mochitest-browser-chrome: crash in nsObjectFrame::IsOpaque() while running browser_pluginnotification.js. WINNT 5.2 mozilla-central test opt everythingelse on 2009/11/03 04:24:31 http://tinderbox.mozilla.org/showlog.cgi?tree=Firefox-Unittest&errorparser=unittest&logfile=1257251071.1257252568.5519.gz&buildtime=1257251071&buildname=WINNT%205.2%20mozilla-central%20test%20opt%20everythingelse&fulltext=1#err1 Thread 0 (crashed) 0 nsObjectFrame::IsOpaque() 1 nsDisplayPlugin::IsOpaque(nsDisplayListBuilder *) 2 nsDisplayList::ComputeVisibility(nsDisplayListBuilder *, ...) 3 nsDisplayClip::ComputeVisibility(nsDisplayListBuilder *, ...) 4 nsDisplayList::ComputeVisibility(nsDisplayListBuilder *, ...) 5 nsLayoutUtils::PaintFrame(nsIRenderingContext *,nsIFrame *, ...) 6 PresShell::Paint(nsIView *,nsIRenderingContext *, ...) 7 nsViewManager::RenderViews(nsView *,nsIRenderingContext &, ...) 8 nsViewManager::Refresh(nsView *,nsIRenderingContext *, ...) 9 nsViewManager::DispatchEvent(nsGUIEvent *,nsIView *,nsEventStatus *) 10 HandleEvent 11 nsWindow::DispatchEvent(nsGUIEvent *,nsEventStatus &) 12 nsWindow::DispatchWindowEvent(nsGUIEvent *,nsEventStatus &) 13 nsWindow::OnPaint(HDC__ *)

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1257692110.1257693643.818.gz WINNT 5.2 mozilla-central opt test everythingelse on 2009/11/08 06:55:10

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1258075403.1258079561.6199.gz Linux mozilla-central opt test everythingelse on 2009/11/12 17:23:23

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1258078491.1258080780.19670.gz WINNT 5.2 mozilla-central opt test everythingelse on 2009/11/12 18:14:51

http://tinderbox.mozilla.org/showlog.cgi?tree=Firefox-Unittest&errorparser=unittest&logfile=1258140141.1258146974.1118.gz&buildtime=1258140141&buildname=Linux%20mozilla-central%20debug%20test%20everythingelse&fulltext=1 Linux mozilla-central debug test everythingelse [testfailed] Started 11:22, finished 13:17

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1258410548.1258412853.21733.gz WINNT 5.2 mozilla-central opt test everythingelse on 2009/11/16 14:29:08

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1259041788.1259043567.18467.gz WINNT 5.2 mozilla-central opt test everythingelse on 2009/11/23 21:49:48

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1259506300.1259508050.17766.gz#err1 WINNT 5.2 mozilla-central opt test everythingelse on 2009/11/29 06:51:40

Only found one instance on crash-stats: e936158c-71ff-43aa-9cf7-a1ebd2091126

This might just possibly be related to some of the unexplained display-list crashes on 3.6. I may be able to reproduce it in our VMWare recorder.

Chris P, could you set up our recorder VM to run this browser-chrome test over and over?

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260280945.1260283003.6759.gz WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/08 06:02:25 s: moz2-win32-slave19

I ran this on our test machine 2900 times and wasn't able to reproduce :-(

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260606192.1260608189.15417.gz#err0 WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/12 00:23:12 s: win32-slave42

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260629381.1260631163.19818.gz WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/12 06:49:41 s: win32-slave34

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260618385.1260620153.19909.gz WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/12 03:46:25 s: win32-slave37

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260666211.1260668272.9787.gz WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/12 17:03:31 s: win32-slave19

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260737447.1260740049.14193.gz WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/13 12:50:47 s: win32-slave42

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260757183.1260759111.28067.gz WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/13 18:19:43 s: win32-slave37

roc: I'll note that this only appears to manifest in opt builds, which means it might be sensitive to the optimization (perhaps even the PGO). You might try with a Windows nightly build. Debugging will suck, but it might be reproducible.

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260801290.1260803861.13239.gz WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/14 06:34:50 s: win32-slave12

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1260876307.1260878107.29605.gz WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/15 03:25:07 s: win32-slave40

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1260994686.1261000042.3746.gz&fulltext=1#err1 WINNT 5.2 mozilla-central opt test everythingelse on 2009/12/16 12:18:06 s: win32-slave23

I got this in record/replay. The test is disabling some plugin, which kills off all the active instances. But the nsObjectFrame doesn't go away immediately, so we try to paint but in nsObjectFrame::IsOpaque the instance we get from GetInstance is null, and we crash.

When plugins crash in e10s we currently also do SetInstance(NULL).

Adds the required null-check and cleans up this function a bit.

Comment on attachment 418077 [details] [diff] [review] fix Excellent, thanks!

Josh, you might want to audit to ensure that mInstance and GetInstance calls have appropriate null checks.

Should this go on the 1.9.2 branch? We don't null check the result of mInstanceOwner->GetWindow there but the guarantees might be different.

Note, I had to commit a followup merge fix for nsObjectFrame in Lorentz: on the branch nsIPluginInstance doesn't have IsTransparent. roc/josh, please check this! http://hg.mozilla.org/projects/firefox-lorentz/rev/ac75b6aa99a4

Blanket approval for Lorentz merge to mozilla-1.9.2 a=beltzner for 1.9.2.4 - please make sure to mark status1.9.2:.4-fixed

Merged into 1.9.2 at http://hg.mozilla.org/releases/mozilla-1.9.2/rev/84ba4d805430

Is this just verified by browser_pluginnotification.js running correctly?