1292628 - Crash in ssse3_fetch_bilinear_cover

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-9029f4cc-3301-4663-bd95-48bcd2160805.
=============================================================

Seen while looking at beta crash stats: https://crash-stats.mozilla.com/signature/?product=Firefox&_sort=-date&signature=ssse3_fetch_bilinear_cover. Crash seems to be unique to beta.

ni on jeff since it appears he may have worked in this area of code.

Comment 1

[Jeff Muizelaar [:jrmuizel]]

[Tracking Requested - why for this release]: This is a crash regression during video playback that we should be able to avoid.

Comment 2

[Liz Henry (:lizzard) (relman/hg->git project)]

204 crashes in the last week with beta 3. Nothing showing up for beta 4 yet. There's also one crash on 50 aurora.

Comment 3

[Jeff Muizelaar [:jrmuizel]]

It looks like most of these have 'Unknown cairo format -1'.

Comment 4

[Jeff Muizelaar [:jrmuizel]]

Attachment: Check the error status of a surface before returning the data inside it

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1ba19d1f07da
Make sure our surface is good before locking it. r=mstange

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out for failing to create surface in non-e10s reftests on Windows 7 VM:

https://hg.mozilla.org/integration/mozilla-inbound/rev/9b00171aff65acb0e55d0ca3486a7331e541a9a4

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=1ba19d1f07da2075f6a3ec1e51bf1dd5a8296a54
Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=34309936&repo=mozilla-inbound

17:51:43     INFO - REFTEST TEST-START | file:///c:/slave/test/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/writing-modes-3/text-combine-upright-compression-006a.html == file:///c:/slave/test/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/writing-modes-3/text-combine-upright-compression-006-ref.html
17:51:43     INFO - REFTEST TEST-LOAD | file:///c:/slave/test/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/writing-modes-3/text-combine-upright-compression-006a.html | 1774 / 13765 (12%)
17:51:43     INFO - ++DOMWINDOW == 43 (18B9F400) [pid = 3420] [serial = 7471] [outer = 0DC49400]
17:51:44     INFO - [GFX3-]: DrawTargetSkia(0C66F940): Failure to create source surface from data. Size: Size(800,1000)
17:51:44     INFO - JavaScript error: chrome://reftest/content/reftest.jsm, line 1463: NS_ERROR_FAILURE:
17:51:44     INFO - JavaScript error: chrome://reftest/content/reftest-content.js, line 1090: TypeError: ret is undefined
[...]
17:56:43     INFO - REFTEST TEST-UNEXPECTED-FAIL | file:///c:/slave/test/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/writing-modes-3/text-combine-upright-compression-006a.html | load failed: timed out waiting for test to complete (waiting for onload scripts to complete)

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/7249543cf71a
Make sure our surface is good before locking it. r=mstange

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Relanded the patch after a Try push with this patch applied but bug 1110928 backed out returned a green reftest for Windows XP: https://treeherder.mozilla.org/#/jobs?repo=try&revision=22da75fc4238&selectedJob=26089235

https://hg.mozilla.org/integration/mozilla-inbound/rev/7249543cf71acbe21ab6306ce321f1207611cf5d

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/7249543cf71a

Comment 10

[Jeff Muizelaar [:jrmuizel]]

Comment on attachment 8783094 [details] [diff] [review]
Check the error status of a surface before returning the data inside it

Approval Request Comment
[Feature/regressing bug #]: 1292628
[User impact if declined]: Possible crash in ssse3 code
[Describe test coverage new/current, TreeHerder]: Has been on nightly for a very short time.
[Risks and why]: Very low risk, but may just push the problem further down the line.

Comment 11

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8783094 [details] [diff] [review]
Check the error status of a surface before returning the data inside it

I see a lot of crash instances on Beta49 (none on Aurora or Nightly) but given the one-line change, it's worth uplifting to Aurora50 and Beta49.

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/2da9027d1d97

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/e66d206c851c