1195098 - crash in CreateBlurMask

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-2051eca1-1c7e-4a53-a6c5-72cf52150816.
=============================================================

Crashing Thread
Frame 	Module 	Signature 	Source
0 	xul.dll 	CreateBlurMask 	gfx/thebes/gfxBlur.cpp
1 	xul.dll 	GetBlur(mozilla::gfx::DrawTarget&, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::RectCornerRadii*, gfxRGBA const&, mozilla::gfx::IntMarginTyped<mozilla::gfx::UnknownUnits>&, mozilla::gfx::IntMarginTyped<mozilla::gfx::UnknownUnits>&) 	gfx/thebes/gfxBlur.cpp
2 	xul.dll 	gfxAlphaBoxBlur::BlurRectangle(gfxContext*, gfxRect const&, mozilla::gfx::RectCornerRadii*, gfxPoint const&, gfxRGBA const&, gfxRect const&, gfxRect const&) 	gfx/thebes/gfxBlur.cpp
3 	xul.dll 	nsContextBoxBlur::BlurRectangle(gfxContext*, nsRect const&, int, mozilla::gfx::RectCornerRadii*, int, gfxRGBA const&, nsRect const&, gfxRect const&) 	layout/base/nsCSSRendering.cpp
4 	xul.dll 	nsCSSRendering::PaintBoxShadowOuter(nsPresContext*, nsRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, float) 	layout/base/nsCSSRendering.cpp

this graphics related crash signature seems to have been introduced with firefox 41, and is taking place across multiple windows versions (about half of the time under windows 10). it's not exclusive to any particular graphics card vendor...

https://crash-stats.mozilla.com/search/?signature=~CreateBlurMask&_facets=signature&_facets=app_notes&_facets=uptime&_facets=adapter_vendor_id&_facets=version&_facets=platform_version&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-version

Comment 1

[[:philipp]]

presumably regressed by bug 1155828

Comment 2

[Jeff Muizelaar [:jrmuizel]]

Mason can you add some instrumentation to figure out what's crashing and why?

Comment 3

[Mason Chang [Inactive] [:mchang]]

Attachment: Null check blurred surface

From the crash report in comment 0, looks like [1] can sometimes return null. The previous code in Gecko 40 null checks this. This patch adds the null check.

[1] https://dxr.mozilla.org/mozilla-central/source/gfx/thebes/gfxBlur.cpp?case=true&from=gfxBlur.cpp#418

Comment 4

[Mason Chang [Inactive] [:mchang]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=5583c77df7ea

Comment 5

[Mason Chang [Inactive] [:mchang]]

url:        https://hg.mozilla.org/integration/mozilla-inbound/rev/e09694f1df5853bd3b0a4d460dead8306023e6cd
changeset:  e09694f1df5853bd3b0a4d460dead8306023e6cd
user:       Mason Chang <[e-mail]>
date:       Tue Aug 18 20:43:24 2015 -0700
description:
Bug 1195098. Null check for blurred source surface. r=mstange

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/e09694f1df58

Comment 7

[Mason Chang [Inactive] [:mchang]]

Comment on attachment 8649437 [details] [diff] [review]
Null check blurred surface

Approval Request Comment
[Feature/regressing bug #]: Bug 1155828, speed up box shadow rendering.
[User impact if declined]: The user can crash when visiting a website with box-shadows.
[Describe test coverage new/current, TreeHerder]: Treeherder reftests
[Risks and why]:  Low, this is a null check that was deleted and this patch puts it back in.
[String/UUID change made/needed]: None

Comment 8

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8649437 [details] [diff] [review]
Null check blurred surface

Simple patch, Aurora+ and Beta+

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/9a2f4afc22b3

Comment 10

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/releases/mozilla-beta/rev/3449402da79d