1245870 - crash in mozilla::detail::RefCounted<T>::Release while PopClip in D2D

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Liz Henry (:lizzard)]

This bug was filed from the Socorro interface and is 
report bp-bcddf6f7-ff8b-4aed-90b4-807ee2160204.
=============================================================

#1 topcrash for aurora 46. Comments and urls reflect problems with gradle.org. 

Crashing thread: 

1 	xul.dll 	RefPtr<mozilla::gfx::PathRecording>::~RefPtr<mozilla::gfx::PathRecording>() 	mfbt/RefPtr.h
2 	xul.dll 	mozilla::gfx::DrawTargetD2D1::PopClip() 	gfx/2d/DrawTargetD2D1.cpp
3 	xul.dll 	mozilla::gfx::DrawTargetDual::PopClip() 	gfx/2d/DrawTargetDual.h
4 	xul.dll 	gfxContext::~gfxContext() 	gfx/thebes/gfxContext.cpp
5 	xul.dll 	RefPtr<gfxContext>::assign_with_AddRef(gfxContext*) 	mfbt/RefPtr.h
6 	xul.dll 	mozilla::layers::ClientPaintedLayer::PaintThebes() 	gfx/layers/client/ClientPaintedLayer.cpp
7 	xul.dll 	mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback(mozilla::layers::ReadbackProcessor*) 	gfx/layers/client/ClientPaintedLayer.cpp
8 	xul.dll 	mozilla::layers::ClientContainerLayer::RenderLayer() 	gfx/layers/client/ClientContainerLayer.h
9 	xul.dll 	mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/client/ClientLayerManager.cpp
10 	xul.dll 	mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/client/ClientLayerManager.cpp

Comment 1

[Liz Henry (:lizzard)]

The crash signature seems to be spiking for 47, while it exists in very low volume for earlier versions.

Comment 2

[Jeff Muizelaar [:jrmuizel]]

Bas, I expect you caused this one.

Comment 3

[Bas Schouten (:bas.schouten)]

Hrm, the page seems to load just fine for me, seeing if I can reproduce this somehow. I'm not sure how PathRecording got involved here.. that should only be used for printing.

Comment 4

[Bas Schouten (:bas.schouten)]

Ugh, that's just a red herring, optimized merging RefPtr destructors, never mind that bit.

Comment 5

[Bas Schouten (:bas.schouten)]

Attachment: MozReview Request: Bug 1245870: When concluding there is nothing to draw inside the clip be sure to balance the Save() since it won't be balanced in PopGroupForlayer. r=jrmuizel

Review commit: https://reviewboard.mozilla.org/r/33701/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/33701/

Comment 6

[Jeff Muizelaar [:jrmuizel]]

Comment on attachment 8716045 [details]
MozReview Request: Bug 1245870: When concluding there is nothing to draw inside the clip be sure to balance the Save() since it won't be balanced in PopGroupForlayer. r=jrmuizel

https://reviewboard.mozilla.org/r/33701/#review30395

Comment 7

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/afd7858792c9

Comment 8

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/afd7858792c9

Comment 9

[Bas Schouten (:bas.schouten)]

Comment on attachment 8716045 [details]
MozReview Request: Bug 1245870: When concluding there is nothing to draw inside the clip be sure to balance the Save() since it won't be balanced in PopGroupForlayer. r=jrmuizel

Approval Request Comment
[Feature/regressing bug #]: Native push/poplayer
[User impact if declined]: Crash when layers heuristics go a certain way
[Describe test coverage new/current, TreeHerder]: Several days nightly coverage
[Risks and why]: Low, causes balance in previously unbalanced save/restore
[String/UUID change made/needed]: None

Comment 10

[Liz Henry (:lizzard)]

Comment on attachment 8716045 [details]
MozReview Request: Bug 1245870: When concluding there is nothing to draw inside the clip be sure to balance the Save() since it won't be balanced in PopGroupForlayer. r=jrmuizel

Fix for top crash, please uplift to aurora

Comment 11

[Bas Schouten (:bas.schouten)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/6a9b6a1e2454

Comment 12

[Carsten Book [:Tomcat]]

(In reply to Bas Schouten (:bas.schouten) from comment #11)
> https://hg.mozilla.org/releases/mozilla-aurora/rev/6a9b6a1e2454

setting flags