1071079 - Nightly crash in moz_cairo_surface_destroy with 0x5a5a... rbx/rcx registers

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Robert Kaiser]

This bug was filed from the Socorro interface and is 
report bp-b7f90133-9ebc-4aae-8da5-4176d2140920.
=============================================================

Top frames:
0 	gkmedias.dll 	moz_cairo_surface_destroy 	gfx/cairo/cairo/src/cairo-surface.c
1 	xul.dll 	mozilla::gfx::DrawTargetCairo::~DrawTargetCairo() 	gfx/2d/DrawTargetCairo.cpp
2 	xul.dll 	mozilla::gfx::DrawTargetCairo::`scalar deleting destructor'(unsigned int) 	
3 	xul.dll 	mozilla::gfx::Factory::CreateDrawTargetForData(mozilla::gfx::BackendType, unsigned char*, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, int, mozilla::gfx::SurfaceFormat) 	gfx/2d/Factory.cpp
4 	xul.dll 	mozilla::layers::ImageDataSerializerBase::GetAsDrawTarget(mozilla::gfx::BackendType) 	gfx/layers/ImageDataSerializer.cpp
5 	xul.dll 	mozilla::layers::BufferTextureClient::BorrowDrawTarget() 	gfx/layers/client/TextureClient.cpp
6 	xul.dll 	mozilla::layers::ContentClientRemoteBuffer::CreateBuffer(gfxContentType, nsIntRect const&, unsigned int, mozilla::RefPtr<mozilla::gfx::DrawTarget>*, mozilla::RefPtr<mozilla::gfx::DrawTarget>*) 	gfx/layers/client/ContentClient.cpp
7 	xul.dll 	mozilla::layers::RotatedContentBuffer::BeginPaint(mozilla::layers::ThebesLayer*, unsigned int) 	gfx/layers/RotatedBuffer.cpp
8 	xul.dll 	mozilla::layers::ContentClientBasic::BeginPaintBuffer(mozilla::layers::ThebesLayer*, unsigned int) 	gfx/layers/client/ContentClient.h
9 	xul.dll 	mozilla::layers::ClientThebesLayer::PaintThebes() 	gfx/layers/client/ClientThebesLayer.cpp
[...]

This started with the 20140920030206 build on 35.0a1 Nightly, is Win64 only (7/8/8.1) and the registers in the "Raw Dump" tab have rbx: "0x5a5a5a5a5a5a5a5a", rcx: "0x5a5a5a5a5a5a5a72" which sounds somewhat suspect. The crashes are EXCEPTION_ACCESS_VIOLATION_READ and the address is reported as 0xffffffffffffffff but we know that might be bogus due to Intel processor limitations in 64bit and the registers can be telling us more, that's why I mentioned the suspect ones here. Exploitability is reported as low and graphics cards are all over the place.

More stats and reports can be found at https://crash-stats.mozilla.com/report/list?signature=moz_cairo_surface_destroy

Comment 1

[(Away)]

Dead surface. rbx is |surface| and rcx is |&surface->ref_count|:

gkmedias!_moz_cairo_surface_destroy+0x11:
000007fe`ee6afa71 8339ff          cmp     dword ptr [rcx],0FFFFFFFFh ds:5a5a5a5a`5a5a5a72=????????

Comment 3

[Matt Woodrow (:mattwoodrow)]

Doesn't that mean that |this| is already deleted in the DrawTargetCairo dtor? I can't see how that could happen (or how the earlier cairo call in the same dtor works).

Comment 4

[alex_mayorga]

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 ID:20141015030202 CSet: 62f0b771583c

Report ID 	Date Submitted
bp-f64ec831-2612-4c18-8322-22b662141015	10/15/2014	1:47 PM
bp-0802317f-ebe8-4945-8352-5bb842141015	10/15/2014	1:45 PM

So this is not "Win64 only" or am I miss reading the bug?

Comment 5

[(Away)]

Originally this looked like Win64 only because of some signature variation. But Win32 has the same bug.

Comment 6

[Robert Kaiser]

The _moz_cairo_surface_destroy signature is almost exclusively 32bit, the signature without the leading underscore is 64bit.

Comment 7

[IU]

Is it possible the cause of this bug is somewhat similar to what was at issue in Bug 1082850?

Comment 8

[Lukas Blakk [:lsblakk] use ?needinfo]

Jeff - can you confirm if the question in comment 7 is on the right track here?

Comment 9

[Lukas Blakk [:lsblakk] use ?needinfo]

No more betas left for Desktop 35, have to wontfix.

Comment 10

[Sylvestre Ledru [:Sylvestre]]

Milan, do you know someone who could help on this bug? thanks

Comment 11

[(Away)]

This was fixed a long time ago by bug 1071079. Double checked with crash-stats.