998319 - crash in nsCSSRendering::FindBackground

Status: RESOLVED WORKSFORME

(Core :: CSS Parsing and Computation, defect)

Description

[Cosmin Malutan, [:cosmin-malutan]]

This bug was filed from the Socorro interface and is 
report bp-57444806-aac8-4813-8b29-c36142140418.
=============================================================
This failed durring a mozmill testrun:
>03:23:21 TEST-SKIPPED | test1.js | Bug 931704 - plainTheme is undefined.
>03:23:21 TEST-SKIPPED | test2.js | Bug 931704 - plainTheme is undefined.
>03:23:21 TEST-SKIPPED | test3.js | Bug 931704 - plainTheme is undefined.
>03:23:23 2014-04-18 03:51:10.120 firefox[40207:a40b] invalid pixel format
>03:23:23 2014-04-18 03:51:10.123 firefox[40207:a40b] invalid context
>03:23:23 2014-04-18 03:51:10.123 firefox[40207:a40b] invalid pixel format
>03:23:23 2014-04-18 03:51:10.124 firefox[40207:a40b] invalid context

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+1]]

For which test did it fail? Can we get a testcase? Also please don't forget to also add the crash reason and the stack, which helps others to find the crash easier.

Crash Reason 	EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash Address 	0x1f

0 	XUL 	nsCSSRendering::FindBackground(nsIFrame*, nsStyleContext**) 	obj-firefox/x86_64/dist/include/nsCOMPtr.h
1 	XUL 	nsCSSRendering::PaintBackground(nsPresContext*, nsRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, unsigned int, nsRect*, int) 	layout/base/nsCSSRendering.cpp
2 	XUL 	nsDisplayButtonBorderBackground::Paint(nsDisplayListBuilder*, nsRenderingContext*) 	layout/forms/nsButtonFrameRenderer.cpp
3 	XUL 	mozilla::FrameLayerBuilder::PaintItems(nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem>&, nsIntRect const&, gfxContext*, nsRenderingContext*, nsDisplayListBuilder*, nsPresContext*, nsIntPoint const&, float, float, int) 	layout/base/FrameLayerBuilder.cpp
4 	XUL 	mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*) 	layout/base/FrameLayerBuilder.cpp
5 	XUL 	mozilla::layers::BasicThebesLayer::PaintBuffer(gfxContext*, nsIntRegion const&, nsIntRegion const&, nsIntRegion const&, bool, mozilla::layers::DrawRegionClip, void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) 	gfx/layers/basic/BasicThebesLayer.h
6 	XUL 	mozilla::layers::BasicThebesLayer::Validate(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) 	gfx/layers/basic/BasicThebesLayer.cpp
7 	XUL 	_ZThn672_N7mozilla6layers19BasicContainerLayer8ValidateEPFvPNS0_11ThebesLayerEP10gfxContextRK11nsIntRegionNS0_14DrawRegionClipES8_PvESA_ 	gfx/layers/basic/BasicContainerLayer.cpp
8 	XUL 	_ZThn672_N7mozilla6layers19BasicContainerLayer8ValidateEPFvPNS0_11ThebesLayerEP10gfxContextRK11nsIntRegionNS0_14DrawRegionClipES8_PvESA_ 	gfx/layers/basic/BasicContainerLayer.cpp
9 	XUL 	mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/basic/BasicLayerManager.cpp
10 	XUL 	nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) const 	layout/base/nsDisplayList.cpp
11 	XUL 	nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) const 	layout/base/nsDisplayList.cpp
12 	XUL 	nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, unsigned int) 	layout/base/nsLayoutUtils.cpp
13 	XUL 	PresShell::Paint(nsView*, nsRegion const&, unsigned int) 	layout/base/nsPresShell.cpp
14 	XUL 	nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) 	view/src/nsViewManager.cpp
15 	XUL 	nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) 	view/src/nsViewManager.cpp
16 	XUL 	nsRefreshDriver::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
17 	XUL 	mozilla::RefreshDriverTimer::Tick() 	layout/base/nsRefreshDriver.cpp
18 	XUL 	nsTimerImpl::Fire() 	xpcom/threads/nsTimerImpl.cpp
19 	XUL 	nsTimerEvent::Run() 	xpcom/threads/nsTimerImpl.cpp
20 	XUL 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
21 	XUL 	NS_ProcessPendingEvents(nsIThread*, unsigned int) 	xpcom/glue/nsThreadUtils.cpp
22 	XUL 	nsBaseAppShell::NativeEventCallback() 	widget/xpwidgets/nsBaseAppShell.cpp
23 	XUL 	nsAppShell::ProcessGeckoEvents(void*) 	widget/cocoa/nsAppShell.mm
24 	CoreFoundation 	__CFRunLoopDoSources0 	
25 	CoreFoundation 	__CFRunLoopRun 	
26 	CoreFoundation 	CFRunLoopRunSpecific 	
27 	HIToolbox 	HIToolbox@0x2e7ee 	
28 	HIToolbox 	HIToolbox@0x2e5f3 	
29 	HIToolbox 	HIToolbox@0x2e4ac 	
30 	AppKit 	_DPSNextEvent 	
31 	AppKit 	-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 	
32 	XUL 	-[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 	widget/cocoa/nsAppShell.mm
33 	AppKit 	-[NSApplication run] 	
34 	XUL 	nsAppShell::Run() 	widget/cocoa/nsAppShell.mm
35 	XUL 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp
36 	XUL 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
37 	XUL 	XREMain::XRE_main(int, char**, nsXREAppData const*) 	toolkit/xre/nsAppRunner.cpp
38 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp
39 	firefox 	main 	browser/app/nsBrowserApp.cpp
40 	firefox 	start

Comment 2

[Cosmin Malutan, [:cosmin-malutan]]

Failed on mm-osx-107-3 with Aurora fr.
Failed in:
remote/restartTests/testAddons_installFromFTP/test1.js

Comment 3

[Henrik Skupin [:whimboo][⌚️UTC+1]]

(In reply to Cosmin Malutan from comment #2)
> remote/restartTests/testAddons_installFromFTP/test1.js

This is not helpful for people not working on Mozmill tests. So here the full link:
http://hg.mozilla.org/qa/mozmill-tests/file/mozilla-aurora/firefox/tests/remote/restartTests/testAddons_installFromFTP/test1.js

Comment 4

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Looks like Linux and Windows are also affected:

Percentage 	Number Of Crashes
Windows 7 	40.00 %	2
OS X 10.6 	40.00 %	2
Linux 	20.00 %	1 

I wonder if those are also our machines. We might want to have a closer look at them.

Comment 5

[Cosmin Malutan, [:cosmin-malutan]]

This a dupe of bug 998331, failed with the same build on the same machine with the same crash reason at startup.

Comment 7

[Henrik Skupin [:whimboo][⌚️UTC+1]]

(In reply to Cosmin Malutan from comment #5)
> This a dupe of bug 998331, failed with the same build on the same machine
> with the same crash reason at startup.

Well, if crashes with the same crash reasons occur on startup it doesn't mean that the crash is the same. Important is the signature and stack. And for both crashes this totally differs. So no, this is not a dupe.

Comment 8

[Daniel Holbert [:dholbert]]

(The FindBackground(nsIFrame*, nsStyleContext**) signature doesn't exist anymore & hasn't for quite some time; let's remove that here as cruft.)

Downgrading to S3 given the low crash frequency.

Comment 9

[Wayne Mery (:wsmwk)]

Only two crashes in the past six months, both for old versions.
https://crash-stats.mozilla.org/signature/?signature=cssparser%3A%3Acolor%3A%3AColor%3A%3Aparse_hash&date=%3E%3D2023-06-30T03%3A14%3A00.000Z&date=%3C2023-12-31T03%3A14%3A00.000Z

Comment 10

[Daniel Holbert [:dholbert]]

Thanks. Let's call this wfm then.