722269 - Firefox crash @ mozilla::gfx::DrawTargetD2D::DrawSurface

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[brunoais]

Firefox had already been opened for about 24h.
I had, at the moment, about 200 tabs in which 30 were loaded.
I had been in the same tab group for a while (4-5 hours).
I tried to change the tag group so I went to the panorama view to select another tab.
After pressing ctrl+shift+E firefox hanged for about 2 seconds and then crashed.
In order to reproduce you need to:
 * Have, at least, 4 groups with tabs in them.
 * Work in a tab group for a while (1h should be enough)
 * Load and change url of some pages (go to google, search, read articles, view images...)
 * Have firefox open for some hours. Seems like you need more than 16h

.

Comment 1

[Tim Taubert [:ttaubert] (inactive)]

Does this crash show up in about:crashes? We need a crash ID to investigate that further and to see if Panorama is even the culprit.

Comment 2

[brunoais]

This is one:
https://crash-stats.mozilla.com/report/index/bp-b9d0a1cb-b508-4717-be39-7b3392120127
here's another:
https://crash-stats.mozilla.com/report/index/bp-57c7eb1e-037e-41ba-a566-afd012120128

I think this is also one caused by the same reason:
https://crash-stats.mozilla.com/report/index/bp-763857aa-ce04-4de1-ad5a-a83672120124

There are more in about:crashes but when I click them the page shows it does not recognize the id.

Comment 3

[Scoobidiver (away)]

Does it happen in Safe Mode (see https://support.mozilla.org/en-US/kb/Safe%20Mode)?
Does it happen with a new profile (see https://support.mozilla.org/en-US/kb/Managing-profiles)?

It's a low volume crash with only 42 crashes in 9.0.1 over the last week.

More reports at:
https://crash-stats.mozilla.com/report/list?signature=DrawingContext%3A%3ADrawBitmap%28ID2D1Bitmap*%2C+D2D_RECT_F+const*%2C+float%2C+D2D1_BITMAP_INTERPOLATION_MODE%2C+D2D_RECT_F+const*%29

Comment 4

[brunoais]

(In reply to Scoobidiver from comment #3)
> Does it happen in Safe Mode (see
> https://support.mozilla.org/en-US/kb/Safe%20Mode)?
Yes
> Does it happen with a new profile (see
> https://support.mozilla.org/en-US/kb/Managing-profiles)?

Didn't test. Need me to test?

Comment 5

[Scoobidiver (away)]

(In reply to brunoaiss from comment #4)
> Didn't test. Need me to test?
Yes. Please.

Comment 6

[Dirkjan Ochtman (:djc)]

I hit this twice with Aurora 17 (2012-09-18). Both times, I was trying to load this URL with pdf.js 0.4.11:

https://wiki.postgresql.org/images/7/73/Range-types-pgopen-2012.pdf

Comment 7

[Dirkjan Ochtman (:djc)]

These are the crash reports:

https://crash-stats.mozilla.com/report/index/bp-ef062c0d-917f-49ad-8e6d-e9ffd2120920
https://crash-stats.mozilla.com/report/index/bp-25592392-c684-4d1e-893a-76c852120920

Comment 8

[Scoobidiver (away)]

I can reproduce in Nightly: bp-c7a5ec47-7e0f-417e-b3e6-d5af92120920.

Comment 9

[Bas Schouten (:bas.schouten)]

Attachment: Make DrawTargetD2D::DrawSurface deal with more surfaces

Comment 10

[Joe Drew (not getting mail)]

Comment on attachment 663164 [details] [diff] [review]
Make DrawTargetD2D::DrawSurface deal with more surfaces

Review of attachment 663164 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/2d/DrawTargetD2D.cpp
@@ +295,3 @@
>      {
> +      RefPtr<DataSourceSurface> srcSurf =
> +        aSurface->GetDataSurface();

same line

Comment 11

[Bas Schouten (:bas.schouten)]

http://hg.mozilla.org/integration/mozilla-inbound/rev/7ed5b4e7e4fc

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/7ed5b4e7e4fc

Comment 13

[Dirkjan Ochtman (:djc)]

Can we get this backported to Aurora? Seems low-risk enough.

Comment 14

[Bas Schouten (:bas.schouten)]

Comment on attachment 663164 [details] [diff] [review]
Make DrawTargetD2D::DrawSurface deal with more surfaces

Review of attachment 663164 [details] [diff] [review]:
-----------------------------------------------------------------

This is very low risk and probably a good idea to get in Aurora now.

Comment 15

[Lukas Blakk [:lsblakk] use ?needinfo]

Comment on attachment 663164 [details] [diff] [review]
Make DrawTargetD2D::DrawSurface deal with more surfaces

Low risk fix for reproducible crash, let's get it on Aurora.

Comment 16

[Justin Wood (:Callek)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/a50ac961485d

Comment 17

[Ioana (away)]

This crash still appears in Socorro, on Firefox 17 beta 1 and the 10/14 Firefox 19 Nightly.

The stack traces are pretty much the same as those in reports listed in this bug:
https://crash-stats.mozilla.com/report/index/9b8c6dba-0c11-4062-a948-86e1a2121016
https://crash-stats.mozilla.com/report/index/7b578df6-1485-478d-99ec-d97112121016

Comment 18

[Scoobidiver (away)]

I can't reproduce it with the STR in comment 6 in 17.0b1+PDF Viewer 0.4.11, Aurora and Nightly.

Comment 19

[u279076]

An overwhelming majority (96%) of the crashes with this signature in the last week are happening on Firefox 16.0.1 or earlier versions. Can we consider this verified based on the fact that crashes are trending way down and the fact that the test in comment 6 no longer reproduces?

Comment 20

[Ioana (away)]

Bas, Lukas, can one of you look over the crashes in comment 17 and let me know if they are the same crash or not?

Comment 21

[Bas Schouten (:bas.schouten)]

(In reply to Ioana Budnar [QA] from comment #20)
> Bas, Lukas, can one of you look over the crashes in comment 17 and let me
> know if they are the same crash or not?

It's very hard to say considering in how many ways these codepaths get hit.

Comment 22

[Ioana (away)]

(In reply to Bas Schouten (:bas.schouten) from comment #21)
> (In reply to Ioana Budnar [QA] from comment #20)
> > Bas, Lukas, can one of you look over the crashes in comment 17 and let me
> > know if they are the same crash or not?
> 
> It's very hard to say considering in how many ways these codepaths get hit.

Would you consider safe marking this bug as verified in that case? Please also see comment 19 for the details there.