1395394 - Crash in mozilla::gfx::gfxGradientCache::GetGradientStops

Status: RESOLVED FIXED

(Core :: Web Painting, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-34118bd6-00a1-4176-b2b5-130130170825.
=============================================================

Seen while looking at crash stats: http://bit.ly/2gqcF1e. Looks as if first crash occurred in 20170817100132 build. So far 12 crashes/9 installs

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6ebc251bd288c268b020815025b05854ccde5c08&tochange=932388b8c22c9775264e543697ce918415db9e23

Comment 1

[Toshihiro Yamada]

It is my report.
Though I need to make sure, my prediction is that probably omtp is related to the crash...
(In a time frame　I reported crashes(1/3 of all recent reports!), omtp is enabled)

Comment 2

[Toshihiro Yamada]

OK, I tested without omtp for a while, and I can't reproduce this crash at all.
So, apparently, this crash is triggered by omtp.

Comment 3

[Jim Mathies [:jimm]]

Is omtp shipping in 57?

Comment 4

[Toshihiro Yamada]

No, I enabled it through about:config.

Comment 5

[Jim Mathies [:jimm]]

According to Bas/milan on #gfx, omtp won't ship in 57. Updating.

Comment 6

[Kacper Michajłow [:kasper93]]

Now that OMTP is enabled by default on Windows (https://hg.mozilla.org/mozilla-central/rev/843b90c48664). I think you might want to fix this crash. It crashes frequently (not always tho) here, for example on this site https://naekranie.pl/.

Comment 7

[Calixte Denizet (:calixte)]

There are 241 crashes in nightly 58 starting with buildid 20170929220356. Before this build, this crash was quite rare.
The signature is now ranked #8 for nightly top-crashers for content process.
:bas, could you investigate please ?

Comment 8

[David Anderson [:dvander] - inactive, e-mail if emergency]

Bas, two thoughts: First, we skip this code when recording. It looks like it should be supported by capturing though. Second, GradientStops is not threadsafe-refcounted, so maybe there is a race between the cache and paint thread.

[1] http://searchfox.org/mozilla-central/rev/c296ed9811319cdd61ac35e9e648f95639cda726/gfx/thebes/gfxGradientCache.cpp#205
[2] http://searchfox.org/mozilla-central/rev/c296ed9811319cdd61ac35e9e648f95639cda726/gfx/2d/2D.h#213

Comment 9

[Bas Schouten (:bas.schouten)]

Attachment: Bug 1395394: Make refcounting of GradientStops threadsafe for the sake of OMTP.

Review commit: https://reviewboard.mozilla.org/r/185452/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/185452/

Comment 10

[Matt Woodrow (:mattwoodrow)]

Comment on attachment 8914128 [details]
Bug 1395394: Make refcounting of GradientStops threadsafe for the sake of OMTP.

https://reviewboard.mozilla.org/r/185452/#review190342

Comment 11

[Nicholas Nethercote [inactive]]

This is the #2 Windows topcrash in Nightly 20170929220356.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/7667e2b40236
Make refcounting of GradientStops threadsafe for the sake of OMTP. r=mattwoodrow

Comment 13

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/7667e2b40236