1315212 - [e10s] Crash in mozilla::gfx::DrawTargetRecording::DrawTargetRecording

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-efa7c80f-8936-4cb5-b0b8-d2afc2161104.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::gfx::DrawTargetRecording::DrawTargetRecording(mozilla::gfx::DrawTargetRecording const*, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::SurfaceFormat) 	gfx/2d/DrawTargetRecording.cpp:309
1 	xul.dll 	nsSimplePageSequenceFrame::PrePrintNextPage(nsITimerCallback*, bool*) 	layout/generic/nsSimplePageSequenceFrame.cpp:651

this e10s crash is regressing in volume since firefox 50 builds (single occurrences of the signature already happened before though). so far crashes are recorded on all versions of windows & the signature is accounting for 0.29% of crashes in the content process in 50.0b.

Correlations for Firefox Beta:
(100.0% in signature vs 00.07% overall) address = 0x39
(96.30% in signature vs 00.34% overall) GFX_ERROR "Failed to create similar cairo surface! Size: " = true
(100.0% in signature vs 26.61% overall) dom_ipc_enabled = 1
(100.0% in signature vs 37.00% overall) reason = EXCEPTION_ACCESS_VIOLATION_READ
(16.67% in signature vs 00.91% overall) GFX_ERROR "Failed to create DrawTarget, Type: " = true

Comment 1

[Bob Owen (:bobowen)]

Looks like the CreateSimilarDrawTarget on the underlying DrawTarget fails, so we get a null dereference on mFinalDT.

Comment 2

[Bob Owen (:bobowen)]

Attachment: Allow for failed call to wrapped DrawTarget in DrawTargetRecording::CreateSimilarDrawTarget

MozReview-Commit-ID: 4SMixY4Nook

Comment 3

[Bob Owen (:bobowen)]

[Tracking Requested - why for this release]:
Crash that has been climbing in later betas, I think we should uplift to 51 and possibly 50 if we have time/chance.

Comment 4

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

We reviewed this in platform triage meeting today. This doesn't seem release blocking. 

The crash volume (though relatively higher than start of Beta50 cycle) is low, about ~50 crashes a week. Let's keep it around in case we want to fix in 50.1.0.

Comment 5

[Gerry Chang [:gchang]]

Track 51+ as regression and crash.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/8e124e64cef2
Allow for failed call to wrapped DrawTarget in DrawTargetRecording::CreateSimilarDrawTarget. r=bas

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/8e124e64cef2

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Please request Aurora/Beta approval on this when you get a chance. And Release if you think it's worth trying to get into December's 50.1 release.

Comment 9

[Bob Owen (:bobowen)]

Comment on attachment 8807590 [details] [diff] [review]
Allow for failed call to wrapped DrawTarget in DrawTargetRecording::CreateSimilarDrawTarget

Approval Request Comment
[Feature/regressing bug #]:
Bug 1156742

[User impact if declined]:
Printing will continue to cause content process crash if this situation arises (underlying CreateSimilatDrawTarget fails).

[Describe test coverage new/current, TreeHerder]:
Manual only. Could not reproduce crash to do before and after testing, but confident that this will fix the issue.

[Risks and why]: 
low - fairly simple change that checks that the underlying CreateSimilatDrawTarget was successful before continuing.

[String/UUID change made/needed]:
None

Comment 10

[Gerry Chang [:gchang]]

Comment on attachment 8807590 [details] [diff] [review]
Allow for failed call to wrapped DrawTarget in DrawTargetRecording::CreateSimilarDrawTarget

Fix a crash. Beta51+ and Aurora 52+. Should be in 51 beta 2.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/3bba008880c8

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/1e633e8ababd

Comment 13

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8807590 [details] [diff] [review]
Allow for failed call to wrapped DrawTarget in DrawTargetRecording::CreateSimilarDrawTarget

Patch is low risk, fix has been verified on pre-release, content crash is top ranked #29, let's ship the fix in 50.1.0

Comment 14

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-release/rev/d1a123d97ecf