1311972 - Crash in `anonymous namespace''::Sk4px::MapDstAlpha<T>

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect, P3)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-a8d2ec60-059b-4228-87bc-ed3522161021.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	`anonymous namespace'::Sk4px::MapDstAlpha<<lambda_1a77d14336ecdf7cc51d51c060222cfd> > 	gfx/skia/skia/src/core/Sk4px.h:168
1 	xul.dll 	sk_default::blit_mask_d32_a8_opaque 	gfx/skia/skia/src/opts/SkBlitMask_opts.h:166
2 	xul.dll 	sk_default::blit_mask_d32_a8 	gfx/skia/skia/src/opts/SkBlitMask_opts.h:198
3 	xul.dll 	SkBlitMask::BlitColor(SkPixmap const&, SkMask const&, SkIRect const&, unsigned int) 	gfx/skia/skia/src/core/SkBlitMask_D32.cpp:59
4 	xul.dll 	SkARGB32_Opaque_Blitter::blitMask(SkMask const&, SkIRect const&) 	gfx/skia/skia/src/core/SkBlitter_ARGB32.cpp:188
5 	xul.dll 	DrawOneGlyph::blitMask(SkMask const&, SkIRect const&) 	gfx/skia/skia/src/core/SkDraw.cpp:1548
6 	xul.dll 	SkTHashTable<SkGlyph, unsigned int, SkGlyph::HashTraits>::find(unsigned int const&) 	gfx/skia/skia/include/private/SkTHash.h:62
7 	xul.dll 	SkGlyphCache::getGlyphIDMetrics(unsigned short, int, int) 	gfx/skia/skia/src/core/SkGlyphCache.cpp:146
8 	xul.dll 	SkFindAndPlaceGlyph::GlyphFindAndPlaceSubpixel<DrawOneGlyph&, 0, 1>::findAndPositionGlyph(char const**, SkPoint, DrawOneGlyph&) 	gfx/skia/skia/src/core/SkFindAndPlaceGlyph.h:465
9 	xul.dll 	SkFindAndPlaceGlyph::ProcessPosText<DrawOneGlyph&>(SkPaint::TextEncoding, char const* const, unsigned int, SkPoint, SkMatrix const&, float const* const, int, SkPaint::Align, SkGlyphCache*, DrawOneGlyph&) 	gfx/skia/skia/src/core/SkFindAndPlaceGlyph.h:685
10 	xul.dll 	SkDraw::drawPosText(char const* const, unsigned int, float const* const, int, SkPoint const&, SkPaint const&) 	gfx/skia/skia/src/core/SkDraw.cpp:1673
11 	xul.dll 	SkBitmapDevice::drawPosText(SkDraw const&, void const*, unsigned int, float const* const, int, SkPoint const&, SkPaint const&) 	gfx/skia/skia/src/core/SkBitmapDevice.cpp:345
12 	xul.dll 	SkCanvas::onDrawPosText(void const*, unsigned int, SkPoint const* const, SkPaint const&) 	gfx/skia/skia/src/core/SkCanvas.cpp:2574
13 	xul.dll 	SkCanvas::drawPosText(void const*, unsigned int, SkPoint const* const, SkPaint const&) 	gfx/skia/skia/src/core/SkCanvas.cpp:2649
14 	xul.dll 	mozilla::gfx::DrawTargetSkia::FillGlyphs(mozilla::gfx::ScaledFont*, mozilla::gfx::GlyphBuffer const&, mozilla::gfx::Pattern const&, mozilla::gfx::DrawOptions const&, mozilla::gfx::GlyphRenderingOptions const*) 	gfx/2d/DrawTargetSkia.cpp:1089
15 	xul.dll 	GlyphBufferAzure::Flush(bool) 	gfx/thebes/gfxFont.cpp:1676
16 	xul.dll 	gfxFont::DrawGlyphs(gfxShapedText*, unsigned int, unsigned int, gfxPoint*, TextRunDrawParams const&, FontDrawParams const&) 	gfx/thebes/gfxFont.cpp:1922

this crash is regressing in numbers starting in firefox 49 on all windows versions, 70% of the crashes are on xp. 
this is ~0.27% of all browser crashes on 49.0.1

Comment 1

[Lee Salzman [:lsalzman]]

Unfortunately based on the comments and backtrace it is hard to identify why it is triggering a read violation here. It is possible that in the Skia update that will land as part of bug 1299435, and changes to glyph rendering thereof, that this crash could be resolved.

Ideally we would need STR or a testcase to verify what is really going on here.

Comment 2

[Marcia Knous [:marcia]]

One URL mentioned in comments that crashes consistently for a user is the first one, I added a few more:

http://www.msuspartans.com/sports/m-footbl/msu-m-footbl-body.html
http://www.spanishdict.com/conjugate/poderse 
http://www.dagbladet.no/video/embed/42zN1ZuSSwM?autoplay=false
http://diply.com/superior/article/worst-film-costume-fails/3

ni on QA to try to reproduce

Comment 3

[Milan Sreckovic [:milan] (needinfo for best results)]

Yes, let's see if we can reproduce it.  The volume is high enough, and we're making Skia the default, so we want to see if we can figure out what's going on.  Even if the new version of Skia fixes it, we have a whole release of it being the default without the fix, so 51 would be the right place for it, where Skia is the default.

Comment 4

[Milan Sreckovic [:milan] (needinfo for best results)]

So, this seems to be canvas, so "making Skia default" isn't really an issue - the canvas was already the default earlier.  This did, however, spike with the previous Skia update (m51), which landed in 49, so it's possible that another update (m55) would take care of it.  Not something we'd want to uplift though.

Comment 5

[Milan Sreckovic [:milan] (needinfo for best results)]

It doesn't seem to be related to optimization:  https://crash-stats.mozilla.com/report/index/3517c91f-3b64-4182-b9a1-d85492161020 is from SSSE3, https://crash-stats.mozilla.com/report/index/d4069a1b-728c-4d0a-9feb-7a29a2161020 is from non-SSSE3 path.

This seems to be text in canvas scenario.

I do understand the spike in 49, I do not understand why there are very few in 50, none in 51, and only one "old build" crash in 52.  I suppose it could be related to the hardware (despite the this-is-not-CPU-type-related claim above) and explained by the differences in population.

Comment 6

[Petruta Horea [:phorea], Desktop Test Engineering]

Unfortunately I couldn't reproduce the crash using 49.0.2, Firefox 50 beta 7 and latest Nightly 52.0a1 - Win 10 64-bit and Win XP 32-bit (where the most of the crashes are reported).

Here are the graphics details for my Win XP machine:
 
Graphics
Features
Compositing	Direct3D 9
Asynchronous Pan/Zoom	wheel input enabled; touch input enabled
WebGL Renderer	Google Inc. -- ANGLE (Intel(R) HD Graphics Direct3D9 vs_3_0 ps_3_0)
WebGL2 Renderer	WebGL creation failed: * Error during ANGLE OpenGL init. * Error during ANGLE OpenGL init. * Error during ANGLE OpenGL init. * Error during ANGLE OpenGL init. * Error during ANGLE OpenGL init. * Exhausted GL driver caps.
Hardware H264 Decoding	No; Failed to create H264 decoder
Audio Backend	winmm
DirectWrite	false (0.0.0.0)
GPU #1
Active	Yes
Description	Intel(R) HD Graphics
Vendor ID	0x8086
Device ID	0x0152
Driver Version	6.14.10.5437
Driver Date	2-4-2013
Drivers	igxprd32
Subsys ID	00000000
RAM	Unknown

Please let me know if I can help any further with the investigation for this crash.

Comment 7

[Milan Sreckovic [:milan] (needinfo for best results)]

Mason, anything jumps out at you without the reproducible case?  Feels like it's specific to what's in the canvas, based on the variety of uptimes, but that's just a guess.

Comment 8

[Mason Chang [Inactive] [:mchang]]

(In reply to Milan Sreckovic [:milan] from comment #7)
> Mason, anything jumps out at you without the reproducible case?  Feels like
> it's specific to what's in the canvas, based on the variety of uptimes, but
> that's just a guess.

I've been unable to reproduce it on Windows 7 or 10. I don't think it's related to canvas though. Looking at a bunch of crash stats, it looks like it's happening outside of canvas. With the test cases, I'm not seeing any canvas in the page source as well. From the crash reports, it's also independent of SSE 3 optimizations as well. Without a test case, it's hard to say what's going on :(.

Comment 9

[Liz Henry (:lizzard) (relman/hg->git project)]

Too late for a fix for 53, as we are in the last week of the 53 beta cycle.

Comment 10

[Pablo]

It seems this crash no longer occurs since I cant find any reports on it , I will close it as WFM and then if it starts to reoccur we can reopen the issue