995132 - [Tarako][Monkey test] Monkey test crashes at libc.so + 0xe464

Status: RESOLVED DUPLICATE of bug 976656

(Firefox OS Graveyard :: General, defect)

Description

[Bingqing Li]

Attachment: log

Operating system: Android
                  0.0.0 Linux 3.0.8+ #1 PREEMPT Wed Apr 9 13:37:48 CST 2014 armv7l Spreadtrum/sp6821a_gonk/sp6821a_gonk:4.0.4.0.4.0.4/OPENMASTER/248:userdebug/test-keys
CPU: arm
     0 CPUs

Crash reason:  SIGSEGV
Crash address: 0x43bc4000

Thread 0 (crashed)
 0  libc.so + 0xe464
     r4 = 0x00000288    r5 = 0x00000018    r6 = 0x43bc3dd0    r7 = 0x43b83264
     r8 = 0x00000000    r9 = 0x00040dd0   r10 = 0x0000019a    fp = 0x000004ec
     sp = 0xbebaafb4    lr = 0x409be611    pc = 0x4010d464
    Found by: given as instruction pointer in context
 1  libxul.so!mozilla::gfx::DrawTargetCairo::CreateSourceSurfaceFromNativeSurface(mozilla::gfx::NativeSurface const&) const [DrawTargetCairo.cpp : 1110 + 0x7]
     sp = 0xbebaaff4    pc = 0x413c5cfd
    Found by: stack scanning

Thread 1
 0  libc.so + 0xd518
     r4 = 0x00000000    r5 = 0x40305600    r6 = 0x4032a600    r7 = 0x000000fc
     r8 = 0x00000000    r9 = 0x40305600   r10 = 0x00000000    fp = 0x41dec968
     sp = 0x40361b90    lr = 0x400c7fd5    pc = 0x4010c518
    Found by: given as instruction pointer in context
 1  libxul.so!epoll_dispatch [epoll.c : 407 + 0xb]
     sp = 0x40361bc8    pc = 0x4087ad07
    Found by: stack scanning
 2  libxul.so!event_base_loop [event.c : 1607 + 0x5]
     r4 = 0x40363180    r5 = 0x00000000    r6 = 0x41dc902c    r7 = 0xffffa3ac
     r8 = 0x00000000    r9 = 0x40361c68   r10 = 0x00000000    sp = 0x40361be8
     pc = 0x40878cd5
    Found by: call frame info
 3  libxul.so!base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) [message_pump_libevent.cc : 340 + 0x7]
     r4 = 0x40302af0    r5 = 0x40361cc4    r6 = 0x40361c70    r7 = 0x40302b00
     r8 = 0x40361c60    r9 = 0x40361c68   r10 = 0x00000000    fp = 0x00000000
     sp = 0x40361c60    pc = 0x4087b433
    Found by: call frame info

Comment 1

[Mike Habicher [:mikeh] (high bugzilla latency)]

The 'minidump_summary' attached shows a slightly different crash signature than what's in the summary, but includes the following stack:

0  libc.so + 0xdd20
1  libxul.so!BufferUnrotate(unsigned char*, int, int, int, int, int) [BufferUnrotate.cpp : 44 + 0xd]
2  libxul.so!mozilla::layers::RotatedContentBuffer::BeginPaint(mozilla::layers::ThebesLayer*, gfxContentType, unsigned int) [RotatedBuffer.cpp : 555 + 0x7]
3  libxul.so!mozilla::layers::ContentClientBasic::BeginPaintBuffer(mozilla::layers::ThebesLayer*, gfxContentType, unsigned int) + 0xf
4  libxul.so!mozilla::layers::ClientThebesLayer::PaintThebes() [ClientThebesLayer.cpp : 61 + 0x9]
5  libxul.so!mozilla::layers::ClientThebesLayer::RenderLayer() [ClientThebesLayer.cpp : 107 + 0x5]
6  libxul.so!mozilla::layers::ClientContainerLayer::RenderLayer() [ClientContainerLayer.h : 81 + 0x5]
7  libxul.so!mozilla::layers::ClientContainerLayer::RenderLayer() [ClientContainerLayer.h : 81 + 0x5]
8  libxul.so!mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) [ClientLayerManager.cpp : 188 + 0x9]
9  libxul.so!mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) [ClientLayerManager.cpp : 211 + 0xb]
10  libxul.so!nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) const [nsDisplayList.cpp : 1301 + 0x7]
11  libxul.so!nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) const [nsDisplayList.cpp : 1155 + 0xd]
12  libxul.so!nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, unsigned int) [nsLayoutUtils.cpp : 2348 + 0x5]
13  libxul.so!PresShell::Paint(nsView*, nsRegion const&, unsigned int) [nsPresShell.cpp : 5898 + 0xd]
14  libxul.so!nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) [nsViewManager.cpp : 455 + 0x19]
15  libxul.so!nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) [nsViewManager.cpp : 396 + 0x7]
16  libxul.so!nsViewManager::ProcessPendingUpdates() [nsViewManager.cpp : 1087 + 0x9]
17  libxul.so!nsRefreshDriver::Tick(long long, mozilla::TimeStamp) [nsRefreshDriver.cpp : 1208 + 0x5]
18  libxul.so!mozilla::RefreshDriverTimer::TimerTick(nsITimer*, void*) [nsRefreshDriver.cpp : 168 + 0xb]
19  libxul.so!nsTimerImpl::Fire() [nsTimerImpl.cpp : 551 + 0x5]
20  libxul.so!nsTimerEvent::Run() [nsTimerImpl.cpp : 635 + 0x5]
21  libxul.so!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp : 612 + 0x5]
22  libxul.so!NS_ProcessNextEvent(nsIThread*, bool) [nsThreadUtils.cpp : 263 + 0xb]

Comment 2

[Sotaro Ikeda [:sotaro]]

CreateSourceSurfaceFromNativeSurface() crash is tracked by Bug 976656.
BufferUnrotate() crash is tracked by Bug 970007.

Bug 970007 seems root cause for the time being.

Comment 3

[Peipei Cheng (needinfo if you need my action)]

This should have been fixed.