Closed Bug 1232231 Opened 4 years ago Closed 4 years ago

crashes in mozilla::layers::TextureWrapperImage::GetAsSourceSurface starting in 2015-12-11 nightly

Categories

(Core :: Graphics: Layers, defect, critical)

45 Branch
x86
Windows NT
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla46
Tracking Status
firefox44 --- unaffected
firefox45 + fixed
firefox46 --- fixed

People

(Reporter: dbaron, Assigned: milan)

References

Details

(Keywords: crash, regression, topcrash, Whiteboard: gfx-noted)

Crash Data

Attachments

(1 file)

[Tracking Requested - why for this release]: Topcrash on nightly

This bug was filed from the Socorro interface and is 
report bp-0e076583-af31-4372-b5a9-fa4a42151212.
=============================================================

These crashes started in the 2015-12-11 nightly and are the #3 topcrash or so on nightly builds

A search is available at:
https://crash-stats.mozilla.com/signature/?product=Firefox&date=%3E2015-10-01&release_channel=nightly&signature=mozilla%3A%3Alayers%3A%3ATextureWrapperImage%3A%3AGetAsSourceSurface#aggregations

The regression range between that nightly and the previous is:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b40ba117fa75&tochange=754b4805a65c

(Note that bug 1232229 is a hopefully-unrelated topcrash that also first appeared in that nightly.)
Bas, could bug 1072501 be causing this?
Flags: needinfo?(bas)
Whiteboard: gfx-noted
Not surprisingly, this is showing up on aurora now that 45 has merged to aurora.  (And it started happening on aurora at the expected time... at least roughly.  release-drivers traffic says aurora updates from aurora 44 to aurora 45 were requested to be enabled on December 18, although the crashes starting showing up in the usual numbers for the December 17 build, which suggests that maybe aurora updates were enabled before requested.  And there were a small number of crashes prior to the enabling of updates, which makes sense, since a few users would have downloaded those builds.)
Somebody should investigate this.  It seems likely to be related to bug 1232229.
Flags: needinfo?(milan)
Bug 1176024 did not make this any better - I see crashes in nightly with the build after that bug was fixed.
Flags: needinfo?(milan)
Attachment #8703708 - Flags: review?(nical.bugzilla)
Now, the above just has us dealing with the BorrowDrawTarget returning nullptr, which it is "allowed to do".  As far as this starting to show up in the range described in comment 0 - without any information to support it, it could be an old bug uncovered bug 1229961, or even bug 1229987, bug 1230056...
(In reply to Milan Sreckovic [:milan] from comment #4)
> Bug 1176024 did not make this any better - I see crashes in nightly with the
> build after that bug was fixed.

Bug 1176024 makes us never fail BorrowDrawTarget if Lock was called successfully with read+write access. In this crash we are requesting a read-only lock so we don't try to prepare the DrawTarget during Lock.

From a look at some code I think we have a D3D11 texture. On the main thread, it can fail to provide the DrawTarget if Factory::CreateDrawTargetForD3D11Texture fails or if mTexture is null (the latter is only possible if the texture has been "force-destroyed" before its refcount goes to zero which can only happen at shutdown if the texture outlives gfx'shutdown and it'd be kinda bad).
Attachment #8703708 - Flags: review?(nical.bugzilla) → review+
(In reply to Nicolas Silva [:nical] from comment #6)
> ... (the latter is only possible if the texture has been "force-destroyed" before its
> refcount goes to zero which can only happen at shutdown if the texture
> outlives gfx'shutdown and it'd be kinda bad).

The crash above doesn't seem to be during shutdown (based on the absence of the note in the crash report), so probably not this scenario.
Top crash, tracking.
Milan, don't hesitate to fill the uplift request to aurora! Thanks
https://hg.mozilla.org/mozilla-central/rev/143ea6152229
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla46
I'll give it a few days on central to see what it does.
Flags: needinfo?(bas)
Comment on attachment 8703708 [details] [diff] [review]
BorrowDrawTarget can return nullptr - be ready for it. r=nical

Approval Request Comment
Topcrash, and I don't see any crashes on nightly since this landed.  Null pointer check, safe change.
Flags: needinfo?(milan)
Attachment #8703708 - Flags: approval-mozilla-aurora?
Comment on attachment 8703708 [details] [diff] [review]
BorrowDrawTarget can return nullptr - be ready for it. r=nical

Top crash, taking it in 45.
Attachment #8703708 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Version: unspecified → 45 Branch
You need to log in before you can comment on or make changes to this bug.