1053934 - Crash in gfxContext::PushNewDT (OOM) with reproducible test-case (reddit.com)

Status: VERIFIED FIXED

(Core :: Graphics, defect)

Description

[Aaron Train [:aaronmt]]

#0  0x7e05b500 in NS_ABORT_OOM (aSize=<optimized out>) at /home/aaronmt/Mozilla/Fennec/xpcom/base/nsDebugImpl.cpp:625
#1  0x7e6ac64e in gfxContext::PushNewDT (this=this@entry=0x8556f710, content=content@entry=COLOR_ALPHA) at /home/aaronmt/Mozilla/Fennec/gfx/thebes/gfxContext.cpp:1636
#2  0x7e6ac6b2 in gfxContext::PushGroup (this=this@entry=0x8556f710, content=content@entry=COLOR_ALPHA) at /home/aaronmt/Mozilla/Fennec/gfx/thebes/gfxContext.cpp:1086
#3  0x7e6ac92e in gfxContext::PushGroupAndCopyBackground (this=0x8556f710, content=COLOR_ALPHA) at /home/aaronmt/Mozilla/Fennec/gfx/thebes/gfxContext.cpp:1133
#4  0x7e6444c4 in mozilla::layers::BasicLayerManager::PushGroupForLayer (this=<optimized out>, aContext=aContext@entry=0x8556f710, aLayer=aLayer@entry=0x8dd96400, aRegion=..., 
    aNeedsClipToVisibleRegion=aNeedsClipToVisibleRegion@entry=0x786400e7) at /home/aaronmt/Mozilla/Fennec/gfx/layers/basic/BasicLayerManager.cpp:105
#5  0x7e644634 in mozilla::layers::BasicThebesLayer::PaintThebes (this=0x8dd96400, aContext=0x8556f710, aMaskLayer=0x0, aCallback=
    0x7efac9a1 <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, aCallbackData=0x786410b0) at /home/aaronmt/Mozilla/Fennec/gfx/layers/basic/BasicThebesLayer.cpp:86
#6  0x7e6462da in mozilla::layers::BasicLayerManager::PaintSelfOrChildren (this=this@entry=0x880ebf20, aPaintContext=..., aGroupTarget=aGroupTarget@entry=0x8556f710)
    at /home/aaronmt/Mozilla/Fennec/gfx/layers/basic/BasicLayerManager.cpp:740
#7  0x7e64659c in mozilla::layers::BasicLayerManager::PaintLayer (this=0x880ebf20, aTarget=0x8556f710, aLayer=0x8dd96400, aCallback=<optimized out>, aCallbackData=0x786410b0)
    at /home/aaronmt/Mozilla/Fennec/gfx/layers/basic/BasicLayerManager.cpp:867
#8  0x7e64631e in mozilla::layers::BasicLayerManager::PaintSelfOrChildren (this=this@entry=0x880ebf20, aPaintContext=..., aGroupTarget=aGroupTarget@entry=0x8556f710)
    at /home/aaronmt/Mozilla/Fennec/gfx/layers/basic/BasicLayerManager.cpp:753
#9  0x7e64659c in mozilla::layers::BasicLayerManager::PaintLayer (this=this@entry=0x880ebf20, aTarget=0x8556f710, aLayer=0x8dd95c00, 
    aCallback=aCallback@entry=0x7efac9a1 <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, aCallbackData=aCallbackData@entry=0x786410b0) at /home/aaronmt/Mozilla/Fennec/gfx/layers/basic/BasicLayerManager.cpp:867
#10 0x7e646c5a in mozilla::layers::BasicLayerManager::EndTransactionInternal (this=0x880ebf20, 
    aCallback=0x7efac9a1 <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, aCallbackData=0x786410b0, aFlags=<optimized out>) at /home/aaronmt/Mozilla/Fennec/gfx/layers/basic/BasicLayerManager.cpp:532


Visit http://www.reddit.com/r/askscience/comments/28vajr/if_i_had_a_sealed_room_filled_with_butane_gas_and/ and pinch-zoom. Instant crash on my Nexus 5 (Android 4.4.4) with Nightly (08/14)

Comment 1

[Robert Kaiser]

This might be connected or similar to bug 1045588. But for investigation, it's good to have a separate bug, I guess.

Comment 2

[(Away)]

Possibly related: bug 1037230 and bug 1046528

Comment 3

[Mark Finkle (:mfinkle) (use needinfo?)]

Snorp - Anyone on GFX we should send this to?

Comment 4

[Fernando Hartmann]

bp-4da18786-d792-49ee-9ca4-977162140825, happened to me some minutes after upgrade from FF 32b8 to 32b9. It's the first time that I saw this error.

Comment 5

[Fernando Hartmann]

(In reply to Fernando Hartmann from comment #4)
> bp-4da18786-d792-49ee-9ca4-977162140825, happened to me some minutes after
> upgrade from FF 32b8 to 32b9. It's the first time that I saw this error.

Crash again bp-d1e203e0-cf00-4e02-8487-ac4cf2140825 :-(

Comment 6

[(Away)]

Fernando: I think those two are unrelated to the most recent PushNewDT problems, which only affected versions 33 and 34. Your crashes look like general out-of-virtual-memory issues (on 32-bit operating systems we are very constrained). There's not much we can do other than reduce memory usage in general. Bug 1007534 will help us collect better data for that.

Comment 8

[Robert Kaiser]

Aaron posted a NSFW link that reproduces the crash as well. I'm hiding the comment as I don't think that Bugzilla should publicly link to such NSFW content.

Comment 9

[James Willcox (:snorp) ([e-mail]) (he/him)]

I ran into this yesterday at the following url: http://www.ispyconnect.com/ (SFW)

My crash report: https://crash-stats.mozilla.com/report/index/9ecb2acb-6edf-47e6-86d0-f18692140827

Comment 10

[James Willcox (:snorp) ([e-mail]) (he/him)]

Investigating further...

Comment 11

[James Willcox (:snorp) ([e-mail]) (he/him)]

I get some interesting warnings in logcat with a debug build:

adb| [7372] WARNING: Transparent content with displayports can be expensive.: file /Users/snorp/source/gecko-dev/layout/base/nsDisplayList.cpp, line 1309
adb| DrawTargetCairo context in error state: invalid matrix (not invertible)(5)
adb| DrawTargetCairo context in error state: invalid matrix (not invertible)(5)

Program received signal SIGSEGV, Segmentation fault.
adb| DrawTargetCairo context in error state: invalid matrix (not invertible)(5)
adb| DrawTargetCairo context in error state: invalid matrix (not invertible)(5)
adb| DrawTargetCairo context in error state: invalid matrix (not invertible)(5)
adb| DrawTargetCairo context in error state: invalid matrix (not invertible)(5)
adb| DrawTargetCairo context in error state: invalid matrix (not invertible)(5)
adb| DrawTargetCairo context in error state: invalid matrix (not invertible)(5)
adb| DrawTargetCairo context in error state: invalid matrix (not invertible)(5)
adb| DrawTargetCairo context in error state: invalid matrix (not invertible)(5)
adb| DrawTargetCairo context in error state: invalid matrix (not invertible)(5)
adb| DrawTargetCairo context in error state: invalid matrix (not invertible)(5)
adb| DrawTargetCairo context in error state: invalid matrix (not invertible)(5)
adb| [7372] WARNING: Failed to create DrawTarget of sufficient size.: file /Users/snorp/source/gecko-dev/gfx/thebes/gfxContext.cpp, line 1631
adb| Hit MOZ_CRASH() at /Users/snorp/source/gecko-dev/xpcom/base/nsDebugImpl.cpp:625

Comment 12

[James Willcox (:snorp) ([e-mail]) (he/him)]

Looks like we aren't running out of memory, we just can't create a similar DT because the cairo context is hosed.

Comment 13

[James Willcox (:snorp) ([e-mail]) (he/him)]

The invalid matrix is set here:

#0  0x56ab576c in mozilla::gfx::DrawTargetCairo::SetTransform (this=0x475fb700, aTransform=...) at /Users/snorp/source/gecko-dev/gfx/2d/DrawTargetCairo.cpp:1430
#1  0x56b6f4e8 in gfxContext::ChangeTransform (this=0x46fd40f0, aNewMatrix=..., aUpdatePatternTransform=aUpdatePatternTransform@entry=true) at /Users/snorp/source/gecko-dev/gfx/thebes/gfxContext.cpp:1561
#2  0x56b6f642 in gfxContext::SetMatrix (this=<optimized out>, matrix=...) at /Users/snorp/source/gecko-dev/gfx/thebes/gfxContext.cpp:470
#3  0x574b4004 in DrawImageInternal (aRenderingContext=aRenderingContext@entry=0x47c52850, aPresContext=aPresContext@entry=0x4e527400, aImage=aImage@entry=0x4a15bf60, aGraphicsFilter=aGraphicsFilter@entry=FILTER_GOOD, aDest=..., aFill=..., 
    aAnchor=..., aDirty=..., aSVGContext=aSVGContext@entry=0x9a09bac0, aImageFlags=1113063424, aImageFlags@entry=1) at /Users/snorp/source/gecko-dev/layout/base/nsLayoutUtils.cpp:5179
#4  0x574b41b2 in nsLayoutUtils::DrawBackgroundImage (aRenderingContext=aRenderingContext@entry=0x47c52850, aPresContext=aPresContext@entry=0x4e527400, aImage=0x4a15bf60, aImageSize=..., aGraphicsFilter=aGraphicsFilter@entry=FILTER_GOOD, 
    aDest=..., aFill=..., aAnchor=..., aDirty=..., aImageFlags=1) at /Users/snorp/source/gecko-dev/layout/base/nsLayoutUtils.cpp:5351
#5  0x574bf970 in nsImageRenderer::Draw (this=this@entry=0x9a09bc08, aPresContext=aPresContext@entry=0x4e527400, aRenderingContext=..., aDirtyRect=..., aDest=..., aFill=..., aAnchor=..., aSrc=...)
    at /Users/snorp/source/gecko-dev/layout/base/nsCSSRendering.cpp:4631
#6  0x574bfafc in nsImageRenderer::DrawBackground (this=this@entry=0x9a09bc08, aPresContext=aPresContext@entry=0x4e527400, aRenderingContext=..., aDest=..., aFill=..., aAnchor=..., aDirty=...)
    at /Users/snorp/source/gecko-dev/layout/base/nsCSSRendering.cpp:4724
#7  0x574ccc58 in nsCSSRendering::PaintBackgroundWithSC (aPresContext=aPresContext@entry=0x4e527400, aRenderingContext=..., aForFrame=aForFrame@entry=0x4a321868, aDirtyRect=..., aBorderArea=..., aBackgroundSC=aBackgroundSC@entry=0x4a32a9b0, 
    aBorder=..., aFlags=aFlags@entry=2, aBGClipRect=aBGClipRect@entry=0x46bacfe8, aLayer=aLayer@entry=0) at /Users/snorp/source/gecko-dev/layout/base/nsCSSRendering.cpp:2790
#8  0x574ccdd0 in nsCSSRendering::PaintBackground (aPresContext=aPresContext@entry=0x4e527400, aRenderingContext=..., aForFrame=aForFrame@entry=0x4a321868, aDirtyRect=..., aBorderArea=..., aFlags=aFlags@entry=2, 
    aBGClipRect=aBGClipRect@entry=0x46bacfe8, aLayer=0) at /Users/snorp/source/gecko-dev/layout/base/nsCSSRendering.cpp:1601
#9  0x574cce6e in nsDisplayBackgroundImage::PaintInternal (this=this@entry=0x46bacf90, aBuilder=<optimized out>, aCtx=0x47c52850, aBounds=..., aClipRect=aClipRect@entry=0x46bacfe8) at /Users/snorp/source/gecko-dev/layout/base/nsDisplayList.cpp:2341
#10 0x574ccea0 in nsDisplayBackgroundImage::Paint (this=0x46bacf90, aBuilder=<optimized out>, aCtx=<optimized out>) at /Users/snorp/source/gecko-dev/layout/base/nsDisplayList.cpp:2327
#11 0x574935d2 in mozilla::FrameLayerBuilder::PaintItems (this=this@entry=0x473d3d80, aItems=..., aRect=..., aContext=aContext@entry=0x46fd40f0, aRC=0x47c52850, aBuilder=aBuilder@entry=0x9a09cbc0, aPresContext=aPresContext@entry=0x4e527400, 
    aOffset=..., aXScale=1, aYScale=1, aCommonClipCount=0) at /Users/snorp/source/gecko-dev/layout/base/FrameLayerBuilder.cpp:4242
#12 0x574939de in mozilla::FrameLayerBuilder::DrawThebesLayer (aLayer=0x46bb2800, aContext=0x46fd40f0, aRegionToDraw=..., aClip=<optimized out>, aRegionToInvalidate=..., aCallbackData=0x9a09cbc0)
    at /Users/snorp/source/gecko-dev/layout/base/FrameLayerBuilder.cpp:4404
#13 0x56b14bb0 in mozilla::layers::BasicThebesLayer::PaintThebes (this=0x46bb2800, aContext=0x46fd40f0, aMaskLayer=0x0, 
    aCallback=0x5749368d <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, aCallbackData=0x9a09cbc0)
    at /Users/snorp/source/gecko-dev/gfx/layers/basic/BasicThebesLayer.cpp:94
#14 0x56b09c26 in mozilla::layers::BasicLayerManager::PaintSelfOrChildren (this=this@entry=0x471e9350, aPaintContext=..., aGroupTarget=aGroupTarget@entry=0x46fd40f0) at /Users/snorp/source/gecko-dev/gfx/layers/basic/BasicLayerManager.cpp:732
#15 0x56b09ed0 in mozilla::layers::BasicLayerManager::PaintLayer (this=0x471e9350, aTarget=0x46fd40f0, aLayer=0x46bb2800, aCallback=<optimized out>, aCallbackData=0x9a09cbc0)
    at /Users/snorp/source/gecko-dev/gfx/layers/basic/BasicLayerManager.cpp:859
#16 0x56b09c6a in mozilla::layers::BasicLayerManager::PaintSelfOrChildren (this=this@entry=0x471e9350, aPaintContext=..., aGroupTarget=aGroupTarget@entry=0x46fd40f0) at /Users/snorp/source/gecko-dev/gfx/layers/basic/BasicLayerManager.cpp:745
#17 0x56b09ed0 in mozilla::layers::BasicLayerManager::PaintLayer (this=this@entry=0x471e9350, aTarget=0x46fd40f0, aLayer=0x46bb2400, 
    aCallback=aCallback@entry=0x5749368d <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, 
    aCallbackData=aCallbackData@entry=0x9a09cbc0) at /Users/snorp/source/gecko-dev/gfx/layers/basic/BasicLayerManager.cpp:859
#18 0x56b0a626 in mozilla::layers::BasicLayerManager::EndTransactionInternal (this=0x471e9350, 
    aCallback=0x5749368d <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, aCallbackData=0x9a09cbc0, aFlags=<optimized out>)
    at /Users/snorp/source/gecko-dev/gfx/layers/basic/BasicLayerManager.cpp:524
#19 0x574d0d72 in nsDisplayList::PaintForFrame (this=this@entry=0x9a09cae8, aBuilder=aBuilder@entry=0x9a09cbc0, aCtx=aCtx@entry=0x47c7ce50, aForFrame=<optimized out>, aFlags=aFlags@entry=0)
    at /Users/snorp/source/gecko-dev/layout/base/nsDisplayList.cpp:1341
#20 0x574d0f70 in nsDisplayList::PaintRoot (this=this@entry=0x9a09cae8, aBuilder=aBuilder@entry=0x9a09cbc0, aCtx=aCtx@entry=0x47c7ce50, aFlags=0) at /Users/snorp/source/gecko-dev/layout/base/nsDisplayList.cpp:1188
#21 0x574d1ef0 in nsLayoutUtils::PaintFrame (aRenderingContext=0x47c7ce50, aFrame=0x4f3262b8, aDirtyRegion=..., aBackstop=4294967295, aFlags=59) at /Users/snorp/source/gecko-dev/layout/base/nsLayoutUtils.cpp:3027
#22 0x57477798 in RenderDocument (aThebesContext=0x46fd40f0, aBackgroundColor=4294967295, aFlags=<optimized out>, aRect=..., this=0x98a46080) at /Users/snorp/source/gecko-dev/layout/base/nsPresShell.cpp:4842
#23 PresShell::RenderDocument (this=0x98a46080, aRect=..., aFlags=<optimized out>, aBackgroundColor=4294967295, aThebesContext=0x46fd40f0) at /Users/snorp/source/gecko-dev/layout/base/nsPresShell.cpp:4716
#24 0x57147686 in mozilla::AndroidBridge::CaptureThumbnail (this=0x9b639110, window=<optimized out>, bufW=350, bufH=200, tabId=0, buffer=0x3006da, shouldStore=@0x9a09d1af: true) at /Users/snorp/source/gecko-dev/widget/android/AndroidBridge.cpp:1865
#25 0x5715868a in ThumbnailRunnable::Run (this=0x4ebb13e0) at /Users/snorp/source/gecko-dev/widget/android/nsAppShell.cpp:102
#26 0x5715816a in DispatchToMethod<ThumbnailRunnable, tag_nsresult (ThumbnailRunnable::*)()> (method=&virtual ThumbnailRunnable::Run(), obj=<optimized out>, arg=...) at /Users/snorp/source/gecko-dev/ipc/chromium/src/base/tuple.h:383
#27 RunnableMethod<ThumbnailRunnable, tag_nsresult (ThumbnailRunnable::*)(), Tuple0>::Run (this=<optimized out>) at /Users/snorp/source/gecko-dev/ipc/chromium/src/base/task.h:307
#28 0x56720d8a in MessageLoop::RunTask (this=this@entry=0x9b6430c0, task=task@entry=0x4ebb1420) at /Users/snorp/source/gecko-dev/ipc/chromium/src/base/message_loop.cc:357
#29 0x56722be6 in MessageLoop::ProcessNextDelayedNonNestableTask (this=this@entry=0x9b6430c0) at /Users/snorp/source/gecko-dev/ipc/chromium/src/base/message_loop.cc:245
#30 0x56722bf6 in MessageLoop::DoIdleWork (this=0x9b6430c0) at /Users/snorp/source/gecko-dev/ipc/chromium/src/base/message_loop.cc:474
#31 0x5673d406 in mozilla::ipc::MessagePump::Run (this=0x9b601d90, aDelegate=0x9b6430c0) at /Users/snorp/source/gecko-dev/ipc/glue/MessagePump.cpp:132
#32 0x56721112 in MessageLoop::RunInternal (this=this@entry=0x9b6430c0) at /Users/snorp/source/gecko-dev/ipc/chromium/src/base/message_loop.cc:229
#33 0x56721150 in RunHandler (this=0x9b6430c0) at /Users/snorp/source/gecko-dev/ipc/chromium/src/base/message_loop.cc:222
#34 MessageLoop::Run (this=0x9b6430c0) at /Users/snorp/source/gecko-dev/ipc/chromium/src/base/message_loop.cc:196
#35 0x57133060 in nsBaseAppShell::Run (this=0x53003240) at /Users/snorp/source/gecko-dev/widget/xpwidgets/nsBaseAppShell.cpp:164

Comment 14

[James Willcox (:snorp) ([e-mail]) (he/him)]

Help me Matt Woodrow you're my only hope

Comment 15

[Robert Kaiser]

(In reply to James Willcox (:snorp) ([e-mail]) from comment #9)
> I ran into this yesterday at the following url: http://www.ispyconnect.com/

Note that we have a spike in OOM|small crashes starting yesterday (8/26) and this bug has been filed before, so anything that does not reproduce with builds befor4e yesterday is probably a different bug, possibly bug 1058567.

Comment 16

[Matt Woodrow (:mattwoodrow)]

There's at least a few things that we could/should be doing here.

Firstly I'd say that ComputeSnappedImageDrawingParameters should be setting shouldDraw = false when we've computed a singular matrix. Stepping through this computation to find out why this happens would be really useful. Adding ni?seth since he rewrote this all recently.

We also shouldn't be using cairo_get_target(mContext), and just use mSurface instead within DrawTargetCairo::CreateSimilarDrawTarget. That way cairo errors won't stop us from creating other surfaces.

Comment 17

[Tobias B. Besemer [:BesTo] (QA)]

Added domain to differ between crashes in https://crash-stats.mozilla.com, because there are more reproducible crashers there with [@ OOM | small ].

Comment 18

[Matt Woodrow (:mattwoodrow)]

Attachment: cairo-crash

Comment 19

[Seth Fowler [:seth] [:s2h]]

The only possibilities I can see for producing a singular matrix in ComputeSnappedImageDrawingParameters are:

1. The final fill we use (|fill|) has zero size.
2. The final dest rect we use (|anchoredDestRect|) has zero size.
3. The current matrix on the gfxContext was already singular before we started. Presumably that's not possible, though.

The first two possibilities would result in a matrix with all zeros, excluding the translation components.

I'm going to leave this needinfo on because I'd like to actually reproduce this if I can, just in case I've missed something, but I suspect checking #1 and #2 above should fix this.

Comment 20

[Ed Morley [:emorley]]

I hit this reproducably on nexus 5 with latest nightly after scrolling down on:
https://wiki.mozilla.org/Auto-tools/Projects/Treeherder

bp-61e0f18b-e8c7-48e2-bc65-69cb32140828	08/29/14	00:27
bp-f0d5503c-e0aa-4f4f-ae78-c7b312140828	08/29/14	00:26
bp-4e7f3695-497b-43fa-a648-81be62140828	08/29/14	00:26
bp-f064a0ae-e609-4eba-b6f6-aaeab2140828	08/29/14	00:25
bp-0fd8def3-2a20-48f8-b28f-fb1102140828	08/29/14	00:25

Comment 21

[Matt Woodrow (:mattwoodrow)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/485b611e3d44

Comment 22

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/485b611e3d44

Comment 23

[Liz Henry (:lizzard)]

I'm hoping this will help the high crash rate we're currently seeing in Aurora. But most of those are desktop crashes on Windows. 

Is this bug/fix possibly also affecting desktop Firefox? Thanks.

Comment 24

[James Willcox (:snorp) ([e-mail]) (he/him)]

Latest nightly (today's respin) on Android seems to be fixed.

Comment 25

[James Willcox (:snorp) ([e-mail]) (he/him)]

(In reply to Liz Henry :lizzard from comment #23)
> I'm hoping this will help the high crash rate we're currently seeing in
> Aurora. But most of those are desktop crashes on Windows. 
> 
> Is this bug/fix possibly also affecting desktop Firefox? Thanks.

Entirely possible it could affect desktop, yes.

Comment 26

[Bill Gianopoulos [:WG9s]]

I have not seen any crashes with today's Nightly so that is an improvement.  I also looked at crash stats for today and I am fairly certain that the only crash so far with today's buildid and this signature is using the not yet supported Windows 64-bit builds.  But not sure how to properly navigate the crash stats site, but it seems to be an official build and the crash appeared on the site before the official 32-bit build completed.

Comment 29

[Seth Fowler [:seth] [:s2h]]

Argh, I went to try to reproduce this today and realized I don't have access to the system I need to do it right now. I'm going to file a followup to harden ComputeSnappedImageDrawingParameters against the possible issues discussed in comment 19; I don't think it's worth delaying.

Comment 30

[Robert Kaiser]

Note that there are a few reports of crashes with this signature that verify they are fixed after the patch here landed, see the dupes.

Comment 31

[Gian-Carlo Pascutto [:gcp]]

I had a reproducible test case for this on Android that is now fixed, but I'm seeing horizontal blue seams in the webpages. I'll investigate if this fix is the cause on Monday.

Comment 32

[Matt Woodrow (:mattwoodrow)]

(In reply to Liz Henry :lizzard from comment #23)
> I'm hoping this will help the high crash rate we're currently seeing in
> Aurora. But most of those are desktop crashes on Windows. 
> 
> Is this bug/fix possibly also affecting desktop Firefox? Thanks.

Yes, it could affect desktop windows on systems that don't have direct2d h/w acceleration enabled.

Comment 36

[Mark Finkle (:mfinkle) (use needinfo?)]

What uplift are we looking for with this patch? I see the OOM crash at #1 on all channels.

Comment 37

[Matt Woodrow (:mattwoodrow)]

[Tracking Requested - why for this release]:

#1 top crash

Comment 38

[Sylvestre Ledru [:Sylvestre]]

Top crash, tracking.

Comment 39

[Robert Kaiser]

(In reply to Mark Finkle (:mfinkle) from comment #36)
> What uplift are we looking for with this patch? I see the OOM crash at #1 on
> all channels.

That doesn't necessarily mean that this patch fixes any of those. The patch has fixed at least a good portion of the *spike* in this signature that we have seen in 34, but it's neither clear yet if it fixed all of it nor if it fixed any crash cases we had before the spike happened.

Comment 40

[Bill Gianopoulos [:WG9s]]

As far as I know this patch only fixed issues that started with the 8/26 Nightly builds, so not sure how it would relate to crashes from before then.

Comment 41

[Robert Kaiser]

Matt, given you said the patch here might fix bug 1060268 as well, does that mean we should uplift the patch to 33 (currently on beta)?

Comment 43

[Matt Woodrow (:mattwoodrow)]

Comment on attachment 8480336 [details] [diff] [review]
cairo-crash

Approval Request Comment
[Feature/regressing bug #]: Unknown
[User impact if declined]: #1 topcrash
[Describe test coverage new/current, TBPL]: Tested manually.
[Risks and why]: Very low risk, just avoids a potential cairo error
[String/UUID change made/needed]: None

Comment 44

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/9337f5dcf107

This landed on m-c during the Gecko 34 cycle, so it's already on Aurora. Also, is this something we'd potentially need for b2g32 (v2.0)?

Comment 45

[Matt Woodrow (:mattwoodrow)]

Yes, I suspect we want this for b2g32. It looks like it would have the same bug.

Comment 46

[Ryan VanderMeulen [:RyanVM]]

Please request approval in that case :)

Comment 47

[Matt Woodrow (:mattwoodrow)]

Comment on attachment 8480336 [details] [diff] [review]
cairo-crash

NOTE: Please see https://wiki.mozilla.org/Release_Management/B2G_Landing to better understand the B2G approval process and landings.

[Approval Request Comment]
Same as above :)

Comment 48

[bhavana bajaj [:bajaj]]

Comment on attachment 8480336 [details] [diff] [review]
cairo-crash

Making an exception on approving this for 2.0 as this may fix a potential crash.

Comment 49

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g32_v2_0/rev/cb7555c9ac26

Comment 50

[Kai-Zhen Li [:seinlin][:kli]]

http://hg.mozilla.org/releases/mozilla-b2g32_v2_0m/rev/cb7555c9ac26

Comment 51

[Yeojin Chung [:YeojinC]]

This issue is verified fixed on Flame 2.0, 2.1.

Result: No crash occurs when the user pinch-zooms on the website on Comment O. 

Device: Flame 2.0 (319mb)(Kitkat Base)(Full Flash)
BuildID: 20141029000205
Gaia: 9f5b6f025e528fabfcc068782cb9b492cb51a7f9
Gecko: de8cfd54bf93
Gonk: 48835395daa6a49b281db62c50805bd6ca24077e
Version: 32.0 (2.0)
Firmware: V188
User Agent: Mozilla/5.0 (Mobile; rv:32.0) Gecko/32.0 Firefox/32.0

Device: Flame 2.1 (319mb)(Kitkat Base)(Full Flash)
BuildID: 20141029001202
Gaia: eb0aab0f13c78c7ac378ad860e865c4b6eaf669f
Gecko: 318019f80a8e
Gonk: 48835395daa6a49b281db62c50805bd6ca24077e
Version: 34.0 (2.1) 
Firmware Version: v188
User Agent: Mozilla/5.0 (Mobile; rv:34.0) Gecko/34.0 Firefox/34.0

Comment 52

[Coler]

Hi, Josh
    Please provide the bug reproduce steps and videos, which could help with our verification.

Comment 53

[Hubert Lu[:hlu] <[e-mail]>]

(In reply to Coler from comment #52)
> Hi, Josh
>     Please provide the bug reproduce steps and videos, which could help with
> our verification.

Hi Coler,
    STR is described on comment 0, and it is:

    == STEP ==
    (1) Visit http://www.reddit.com/r/askscience/comments/28vajr/if_i_had_a_sealed_room_filled_with_butane_gas_and/ 
    (2) Pinch-zoom, and check if it works properly. We expect it should not have crash issue.

Comment 54

[Coler]

This issue has been verified successfully on Woodduck 2.0.
Reproducing rate: 0/10
See attachment: Verify_Woodduck_Zoom.mp4

build version:
Gaia-Rev        87b23fa81c3b59f2ba24b84f7d686f4160d4e7cb
Gecko-Rev       d049d4ef127844121c9cf14d2e8ca91fd9045fcb
Build-ID        20141125050313
Version         32.0

Comment 55

[Coler]

Attachment: Verify_Woodduck_Zoom.mp4

Comment 56

[Rob]

I had a crash with Firefox Nightly 40.0a1 (2015-04-21), on Win XP bp-9a7e3d05-62d3-47bc-85a8-f63022150421 .

That MCR's "Related Bugs" more properly directs us (me?) to Bug 1058567 Comment 24 (Platform: "All Linux", IE: non-Android), but you can bet that I am not pinch-zooming my Desktop's Screen after visiting the example URL (or the different URL which caused the Crash for me) given above (thus, the closed Bug may be more helpful if reopened?).

My crash came from highlighting text and then right-clicking and choosing the 'Search (default Search Engine) for "text highlighted"' Menu Feature. That simply brings up https://encrypted.google.com/ (in my case), which is a Page that we hope does not crash Firefox.

FWIW (not much ?) I tested these other URLS at Bug 1060268 and Bug 1045588 and they did not crash my Browser.

I note that Lines 1274 - 1278 gfxContext.cpp (URL linked in the MCR, see also http://hg.mozilla.org/mozilla-central/diff/6c673d6a2fb8/gfx/thebes/gfxContext.cpp) contains an "#ifdef XP_WIN", so an XP-centric Bug Report seems indicated.