676690 - Firefox Crash [@ nsCanvasRenderingContext2DAzure::GetImageData_explicit(int, int, unsigned int, unsigned int, unsigned char*, unsigned int) ]

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Marcia Knous [:marcia]]

Seen while looking at crash stats. Low volume crash which appears on the the trunk and Aurora. 

https://crash-stats.mozilla.com/report/list?signature=nsCanvasRenderingContext2DAzure::GetImageData_explicit%28int,%20int,%20unsigned%20int,%20unsigned%20int,%20unsigned%20char*,%20unsigned%20int%29

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsCanvasRenderingContext2DAzure::GetImageData_explicit 	content/canvas/src/nsCanvasRenderingContext2DAzure.cpp:4119
1 	xul.dll 	CreateImageData 	obj-firefox/dist/include/CustomQS_Canvas2D.h:196
2 	xul.dll 	nsIDOMCanvasRenderingContext2D_GetImageData 	obj-firefox/dist/include/CustomQS_Canvas2D.h:349
3 	xul.dll 	js::Invoke 	js/src/jsinterp.cpp:656
4 	xul.dll 	js::Interpret 	js/src/jsinterp.cpp:4008

Comment 1

[Carlo Alberto Ferraris]

I can reproduce it consistently on http://www.mapnificent.net/torino/ (or any other city available on mapnificient)

Comment 2

[Carlo Alberto Ferraris]

(In reply to Carlo Alberto Ferraris from comment #1)
> I can reproduce it consistently on http://www.mapnificent.net/torino/ (or
> any other city available on mapnificient)

(on current aurora: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0a2) Gecko/20110804 Firefox/7.0a2)

Comment 3

[Bas Schouten (:bas.schouten)]

I can't seem to reproduce on that site. Have you seen it anywhere else on your machine?

Comment 4

[LegNeato]

Tracking for 7 as azure is new in 7

Comment 5

[Matt Woodrow (:mattwoodrow)]

Attachment: Don't release the DataSourceSurface until after we access the pixels

I've also included the s/abs/fabs change since this is required to mac.

Comment 6

[Matt Woodrow (:mattwoodrow)]

Attachment: Don't release the DataSourceSurface until after we access the pixels v2

Fine, removed the abs code.

Comment 7

[Bas Schouten (:bas.schouten)]

Comment on attachment 560230 [details] [diff] [review]
Don't release the DataSourceSurface until after we access the pixels v2

Review of attachment 560230 [details] [diff] [review]:
-----------------------------------------------------------------

Yes! This is almost certainly the problem we're seeing here, although since we can't reproduce it we won't know for sure. This is completely safe though and fixes a nasty bug, it should be taken!

Comment 8

[Matt Woodrow (:mattwoodrow)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/75cff72d1ff6

Comment 9

[LegNeato]

This needs to land on beta asap to make Firefox 7

Comment 10

[Matt Woodrow (:mattwoodrow)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/f9c333d4a095
https://hg.mozilla.org/releases/mozilla-beta/rev/1a894427bc94

Comment 11

[(no longer active)]

https://hg.mozilla.org/mozilla-central/rev/75cff72d1ff6

Comment 12

[AndreiD[QA]]

I did tests to verify if the issue is fixed and while zooming in and out in the map here http://www.mapnificent.net/torino/ (comment 1) the browser freezes for a few seconds displaying the following message"
"A script on this page may be busy, or it may have stopped responding. You can stop the script now, or you can continue to see if the script will complete.Script: http://www.mapnificent.net/media/js/main.js:1"

This is visible on Windows 7 both x86 and x64 platforms on the latest Firefox builds on the following channels:

Beta, 7.0b6:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0) Gecko/20100101 Firefox/7.0

Aurora, 8.0a2
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0a2) Gecko/20110918 Firefox/8.0a2

Nightly, 9.0a1:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a1) Gecko/20110918 Firefox/9.0a1

Although, this issue is not visible on the Linux platform, or Mac or even other versions of Windows like XP or Vista.
Finally, it's unclear if this bug should be reopen or not. Thanks

Comment 13

[u279076]

I believe this bug was about the crash reported in the original comment, not a slow script warning. If you cannot crash Firefox by using the test you performed then I would say this is VERIFIED FIXED.

Comment 14

[u279076]

qa- as there really isn't much we can do to verify this is fixed