1232231 - crashes in mozilla::layers::TextureWrapperImage::GetAsSourceSurface starting in 2015-12-11 nightly

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

[Tracking Requested - why for this release]: Topcrash on nightly

This bug was filed from the Socorro interface and is 
report bp-0e076583-af31-4372-b5a9-fa4a42151212.
=============================================================

These crashes started in the 2015-12-11 nightly and are the #3 topcrash or so on nightly builds

A search is available at:
https://crash-stats.mozilla.com/signature/?product=Firefox&date=%3E2015-10-01&release_channel=nightly&signature=mozilla%3A%3Alayers%3A%3ATextureWrapperImage%3A%3AGetAsSourceSurface#aggregations

The regression range between that nightly and the previous is:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b40ba117fa75&tochange=754b4805a65c

(Note that bug 1232229 is a hopefully-unrelated topcrash that also first appeared in that nightly.)

Comment 1

[u279076]

Bas, could bug 1072501 be causing this?

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Not surprisingly, this is showing up on aurora now that 45 has merged to aurora.  (And it started happening on aurora at the expected time... at least roughly.  release-drivers traffic says aurora updates from aurora 44 to aurora 45 were requested to be enabled on December 18, although the crashes starting showing up in the usual numbers for the December 17 build, which suggests that maybe aurora updates were enabled before requested.  And there were a small number of crashes prior to the enabling of updates, which makes sense, since a few users would have downloaded those builds.)

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Somebody should investigate this.  It seems likely to be related to bug 1232229.

Comment 4

[Milan Sreckovic [:milan] (needinfo for best results)]

Attachment: BorrowDrawTarget can return nullptr - be ready for it. r=nical

Bug 1176024 did not make this any better - I see crashes in nightly with the build after that bug was fixed.

Comment 5

[Milan Sreckovic [:milan] (needinfo for best results)]

Now, the above just has us dealing with the BorrowDrawTarget returning nullptr, which it is "allowed to do".  As far as this starting to show up in the range described in comment 0 - without any information to support it, it could be an old bug uncovered bug 1229961, or even bug 1229987, bug 1230056...

Comment 6

[Nicolas Silva [:nical]]

(In reply to Milan Sreckovic [:milan] from comment #4)
> Bug 1176024 did not make this any better - I see crashes in nightly with the
> build after that bug was fixed.

Bug 1176024 makes us never fail BorrowDrawTarget if Lock was called successfully with read+write access. In this crash we are requesting a read-only lock so we don't try to prepare the DrawTarget during Lock.

From a look at some code I think we have a D3D11 texture. On the main thread, it can fail to provide the DrawTarget if Factory::CreateDrawTargetForD3D11Texture fails or if mTexture is null (the latter is only possible if the texture has been "force-destroyed" before its refcount goes to zero which can only happen at shutdown if the texture outlives gfx'shutdown and it'd be kinda bad).

Comment 7

[Milan Sreckovic [:milan] (needinfo for best results)]

(In reply to Nicolas Silva [:nical] from comment #6)
> ... (the latter is only possible if the texture has been "force-destroyed" before its
> refcount goes to zero which can only happen at shutdown if the texture
> outlives gfx'shutdown and it'd be kinda bad).

The crash above doesn't seem to be during shutdown (based on the absence of the note in the crash report), so probably not this scenario.

Comment 8

[Milan Sreckovic [:milan] (needinfo for best results)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=1e326bdfcecb

Comment 9

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e22122a3bf90

Comment 10

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Something from this push broke weightmapping-12579.html on OSX 10.10: https://treeherder.mozilla.org/logviewer.html#?job_id=19315024&repo=mozilla-inbound

Backed out in https://hg.mozilla.org/integration/mozilla-inbound/rev/4340f9aea43f

Comment 11

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/143ea6152229

Comment 12

[Sylvestre Ledru [:Sylvestre]]

Top crash, tracking.
Milan, don't hesitate to fill the uplift request to aurora! Thanks

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/143ea6152229

Comment 14

[Milan Sreckovic [:milan] (needinfo for best results)]

I'll give it a few days on central to see what it does.

Comment 15

[Milan Sreckovic [:milan] (needinfo for best results)]

Comment on attachment 8703708 [details] [diff] [review]
BorrowDrawTarget can return nullptr - be ready for it. r=nical

Approval Request Comment
Topcrash, and I don't see any crashes on nightly since this landed.  Null pointer check, safe change.

Comment 16

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8703708 [details] [diff] [review]
BorrowDrawTarget can return nullptr - be ready for it. r=nical

Top crash, taking it in 45.

Comment 17

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/7355ad1c4528