1165706 - Crash [@ SkPixelRef::unlockPixels() ] | [@ mozilla::net::HttpChannelChild::OnStopRequest(nsresult const&, mozilla::net::ResourceTimingStruct const&) ]

Status: VERIFIED FIXED

(Core :: Graphics, defect)

Description

[Bob Clary [:bc] (inactive)]

Attachment: Debug Crash report

1. http://plus.shonenjump.com/client_info/SHUEISHA/html/player/viewer.html?tw=1&lin=1&cid=SHSA_JP01PLUS00001593_57

2. Crash Opt/Debug Nightly on OSX. Doesn't Crash Release.

bp-7508f335-408f-4579-9959-6aa952150517
[@ SkPixelRef::unlockPixels() ]

bp-dd9ca7ab-b5c4-495e-acdb-67ae72150517
[@ mozilla::net::HttpChannelChild::OnStopRequest(nsresult const&, mozilla::net::ResourceTimingStruct const&) ]

Debug
[@ SkImageInfo::validate() ]

Operating system: Mac OS X
                  10.9.5 13F1077
CPU: amd64
     family 6 model 42 stepping 7
     4 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0xffffffffbbadbeef
Process uptime: 22 seconds

Thread 45 (crashed)
 0  XUL!SkImageInfo::validate() const [SkBitmap.cpp : 1401 + 0xf]
    rax = 0x00000000bbadbeef   rdx = 0x49003ab2af83cba7
    rcx = 0x000000012994a1b0   rbx = 0x000000012994b000
    rsi = 0x49003ab2af83cba7   rdi = 0x0000390000003a03
    rbp = 0x000000012994a200   rsp = 0x000000012994a1f0
     r8 = 0x0000000000000040    r9 = 0x0000000129949f00
    r10 = 0x000000000000007d   r11 = 0x0000000000000206
    r12 = 0x0000000000005d0f   r13 = 0x0000000000000000
    r14 = 0x00000001288bdfe0   r15 = 0x000000010136c320
    rip = 0x0000000106acddbc

s-s due to badbeef

Comment 1

[Bob Clary [:bc] (inactive)]

Attachment: Debug Crash report OSX 10.6 [@ SkDashPathEffect::SkDashPathEffect(float const*, int, float)

Related but OSX 10.6 only?

1. http://meteopost.com/weather/kiev/
2. Debug Nightly/41 Crash 

I can't do much here since Nightly doesn't display on my OSX 10.6 machines though it appears to load content.

Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0xffffffffbbadbeef
Process uptime: 17 seconds

Thread 39 (crashed)
 0  XUL!SkDashPathEffect::SkDashPathEffect(float const*, int, float) [SkDashPathEffect.cpp : 25 + 0xf]
    rax = 0x00000000bbadbeef   rdx = 0xd224e320dfc560c2
    rcx = 0x0000000141dab2d0   rbx = 0x0000000141dac000
    rsi = 0xd224e320dfc560c2   rdi = 0x00007fff708dda60
    rbp = 0x0000000141dab350   rsp = 0x0000000141dab310
     r8 = 0x00007fff708dda60    r9 = 0x0000000000000000
    r10 = 0x0000000000000079   r11 = 0x0000000000000206
    r12 = 0x0000000000000000   r13 = 0x000000000000a407
    r14 = 0x0000000101b6c320   r15 = 0x0000000122702660
    rip = 0x00000001075ceb70
Found by: given as instruction pointer in context

Comment 2

[Andrew McCreight [:mccr8]]

Milan, is there somebody who can look at this?  Thanks.

Comment 3

[Milan Sreckovic [:milan] (needinfo for best results)]

[Tracking Requested - why for this release]: We default to Skia canvas as of 40.  This crash is there with Skia canvas only.  We should track this and make sure we fix or roll back the preference change.

Comment 4

[Markus Stange [:mstange]]

In 7508f335-408f-4579-9959-6aa952150517 the crash is happening in a worker thread, and bug 857895 (which made us use worker threads) was backed out for crashes like these. See also bug 1165799 and bug 1165710.

Comment 5

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

This is a sec-high and reproducible bug so adding a tracking flag for FF40 and FF41.

Comment 6

[Milan Sreckovic [:milan] (needinfo for best results)]

Comment 4 is suggesting this is "fixed" with the backout of bug 857895.  Bob, can you still reproduce?  I can't on 10.9.5.

Comment 7

[Bob Clary [:bc] (inactive)]

I can't reproduce in automation on osx/rhel/windows. -> fixed by backout.

Comment 8

[:dmajor]

Is fx40 really affected? I don't think 857895 ever landed there.

Comment 9

[Bob Clary [:bc] (inactive)]

fwiw, I don't recall seeing this on anything but 41 and tested 39,40 and 41 when I checked this.

Comment 10

[Matt Wobensmith [:mwobensmith][:matt:]]

Confirmed crash on Fx41 debug, 2015-05-16. 
Verified fixed on Fx41 debug, 2015-05-28.