1202703 - crash in nsDeviceContext::CreateRenderingContext()

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-df2c4e02-b5f9-416e-8643-8192f2150902.
=============================================================
0 	xul.dll 	nsDeviceContext::CreateRenderingContext() 	gfx/src/nsDeviceContext.cpp
1 	xul.dll 	nsSimplePageSequenceFrame::PrePrintNextPage(nsITimerCallback*, bool*) 	layout/generic/nsSimplePageSequenceFrame.cpp
2 	xul.dll 	nsPrintEngine::PrePrintPage() 	layout/printing/nsPrintEngine.cpp
3 	xul.dll 	nsPagePrintTimer::Notify(nsITimer*) 	layout/printing/nsPagePrintTimer.cpp
4 	xul.dll 	nsTimerImpl::Fire() 	xpcom/threads/nsTimerImpl.cpp
5 	xul.dll 	nsTimerEvent::Run() 	xpcom/threads/nsTimerImpl.cpp
6 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
7 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
8 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
9 	xul.dll 	nsThreadManager::GetCurrentThread(nsIThread**) 	xpcom/threads/nsThreadManager.cpp
10 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
11 	xul.dll 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp
12 	xul.dll 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
13 	xul.dll 	XREMain::XRE_main(int, char** const, nsXREAppData const*) 	toolkit/xre/nsAppRunner.cpp
14 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp
15 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp
16 	firefox.exe 	NS_internal_main(int, char**) 	browser/app/nsBrowserApp.cpp

this crash started taking off in firefox 40 & is present in all subsequent releases. all user comments seem to mention they were printing something when the bug occurred.

maybe it's related to http://hg.mozilla.org/releases/mozilla-release/rev/27dc4c0f6660 and bug 1019063?

Comment 1

[(Away)]

   416     if (!dt) {
   417         gfxCriticalError() << "Failed to create draw target in device context sized " << mWidth << "x" << mHeight << " and pointers " << hexa(mPrintingSurface) << " and " << hexa(printingSurface);
   418         MOZ_CRASH("Cannot CreateDrawTargetForSurface");
   419     }

Reports tend to have very large sizes:

[0][GFX1-]: Attempt to create DrawTarget for invalid surface. Size(47520,59731) Cairo Status: 1|[1][GFX1]: Failed to create draw target in device context sized 47520x59731 and pointers 0x00686E80 and 0x00686E80

[0][GFX1-]: Attempt to create DrawTarget for invalid surface. Size(48960,63360) Cairo Status: 1|[1][GFX1]: Failed to create draw target in device context sized 48960x63360 and pointers 0x0A7F2FD0 and 0x0A7F2FD0

[0][GFX1-]: Attempt to create DrawTarget for invalid surface. Size(47309,61517) Cairo Status: 1|[1][GFX1]: Failed to create draw target in device context sized 47309x61517 and pointers 0x1DBDECD0 and 0x1DBDECD0

Comment 2

[(Away)]

Is MOZ_CRASH the right thing to do here? Can we "just" abort the print operation?

Comment 3

[Milan Sreckovic [:milan] (needinfo for best results)]

MOZ_CRASH was just replacing the null pointer access crash from bug 1019063, so not really a regression - they would have shown up as that different signature.  A few steps up the stack we keep assuming this couldn't have failed, though it clearly can.  I'll take a look; chances are it will be work similar to bug 1019063 - just propagate the expectation of failure up the stack until we can return the "printing failed" code (he said naively.)

Comment 4

[Milan Sreckovic [:milan] (needinfo for best results)]

Attachment: Part 1. CreateRenderingContext can in fact fail. r=mattwoodrow

Comment 5

[Milan Sreckovic [:milan] (needinfo for best results)]

Comment on attachment 8659433 [details] [diff] [review]
Part 1. CreateRenderingContext can in fact fail. r=mattwoodrow

Let's land Part 1, it should stop the crash - we can leave the bug open, I'd like to add a bit more cleanup.

Comment 6

[Milan Sreckovic [:milan] (needinfo for best results)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=0163b4053e34, though Mac only.

Comment 7

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0dc9f022bede

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/0dc9f022bede