transform: skew(90deg) cause FF to crash

NEW
Unassigned

Status

()

--
critical
4 years ago
a year ago

People

(Reporter: kleidt, Unassigned)

Tracking

({crash, reproducible})

Trunk
x86
All
crash, reproducible
Points:
---

Firefox Tracking Flags

(firefox32 affected, firefox33 affected, firefox34 affected, firefox35 affected, firefox-esr31 affected)

Details

(crash signature, URL)

Attachments

(1 attachment)

(Reporter)

Description

4 years ago
User Agent: Mozilla/5.0 (Windows NT 5.1; rv:31.0) Gecko/20100101 Firefox/31.0 (Beta/Release)
Build ID: 20140716183446

Steps to reproduce:

1) Visit http://www.css3maker.com/css3-transform.html
2) Play with the "Skew" slider


Actual results:

Firefox crashes at skew(90deg) and skew(-90deg) 


Expected results:

No Webpage should be able to crash a browser!

Comment 1

4 years ago
WFM using current Nightly on OS X. Can you reproduce with a new profile?
Could you add the crash report please?
Flags: needinfo?(kleidt)
Keywords: crash
(Reporter)

Comment 2

4 years ago
It's my first bugreport for Mozilla. I hope this is what you want:
https://crash-stats.mozilla.com/report/index/25d9a078-5413-46e7-81cc-b07012140829
Flags: needinfo?(kleidt)

Comment 3

4 years ago
(In reply to Michael Kleidt from comment #2)
> It's my first bugreport for Mozilla. I hope this is what you want:
> https://crash-stats.mozilla.com/report/index/25d9a078-5413-46e7-81cc-
> b07012140829

Thanks! There are already a lot of similar reports, but I'm not sure if they have the same cause (See comments in bug 1034254)
Whiteboard: DUPEME

Comment 4

4 years ago
WFM with FF31 on Win 7 with HWA on/off.
Reporter, can you test with a clean profile, please.
https://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-firefox-profiles
Flags: needinfo?(kleidt)
(Reporter)

Comment 5

4 years ago
I Test it with a clean profile:
https://crash-stats.mozilla.com/report/index/990ba114-0e23-4d88-acc5-3d9392140829

and I test it on a Win7 Mashine:
https://crash-stats.mozilla.com/report/index/facb4ba6-15c7-4281-ae8c-fee712140829

Perhaps a hint to reproduce:
1) Move the "Skew" slider lowly from left to right and reverse - several times. Some times this dose not work, but in this case I always manage to crash, when I "Skew" Radio-Button and use the "Skey Y" slider the same way.
Flags: needinfo?(kleidt)

Comment 6

4 years ago
Is it possible for you to paste here the data from the section "graphics" in the page about:support (type it in the location bar) for your 2 machines.
(Reporter)

Comment 7

4 years ago
XP Computer has

Grafik
Direct2D aktiviert	Wurde auf Grund Ihrer Grafiktreiberversion blockiert.
DirectWrite aktiviert	false (0.0.0.0)
Geräte-ID	0x29b2
GPU #2 aktiv	false
GPU-beschleunigte Fenster	0/1 Basic
Karten-Beschreibung	Intel(R) Q35 Express Chipset Family
Karten-RAM	Unknown
Karten-Treiber	igxprd32
Treiber-Datum	1-13-2010
Treiber-Version	6.14.10.5218
Vendor-ID	0x8086
WebGL-Renderer	Google Inc. -- ANGLE (Intel(R) Q35 Express Chipset Family Direct3D9 vs_0_0 ps_2_0)
windowLayerManagerRemote	false
AzureCanvasBackend	skia
AzureContentBackend	cairo
AzureFallbackCanvasBackend	cairo
AzureSkiaAccelerated	0


Win7 VM has
Grafik
Direct2D aktiviert	Wurde auf Grund Ihrer Grafikkarte blockiert, da ungelöste Treiberprobleme bestehen.
DirectWrite aktiviert	false (6.2.9200.16571)
Geräte-ID	0x0000
GPU #2 aktiv	false
GPU-beschleunigte Fenster	0/1 Basic Wurde auf Grund Ihrer Grafikkarte blockiert, da ungelöste Treiberprobleme bestehen.
Karten-Beschreibung	RDPDD Chained DD
Karten-RAM	Unknown
Karten-Treiber	RDPDD
Vendor-ID	0x0000
WebGL-Renderer	Wurde auf Grund Ihrer Grafikkarte blockiert, da ungelöste Treiberprobleme bestehen.
windowLayerManagerRemote	false
AzureCanvasBackend	skia
AzureContentBackend	cairo
AzureFallbackCanvasBackend	cairo
AzureSkiaAccelerated	0
(Reporter)

Comment 8

4 years ago
On a 64 Bit Win7 mashine, I wasn't able reproduce the problem. (Both XP and Win7 VM are 32 bit)
(Reporter)

Comment 9

4 years ago
I also couldn't reproduce it on my Ubuntu System (FF 31.0)

Some new findings: When I come near the skew(90deg) value, the rectangle get wider and wider. When it gets wider then the screen, scrollbars are added. When I understand it correctly, the width for  skew(90deg) is theretically infinite. But the calculation in Firefox will result in a fine value. But the questions are: what is the maximum width for a webpage? Depends this maximum width on the oerating system? Processor architecture? Graphic card? Graphic driver? ...?

Comment 10

4 years ago
Yes, it's probably this edge case, when the rectangle animation is only a thin line at 90° that disappears from the screen.

Comment 11

4 years ago
And I checked the website of Intel, you have the latest drivers for your old card:
https://downloadcenter.intel.com/SearchResult.aspx?lang=eng&ProdId=2880
So it will be difficult to fix something on that side.
(Reporter)

Comment 12

4 years ago
But why dose Firefox crashes? There should be a possibility to catch an exception or to prevent the execution like
if (width>maxwidht && osIs('xp') [or whatever else is trigering this bug] {
  width = maxwidth;
}
(Reporter)

Comment 13

4 years ago
Perhaps an interesting detail: The Win7 VM runs NOT on the XP mashine. Ist a bigger Server (I think Dell) which hosts all customer VM.

Updated

4 years ago
Severity: normal → critical

Comment 14

4 years ago
I tried to make the shape as long as possible in firefox-31.0.en-US.linux64, and it crashed with a similar trace: bp-d8eac6ce-8678-40c7-ac93-87a3c2140901

bug 1045588 also has such a trace.
Crash Signature: [@ OOM | small ]
Component: Untriaged → Graphics
OS: Windows XP → All
Product: Firefox → Core

Comment 15

4 years ago
(In reply to [:Aleksej] from comment #14)
> as long as possible

It could also have ended up very thin.
QA Whiteboard: [bugday-20140901][DUPEME]
Whiteboard: DUPEME

Comment 16

4 years ago
Crash consistently on Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0 ID:20140902030202 CSet: c360f3d1c00d

Steps:
- Load http://www.css3maker.com/css3-transform.html
- Select "Skew" radio button
- Slide "Skew X" until the rectangle in the "CSS3 Preview Area" becomes a thin line

Result:
Nightly crashes

Expected result:
Nightly doesn't crash
Status: UNCONFIRMED → NEW
Ever confirmed: true

Comment 17

4 years ago
Report ID 	Date Submitted
bp-96f4f0a6-3cdd-4008-8d24-83e312140902	9/2/2014	3:57 PM
bp-619985ad-e43a-4f68-83c5-a06b52140902	9/2/2014	3:50 PM
bp-88e1cef4-2f6a-45f2-a902-91b502140902	9/2/2014	3:24 PM

Updated

4 years ago
status-firefox32: --- → affected
status-firefox33: --- → affected
status-firefox34: --- → affected
status-firefox35: --- → affected
Version: 31 Branch → Trunk

Comment 18

4 years ago
I can reproduce the crash with HWA disabled and STR Comment 16. 
But I cannot reproduce with HWA enabled.

Regression window(m-c)
Good
http://hg.mozilla.org/mozilla-central/rev/1e33678f89fe
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0 ID:20130920190924
Bad:
http://hg.mozilla.org/mozilla-central/rev/a2c31dc69ab3
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0 ID:20130920193025
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1e33678f89fe&tochange=a2c31dc69ab3

Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/44952b2191fc
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0 ID:20130920023238
Bad:
http://hg.mozilla.org/integration/mozilla-inbound/rev/e844f4ed3e1f
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0 ID:20130920025128
Pushlog;
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=44952b2191fc&tochange=e844f4ed3e1f


In local build:
Last Good:ad266fafd429
First Bad:e844f4ed3e1f

Triggered by:
e844f4ed3e1f	Matt Woodrow — Bug 907926 - Enable Azure content for windows. r=nrc
Blocks: 907926
I can also see that on Linux, it OOMs right after.

Comment 20

4 years ago
Matt, you just fixed another OOM|small case in bug 1053934 and the regression range for this points to your patch for enabling Azure - is this case with those steps pointing to something we can easily enough get a fix for as well?
Flags: needinfo?(matt.woodrow)

Comment 21

4 years ago
With HWA off on Win 7, I crashed FF35 too.
Keywords: reproducible
(In reply to Robert Kaiser (:kairo@mozilla.com) from comment #20)
> Matt, you just fixed another OOM|small case in bug 1053934 and the
> regression range for this points to your patch for enabling Azure - is this
> case with those steps pointing to something we can easily enough get a fix
> for as well?

I strongly suspect that this will be fixed by the same patch.
Flags: needinfo?(matt.woodrow)

Comment 23

4 years ago
It wasn't, still crashes reliably on Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0 ID:20140904030202 CSet: 776fa9cf70cd

Report ID 	Date Submitted
bp-3089fcec-6bb2-42c9-abd2-a2c802140904	9/4/2014	10:38 AM
QA Whiteboard: [bugday-20140901][DUPEME] → [bugday-20140901]
Flags: needinfo?(matt.woodrow)

Updated

4 years ago
status-firefox-esr31: --- → affected

Comment 24

4 years ago
WFM Win XP Firefox Nightly 40.0a1 (2015-04-21). Some of the Skew setting become "ugly" but none "crashes" the Browser.

Comment 25

3 years ago
Created attachment 8625548 [details]
1060268.html

Not causing OOM here, but does freeze the browser.

I created a test case.

The element must be rotated any degree (other than 0), the element needs to be skewed -90 or 90 degrees, and the element must contain text.

The freeze occurs every paint I believe. Resizing the browser and switching tabs triggers it.

Comment 26

3 years ago
Graphics
--------

Adapter Description: AMD Radeon R7 200 Series
Adapter Drivers: aticfx64 aticfx64 aticfx64 aticfx32 aticfx32 aticfx32 atiumd64 atidxx64 atidxx64 atiumdag atidxx32 atidxx32 atiumdva atiumd6a atitmm64
Adapter RAM: 1024
Asynchronous Pan/Zoom: none
Device ID: 0x6613
Direct2D Enabled: true
DirectWrite Enabled: true (6.3.9600.17795)
Driver Date: 11-20-2014
Driver Version: 14.501.1003.0
GPU #2 Active: false
GPU Accelerated Windows: 1/1 Direct3D 11 (OMTC)
Subsys ID: 00000000
Supports Hardware H264 Decoding: true
Vendor ID: 0x1002
WebGL Renderer: Google Inc. -- ANGLE (AMD Radeon R7 200 Series Direct3D11 vs_5_0 ps_5_0)
windowLayerManagerRemote: true
AzureCanvasBackend: direct2d 1.1
AzureContentBackend: direct2d 1.1
AzureFallbackCanvasBackend: cairo
AzureSkiaAccelerated: 0
Do you get the same freeze with acceleration disabled?
Flags: needinfo?(matt.woodrow)
(Reporter)

Comment 28

2 years ago
I'm working on a new machine and I can't reproduce the error any more.
When the old system has frozen for ever, the new one just freeze for some seconds.
It looks like the error is handled internally:
WebGL2-Renderer: WebGL creation failed: * Error during ANGLE OpenGL init. * Error during ANGLE OpenGL init. * Error during ANGLE OpenGL init. * Error during ANGLE OpenGL init. * Error during ANGLE OpenGL init. * Exhausted GL driver caps.

Allgemeine Informationen
------------------------

Name: Firefox
Version: 51.0.1
Build-ID: 20170125094131
Update-Kanal: release
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:51.0) Gecko/20100101 Firefox/51.0
Betriebssystem: Windows_NT 6.1
Fenster mit mehreren Prozessen: 1/1 (aktiviert durch Benutzer)
Abgesicherter Modus: false

Absturzberichte der letzten 3 Tage
----------------------------------

Grafik
------

Allgemeine Merkmale
Compositing: Direct3D 11
Asynchrones Wischen und Zoomen: Mausrad-Eingabe aktiviert
WebGL-Renderer: Google Inc. -- ANGLE (Intel(R) HD Graphics Direct3D11 vs_4_0 ps_4_0)
WebGL2-Renderer: WebGL creation failed: * Error during ANGLE OpenGL init. * Error during ANGLE OpenGL init. * Error during ANGLE OpenGL init. * Error during ANGLE OpenGL init. * Error during ANGLE OpenGL init. * Exhausted GL driver caps.
H264-Dekodierung durch Hardware: No; Hardware video decoding disabled or blacklisted
Audio-Back-End: wasapi
Direct2D: true
DirectWrite: true (6.2.9200.21976)
GPU 1
Aktiv: Ja
Beschreibung: Intel(R) HD Graphics
Herstellerkennung: 0x8086
Gerätekennung: 0x0042
Treiber-Version: 8.15.10.2622
Treiber-Datum: 1-10-2012
Treiber: igdumd64 igd10umd64 igdumdx32 igd10umd32
Subsys-ID: 304b103c
RAM: Unknown

Weitere Informationen
ClearType-Parameter: Gamma: 2.2 Pixel Structure: RGB
AzureCanvasAccelerated: 0
AzureCanvasBackend: direct2d 1.1
AzureContentBackend: direct2d 1.1
AzureFallbackCanvasBackend: cairo
ClearType-Parameter: Gamma: 2.2 Pixel Structure: RGB
Entscheidungsprotokoll
D3D9_COMPOSITING:
disabled by default: Disabled by default
You need to log in before you can comment on or make changes to this bug.