1078693 - Nightly crash in mozilla::gfx::SourceSurfaceD2D1::GetDataSurface()

Status: VERIFIED FIXED

(Core :: Graphics, defect)

Description

[Robert Kaiser]

This bug was filed from the Socorro interface and is 
report bp-d51e3b5d-5b72-43d5-8f72-795d52141006.
=============================================================

Top Frames:
0 	xul.dll 	mozilla::gfx::SourceSurfaceD2D1::GetDataSurface() 	gfx/2d/SourceSurfaceD2D1.cpp
1 	xul.dll 	mozilla::gfx::GetCairoSurfaceForSourceSurface(mozilla::gfx::SourceSurface*, bool, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) 	gfx/2d/DrawTargetCairo.cpp
2 	xul.dll 	mozilla::gfx::GfxPatternToCairoPattern 	gfx/2d/DrawTargetCairo.cpp
3 	xul.dll 	mozilla::gfx::DrawTargetCairo::DrawPattern(mozilla::gfx::Pattern const&, mozilla::gfx::StrokeOptions const&, mozilla::gfx::DrawOptions const&, mozilla::gfx::DrawTargetCairo::DrawPatternType, bool) 	gfx/2d/DrawTargetCairo.cpp
4 	xul.dll 	mozilla::gfx::DrawTargetCairo::FillRect(mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::Pattern const&, mozilla::gfx::DrawOptions const&) 	gfx/2d/DrawTargetCairo.cpp
5 	xul.dll 	gfxSurfaceDrawable::DrawInternal(gfxContext*, gfxRect const&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, bool, GraphicsFilter const&, double, gfxMatrix const&) 	gfx/thebes/gfxDrawable.cpp
6 	xul.dll 	gfxSurfaceDrawable::Draw(gfxContext*, gfxRect const&, bool, GraphicsFilter const&, double, gfxMatrix const&) 	gfx/thebes/gfxDrawable.cpp
7 	xul.dll 	gfxUtils::DrawPixelSnapped(gfxContext*, gfxDrawable*, gfxSize const&, mozilla::image::ImageRegion const&, mozilla::gfx::SurfaceFormat, GraphicsFilter, unsigned int, double) 	gfx/thebes/gfxUtils.cpp
8 	xul.dll 	mozilla::image::imgFrame::Draw(gfxContext*, mozilla::image::ImageRegion const&, nsIntMargin const&, GraphicsFilter, unsigned int) 	image/src/imgFrame.cpp
9 	xul.dll 	mozilla::image::RasterImage::DrawWithPreDownscaleIfNeeded(mozilla::image::DrawableFrameRef&&, gfxContext*, nsIntSize const&, mozilla::image::ImageRegion const&, GraphicsFilter, unsigned int) 	image/src/RasterImage.cpp
10 	xul.dll 	mozilla::image::RasterImage::Draw(gfxContext*, nsIntSize const&, mozilla::image::ImageRegion const&, unsigned int, GraphicsFilter, mozilla::Maybe<mozilla::SVGImageContext> const&, unsigned int) 	image/src/RasterImage.cpp
11 	xul.dll 	DrawImageInternal 	layout/base/nsLayoutUtils.cpp
[...]

This started spiking on October 2 in 35.0a1 Nightly builds and didn't appear before the 2014100203 nightly build. Most of the URLs point to Facebook, so nothing helpful there, and Graphics Adapters also seem to be all over the place. Windows versions seem to be Win7 and up (including Win10 preview).

All the crashes seem to be EXCEPTION_ACCESS_VIOLATION_READ at address 0x0 so it smells a lot like a null deref to me.

Find more stats and reports at https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Agfx%3A%3ASourceSurfaceD2D1%3A%3AGetDataSurface%28%29

Comment 1

[Robert Kaiser]

[Tracking Requested - why for this release]:
This is the #2 crash on Nightly behind the already-fixed bug 1077746 and with more than double the volume of the usually list-leading OOM|small signature.

Comment 2

[Benjamin Smedberg]

Since this seems to have a clear nightly regression range, can you provide the link?

Comment 3

[Robert Kaiser]

https://crash-stats.mozilla.com/report/list?signature=IUnknown%3A%3AQueryInterface%3CID2D1Bitmap1%3E%28ID2D1Bitmap1%2A%2A%29 and https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Agfx%3A%3ASourceSurfaceD2D1%3A%3ASourceSurfaceD2D1%28ID2D1Image%2A%2C%20ID2D1DeviceContext%2A%2C%20mozilla%3A%3Agfx%3A%3ASurfaceFormat%2C%20mozilla%3A%3Agfx%3A%3AIntSizeTyped%3Cmozilla%3A%3Agfx%3A%3AUnknownUnits%3E%20const%26%2C%20mozilla%3A%3Agfx%3A%3ADrawTargetD2D1%2A%29 have the same regression range and go through mozilla::gfx::SourceSurfaceD2D1::SourceSurfaceD2D1() - I'm holding off on reporting a separate bug for those for now as they might be related.

(In reply to Benjamin Smedberg  [:bsmedberg] from comment #2)
> Since this seems to have a clear nightly regression range, can you provide
> the link?

Reluctantly, as I have too little time and dislike digging through FTP and assembling those URLs by hand. We really should have something that can automate this by just dropping in the ID of first nightly build affected and it would spit out the pushlog URL for the range from the nightly build before to that one. Know anyone who can do that?

So, regression range is http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=14665b1de5ee&tochange=2399d1ae89e9 which IMHO points unsurprisingly to bug 902952 which turned on D2D 1.1 where available.

Comment 4

[Benjamin Smedberg]

NI?milan for assignee.

Comment 5

[Milan Sreckovic [:milan] (needinfo for best results)]

Bas, related to the patterns / Moz2D work?

Comment 6

[Robert Kaiser]

(In reply to Robert Kaiser (:[e-mail]) from comment #3)
> We really should have something that can automate this by just dropping in the ID

FWIW, I filed bug 1080874 on that (not really related to the bug here, just to my rant about creating regression range URLs).

Comment 7

[Bas Schouten (:bas.schouten)]

(In reply to Milan Sreckovic [:milan] from comment #5)
> Bas, related to the patterns / Moz2D work?

Result of D2D 1.1, which I'll probably switch off on Aurora for now fwiw.

Comment 8

[Bas Schouten (:bas.schouten)]

I need to fix this though!

Comment 9

[Bas Schouten (:bas.schouten)]

Attachment: Correctly indicate validity of a SourceSurfaceD2D1 and deal with failed surface creation

Comment 10

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/0a69bc9e746c

Comment 11

[[SV Manager] Florin Mezei, QA (:FlorinMezei)]

Socorro [1] shows no crashes over the past 4 weeks.

[1] - https://crash-stats.mozilla.com/report/list?product=Firefox&range_unit=days&range_value=28&signature=mozilla%3A%3Agfx%3A%3ASourceSurfaceD2D1%3A%3AGetDataSurface%28%29