Crash [@ SkPixelRef::unlockPixels() ] | [@ mozilla::net::HttpChannelChild::OnStopRequest(nsresult const&, mozilla::net::ResourceTimingStruct const&) ]

VERIFIED FIXED

Status

()

defect
--
major
VERIFIED FIXED
4 years ago
3 years ago

People

(Reporter: bc, Unassigned)

Tracking

(Blocks 1 bug, 4 keywords)

Trunk
x86_64
macOS
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox39 disabled, firefox41+ verified, firefox-esr38 disabled)

Details

(Whiteboard: [adv-main41+], crash signature, )

Attachments

(2 attachments)

Reporter

Description

4 years ago
Posted file Debug Crash report
1. http://plus.shonenjump.com/client_info/SHUEISHA/html/player/viewer.html?tw=1&lin=1&cid=SHSA_JP01PLUS00001593_57

2. Crash Opt/Debug Nightly on OSX. Doesn't Crash Release.

bp-7508f335-408f-4579-9959-6aa952150517
[@ SkPixelRef::unlockPixels() ]

bp-dd9ca7ab-b5c4-495e-acdb-67ae72150517
[@ mozilla::net::HttpChannelChild::OnStopRequest(nsresult const&, mozilla::net::ResourceTimingStruct const&) ]

Debug
[@ SkImageInfo::validate() ]

Operating system: Mac OS X
                  10.9.5 13F1077
CPU: amd64
     family 6 model 42 stepping 7
     4 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0xffffffffbbadbeef
Process uptime: 22 seconds

Thread 45 (crashed)
 0  XUL!SkImageInfo::validate() const [SkBitmap.cpp : 1401 + 0xf]
    rax = 0x00000000bbadbeef   rdx = 0x49003ab2af83cba7
    rcx = 0x000000012994a1b0   rbx = 0x000000012994b000
    rsi = 0x49003ab2af83cba7   rdi = 0x0000390000003a03
    rbp = 0x000000012994a200   rsp = 0x000000012994a1f0
     r8 = 0x0000000000000040    r9 = 0x0000000129949f00
    r10 = 0x000000000000007d   r11 = 0x0000000000000206
    r12 = 0x0000000000005d0f   r13 = 0x0000000000000000
    r14 = 0x00000001288bdfe0   r15 = 0x000000010136c320
    rip = 0x0000000106acddbc

s-s due to badbeef
Reporter

Comment 1

4 years ago
Related but OSX 10.6 only?

1. http://meteopost.com/weather/kiev/
2. Debug Nightly/41 Crash 

I can't do much here since Nightly doesn't display on my OSX 10.6 machines though it appears to load content.

Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0xffffffffbbadbeef
Process uptime: 17 seconds

Thread 39 (crashed)
 0  XUL!SkDashPathEffect::SkDashPathEffect(float const*, int, float) [SkDashPathEffect.cpp : 25 + 0xf]
    rax = 0x00000000bbadbeef   rdx = 0xd224e320dfc560c2
    rcx = 0x0000000141dab2d0   rbx = 0x0000000141dac000
    rsi = 0xd224e320dfc560c2   rdi = 0x00007fff708dda60
    rbp = 0x0000000141dab350   rsp = 0x0000000141dab310
     r8 = 0x00007fff708dda60    r9 = 0x0000000000000000
    r10 = 0x0000000000000079   r11 = 0x0000000000000206
    r12 = 0x0000000000000000   r13 = 0x000000000000a407
    r14 = 0x0000000101b6c320   r15 = 0x0000000122702660
    rip = 0x00000001075ceb70
Found by: given as instruction pointer in context
Milan, is there somebody who can look at this?  Thanks.
Flags: needinfo?(milan)
[Tracking Requested - why for this release]: We default to Skia canvas as of 40.  This crash is there with Skia canvas only.  We should track this and make sure we fix or roll back the preference change.
Blocks: 932958
Flags: needinfo?(milan)
Flags: needinfo?(mstange)
In 7508f335-408f-4579-9959-6aa952150517 the crash is happening in a worker thread, and bug 857895 (which made us use worker threads) was backed out for crashes like these. See also bug 1165799 and bug 1165710.
Flags: needinfo?(mstange)
This is a sec-high and reproducible bug so adding a tracking flag for FF40 and FF41.
Comment 4 is suggesting this is "fixed" with the backout of bug 857895.  Bob, can you still reproduce?  I can't on 10.9.5.
Flags: needinfo?(bob)
Reporter

Comment 7

4 years ago
I can't reproduce in automation on osx/rhel/windows. -> fixed by backout.
Blocks: 857895
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Flags: needinfo?(bob)
Resolution: --- → FIXED
Is fx40 really affected? I don't think 857895 ever landed there.
Flags: needinfo?(milan)
Reporter

Comment 9

4 years ago
fwiw, I don't recall seeing this on anything but 41 and tested 39,40 and 41 when I checked this.

Updated

4 years ago
Group: core-security → core-security-release
Confirmed crash on Fx41 debug, 2015-05-16. 
Verified fixed on Fx41 debug, 2015-05-28.
Status: RESOLVED → VERIFIED
Whiteboard: [adv-main41+]
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.