1067311 - Crash in gfxSurfaceDrawable::DrawWithSamplingRect(gfxContext*, gfxRect const&, gfxRect const&, bool, GraphicsFilter const&, double)

Status: VERIFIED FIXED

(Core :: Graphics, defect)

Description

[Johannes Pfrang [:johnp]]

This bug was filed from the Socorro interface and is 
report bp-854ec442-624b-40d2-803b-390492140915.
=============================================================

This crash signature is new to the 14.09.2014 build and has this (memcpy) signature and signatures like this:

bp-8223ab5a-ec74-4616-8dff-eca6e2140915

Searches:

https://crash-stats.mozilla.com/report/list?product=Firefox&query_type=contains&range_unit=days&process_type=any&hang_type=any&signature=gfxSurfaceDrawable%3A%3ADrawWithSamplingRect%28gfxContext*%2C+gfxRect+const%26%2C+gfxRect+const%26%2C+bool%2C+GraphicsFilter+const%26%2C+double%29&date=2014-09-15+11%3A00%3A00&range_value=28#tab-table

https://crash-stats.mozilla.com/report/list?product=Firefox&query_type=contains&range_unit=days&process_type=any&hang_type=any&signature=memcpy+|+gfxSurfaceDrawable%3A%3ADrawWithSamplingRect%28gfxContext*%2C+gfxRect+const%26%2C+gfxRect+const%26%2C+bool%2C+GraphicsFilter+const%26%2C+double%29&date=2014-09-15+11%3A00%3A00&range_value=28#tab-table

Therefore a regression from yesterdays build.

Comment 1

[Johannes Pfrang [:johnp]]

Blocking the bug that introduced this code into central yesterday.

Comment 2

[Robert Kaiser]

Adding https://crash-stats.mozilla.com/report/list?signature=gfxSurfaceDrawable%3A%3ADrawInternal%28gfxContext%2A%2C%20gfxRect%20const%26%2C%20mozilla%3A%3Agfx%3A%3AIntRectTyped%3Cmozilla%3A%3Agfx%3A%3AUnknownUnits%3E%20const%26%2C%20bool%2C%20GraphicsFilter%20const%26%2C%20double%2C%20gfxMatrix%20const%26%29 which I'm pretty sure is caused by the same thing.


I somewhat suspect that https://crash-stats.mozilla.com/report/list?signature=%400x0%20%7C%20gfxUtils%3A%3ADrawPixelSnapped%28gfxContext%2A%2C%20gfxDrawable%2A%2C%20gfxSize%20const%26%2C%20mozilla%3A%3Aimage%3A%3AImageRegion%20const%26%2C%20mozilla%3A%3Agfx%3A%3ASurfaceFormat%2C%20GraphicsFilter%2C%20unsigned%20int%2C%20double%29 is this as well, but I'd only dare to add it here if someone with knowledge of the code can confirm that.

Comment 3

[Benjamin Kerensa [:bkerensa]]

Does it make sense to nominate this for tracking?

Comment 4

[Robert Kaiser]

[Tracking Requested - why for this release]:
(In reply to Benjamin Kerensa [:bkerensa] from comment #3)
> Does it make sense to nominate this for tracking?

Given that it remains at #1 on Nightly and seemingly doesn't get attention, yes.

Comment 5

[Matt Woodrow (:mattwoodrow)]

Attachment: Don't crash if SourceSurface allocation fails

Looks like this happens on windows sometimes, and the old path (FillRect with an empty SurfacePattern) handles it gracefully.

Comment 6

[Matt Woodrow (:mattwoodrow)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1f03487d2904

Comment 7

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/1f03487d2904

Comment 8

[Wayne Mery (:wsmwk)]

I crashed bp-51ad923c-5496-4aac-a6f4-970a72140926 even with this patch, assuming it was in my 2014-09-24 nightly build. 

Install Time	2014-09-24 16:25:39
Product	Firefox
Version	35.0a1
Build ID	20140924030204
Release Channel	nightly

Comment 9

[Johannes Pfrang [:johnp]]

There are no crash reports after build id 20140924030204. Therefore this seems to be fixed.
In any way, something looks wrong, because your crash report (and a lot others too) is of revision 1e2993c99323 which should include the fix. Anyone have an idea what was going on here?

Comment 10

[[SV Manager] Florin Mezei, QA (:FlorinMezei)]

Socorro shows no more crashes over the past 4 weeks, with either of these 3 signatures.