Crash in ssse3_fetch_bilinear_cover

RESOLVED FIXED in Firefox 49

Status

()

Core
Graphics
--
critical
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: marcia, Assigned: jrmuizel)

Tracking

({crash, regression})

49 Branch
mozilla51
x86
Windows 7
crash, regression
Points:
---

Firefox Tracking Flags

(firefox49+ fixed, firefox50+ fixed, firefox51 fixed)

Details

(crash signature)

Attachments

(1 attachment)

This bug was filed from the Socorro interface and is 
report bp-9029f4cc-3301-4663-bd95-48bcd2160805.
=============================================================

Seen while looking at beta crash stats: https://crash-stats.mozilla.com/signature/?product=Firefox&_sort=-date&signature=ssse3_fetch_bilinear_cover. Crash seems to be unique to beta.

ni on jeff since it appears he may have worked in this area of code.
Flags: needinfo?(jmuizelaar)
[Tracking Requested - why for this release]: This is a crash regression during video playback that we should be able to avoid.
Assignee: nobody → jmuizelaar
tracking-firefox49: --- → ?
Flags: needinfo?(jmuizelaar)

Updated

2 years ago
status-firefox50: --- → affected
status-firefox51: --- → ?
Keywords: regression
Version: 48 Branch → 49 Branch
204 crashes in the last week with beta 3. Nothing showing up for beta 4 yet. There's also one crash on 50 aurora.
tracking-firefox49: ? → +
tracking-firefox50: --- → +
It looks like most of these have 'Unknown cairo format -1'.
Created attachment 8783094 [details] [diff] [review]
Check the error status of a surface before returning the data inside it
Attachment #8783094 - Flags: review?(mstange)
Attachment #8783094 - Flags: review?(mstange) → review+

Comment 5

2 years ago
Pushed by jmuizelaar@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1ba19d1f07da
Make sure our surface is good before locking it. r=mstange
Backed out for failing to create surface in non-e10s reftests on Windows 7 VM:

https://hg.mozilla.org/integration/mozilla-inbound/rev/9b00171aff65acb0e55d0ca3486a7331e541a9a4

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=1ba19d1f07da2075f6a3ec1e51bf1dd5a8296a54
Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=34309936&repo=mozilla-inbound

17:51:43     INFO - REFTEST TEST-START | file:///c:/slave/test/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/writing-modes-3/text-combine-upright-compression-006a.html == file:///c:/slave/test/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/writing-modes-3/text-combine-upright-compression-006-ref.html
17:51:43     INFO - REFTEST TEST-LOAD | file:///c:/slave/test/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/writing-modes-3/text-combine-upright-compression-006a.html | 1774 / 13765 (12%)
17:51:43     INFO - ++DOMWINDOW == 43 (18B9F400) [pid = 3420] [serial = 7471] [outer = 0DC49400]
17:51:44     INFO - [GFX3-]: DrawTargetSkia(0C66F940): Failure to create source surface from data. Size: Size(800,1000)
17:51:44     INFO - JavaScript error: chrome://reftest/content/reftest.jsm, line 1463: NS_ERROR_FAILURE:
17:51:44     INFO - JavaScript error: chrome://reftest/content/reftest-content.js, line 1090: TypeError: ret is undefined
[...]
17:56:43     INFO - REFTEST TEST-UNEXPECTED-FAIL | file:///c:/slave/test/build/tests/reftest/tests/layout/reftests/w3c-css/submitted/writing-modes-3/text-combine-upright-compression-006a.html | load failed: timed out waiting for test to complete (waiting for onload scripts to complete)
Flags: needinfo?(jmuizelaar)

Comment 7

2 years ago
Pushed by archaeopteryx@coole-files.de:
https://hg.mozilla.org/integration/mozilla-inbound/rev/7249543cf71a
Make sure our surface is good before locking it. r=mstange

Comment 9

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/7249543cf71a
Status: NEW → RESOLVED
Last Resolved: 2 years ago
status-firefox51: ? → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla51
Comment on attachment 8783094 [details] [diff] [review]
Check the error status of a surface before returning the data inside it

Approval Request Comment
[Feature/regressing bug #]: 1292628
[User impact if declined]: Possible crash in ssse3 code
[Describe test coverage new/current, TreeHerder]: Has been on nightly for a very short time.
[Risks and why]: Very low risk, but may just push the problem further down the line.
Attachment #8783094 - Flags: approval-mozilla-beta?
Attachment #8783094 - Flags: approval-mozilla-aurora?
Comment on attachment 8783094 [details] [diff] [review]
Check the error status of a surface before returning the data inside it

I see a lot of crash instances on Beta49 (none on Aurora or Nightly) but given the one-line change, it's worth uplifting to Aurora50 and Beta49.
Attachment #8783094 - Flags: approval-mozilla-beta?
Attachment #8783094 - Flags: approval-mozilla-beta+
Attachment #8783094 - Flags: approval-mozilla-aurora?
Attachment #8783094 - Flags: approval-mozilla-aurora+

Updated

2 years ago
Keywords: checkin-needed

Comment 12

2 years ago
bugherderuplift
https://hg.mozilla.org/releases/mozilla-aurora/rev/2da9027d1d97
status-firefox50: affected → fixed
Keywords: checkin-needed

Comment 13

2 years ago
bugherderuplift
https://hg.mozilla.org/releases/mozilla-beta/rev/e66d206c851c
status-firefox49: affected → fixed
You need to log in before you can comment on or make changes to this bug.