crash in gfxContext::PushClipsToDT(mozilla::gfx::DrawTarget*)

Status: RESOLVED INCOMPLETE

(Core :: Graphics, defect, P5)

Description

[u279076]

This bug was filed from the Socorro interface and is 
report bp-77e8e96f-f5fe-4f51-98e5-52c542140216.
=============================================================
0 	libxul.so 	gfxContext::PushClipsToDT(mozilla::gfx::DrawTarget*) 	gfx/thebes/gfxContext.cpp
1 	libxul.so 	gfxContext::PushGroup(gfxContentType) 	gfx/thebes/gfxContext.cpp
2 	libxul.so 	mozilla::layers::BasicLayerManager::PushGroupForLayer(gfxContext*, mozilla::layers::Layer*, nsIntRegion const&, bool*) 	gfx/layers/basic/BasicLayerManager.cpp
3 	libxul.so 	mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::ReadbackProcessor*) 	gfx/layers/basic/BasicLayerManager.cpp
4 	libxul.so 	mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/basic/BasicLayerManager.cpp
5 	libxul.so 	PresShell::Paint(nsView*, nsRegion const&, unsigned int) 	layout/base/nsPresShell.cpp
6 	libxul.so 	nsViewManager::Refresh(nsView*, nsIntRegion const&) 	view/src/nsViewManager.cpp
7 	libxul.so 	nsViewManager::PaintWindow(nsIWidget*, nsIntRegion) 	view/src/nsViewManager.cpp
8 	libxul.so 	nsView::PaintWindow(nsIWidget*, nsIntRegion) 	view/src/nsView.cpp
9 	libxul.so 	nsWindow::OnExposeEvent(_GdkEventExpose*) 	widget/gtk/nsWindow.cpp
10 	libxul.so 	expose_event_cb 	widget/gtk/nsWindow.cpp
11 	libgtk-x11-2.0.so.0.2400.22 	libgtk-x11-2.0.so.0.2400.22@0x12cd85 	
12 	libgtk-x11-2.0.so.0.2400.22 	libgtk-x11-2.0.so.0.2400.22@0x12cd10 	
13 	libgobject-2.0.so.0.3800.2 	libgobject-2.0.so.0.3800.2@0x106a8 	
14 	libglib-2.0.so.0.3800.2 	libglib-2.0.so.0.3800.2@0x38159 	
15 	libgobject-2.0.so.0.3800.2 	libgobject-2.0.so.0.3800.2@0x2203d 	
16 	libgobject-2.0.so.0.3800.2 	libgobject-2.0.so.0.3800.2@0x35453 	
17 	libgobject-2.0.so.0.3800.2 	libgobject-2.0.so.0.3800.2@0x14d34 	
18 	libgobject-2.0.so.0.3800.2 	libgobject-2.0.so.0.3800.2@0x35638 	
19 	libgobject-2.0.so.0.3800.2 	libgobject-2.0.so.0.3800.2@0x29a19 	
20 	libgobject-2.0.so.0.3800.2 	libgobject-2.0.so.0.3800.2@0x2950e

More reports:
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=gfxContext%3A%3APushClipsToDT%28mozilla%3A%3Agfx%3A%3ADrawTarget%2A%29
=============================================================

This is similar to bug 805406 but that bug is specific to these crashes on Windows. I'm filing this new bug to track this signature on Linux since we're now seeing a significant volume there. In overall volume Linux accounts for only 1.41% at 518 crashes. However comparing this just to other Linux crashes this sits at #2 on Nightly, #3 on Beta, #46 on Release

Comment 1

[juan becerra [:juanb]]

This is the #2 crash in Firefox 29.

Comment 2

[Sylvestre Ledru [:Sylvestre]]

Milan, could you help us here?

Comment 3

[Milan Sreckovic [:milan] (needinfo for best results)]

Working on the matching Windows bug 805406 first; once we have something that's validated as a fix there, we can get a Linux version.

Comment 4

[Robert Kaiser]

As Milan says, Bas has been trying to get this fixed in bug 805406 in a few ways, but in the end, we found out this didn't help very much as most of those are probably OOM situations that just end up in this signature (my personal guess as someone who doesn't know the code but listened to the explanations of circumstances is that an OOM situation triggers a graphics card reset and that makes us crash).
This signature has been around as the #1 or #2 crash for quite a while now, and there's not much more we can do.

And in any case, this bug was specifically filed for the Linux-only variant of this as it's very much possible that the Windows and Linux variant have different causes. If anything, we could track the Windows variant in bug 805406 but the Linux-specific one here isn't tracking-worthy at this point.

Comment 5

[Richard Newman [:rnewman]]

This is happening reliably for me on Android ARMv7 Nightly 32. Want a new bug, or will this suffice? 

https://crash-stats.mozilla.com/report/index/61cd6294-07bb-4b86-9bf3-7baf42140506

Comment 6

[Richard Newman [:rnewman]]

Crashed twice on this page:

http://caveman-clarke.blogspot.com/2012/01/new-balance-minimus-zero-mt00-trail.html?m=1

Comment 7

[Timothy Nikkel (:tnikkel)]

I can reproduce that too when pinch zooming on that page.

Comment 8

[Richard Newman [:rnewman]]

I see something like 800 reports on Fennec in the last week. tracking-fennec=?

Comment 9

[guigs [:guigs] PST (please needinfo me!)]

See also support question: https://support.mozilla.org/en-US/questions/1000871

Comment 10

[u279076]

Just updating this bug report with the latest rank.

Desktop
=======
#2 in Release
#2 in Beta
#16 in Aurora
#7 in Nightly

Fennec
======
#1 in Release
#1 in Beta
#14 in Aurora
#40 in Nightly

Comment 11

[Sylvestre Ledru [:Sylvestre]]

This bug might have been fixed by bug 1034584 (see bug 1027103).

Comment 12

[Brad Lassey [:blassey] (use needinfo?)]

filter on [mass-p5]

Comment 13

[u279076]

Resolving this bug as incomplete as it no longer seems to be an issue worth further investigation. There are no recent crashes on Linux and 92 recent crashes on Android, of which none are on recent Fennec versions. 93% are on Fennec 30 and the remaining 7% are spread across earlier versions.