crash in mozilla::layers::RotatedBuffer::DrawBufferQuadrant

RESOLVED FIXED

Status

()

--
critical
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: alex_mayorga, Assigned: milan)

Tracking

({crash})

44 Branch
x86
Windows 7
crash
Points:
---

Firefox Tracking Flags

(firefox45 affected, firefox46 affected, firefox47 affected, firefox48 affected)

Details

(Whiteboard: [gfx-noted], crash signature)

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

3 years ago
This bug was filed from the Socorro interface and is 
report bp-60244d11-07c4-4cfd-b546-115092160407.
=============================================================

¡Hola!

569 crashes (12 startup) in the past month at https://crash-stats.mozilla.com/report/list?product=Firefox&range_unit=days&range_value=28&signature=mozilla%3A%3Alayers%3A%3ARotatedBuffer%3A%3ADrawBufferQuadrant#tab-sigsummary
(Reporter)

Updated

3 years ago
status-firefox45: --- → affected
status-firefox46: --- → affected
status-firefox47: --- → affected
status-firefox48: --- → affected
All of the ones I've seen call DrawTargetCairo::Snapshot with invalid DrawTarget, returning null , having RotatedBuffer::DrawBufferQuadrant (which got the snapshot through RotatedContentBuffer::GetSourceSurface call) use that snapshot without checking.

This perhaps starts with Factory::CreateDrawTargetForData getting called with DIRECT2D1_1 as the BackendType, which is not something we do.

Could be an OOM of some type, or a device reset.
Whiteboard: [gfx-noted]
Created attachment 8739130 [details] [diff] [review]
Not necessariy a patch that deals with this issue, but we need to worry about the validity, not just the existence, of a draw target.
Attachment #8739130 - Flags: feedback?(bas)
Comment on attachment 8739130 [details] [diff] [review]
Not necessariy a patch that deals with this issue, but we need to worry about the validity, not just the existence, of a draw target.

Review of attachment 8739130 [details] [diff] [review]:
-----------------------------------------------------------------

I'm not sure how much this adds, but it can't hurt.
Attachment #8739130 - Flags: feedback?(bas) → feedback+
Created attachment 8741017 [details] [diff] [review]
Not necessariy a patch that deals with this issue, but we need to worry about the validity, not just the existence, of a draw target.  Carry r=bas
Attachment #8739130 - Attachment is obsolete: true
Attachment #8741017 - Flags: review+
Keywords: checkin-needed
(In reply to Carsten Book [:Tomcat] from comment #8)
> https://hg.mozilla.org/mozilla-central/rev/7ed46b45eef8

No crashes of this type since just before this patch landed (20160413030239 is the last one so far.)

I did find a (single, linux) crash that has error reports added in the above patch: https://crash-stats.mozilla.com/report/index/b6e49c8d-677d-4b22-99e0-8074f2160417.  I doubt this is new, it just would have crashed elsewhere before.

Lets wait for more days and data, and see if we get any crashes with the extra info once we go to dev edition with 48.
Flags: needinfo?(milan)
I don't see any of these crashes in 48 or 49.  Not enough volume to uplift to 47 beta, looks like we're getting two or so crashes per day, so maybe just call this fixed and let it ride 48.
Assignee: nobody → milan
Status: NEW → RESOLVED
Last Resolved: 3 years ago
Flags: needinfo?(milan)
Keywords: leave-open
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.