1415325 - Crash in SkRefCntBase::unref in 57b13 on AMD (only)

Status: RESOLVED INCOMPLETE

(Core :: Graphics, defect, P3)

Description

[Randell Jesup [:jesup] (needinfo me)]

[Tracking Requested - why for this release]:
Late regression in 57 beta 13 - perhaps a compiler bug

+++ This bug was initially created as a clone of Bug #1413857 +++

This is limited to the AMD-specific regression that started in 57b13, with low-ish wildptr addresses (similar to 0x22bc7b -- perhaps  32-bit address with the top byte cleared??)

Definitely tied to AMD, and definitely started at 57b13.  There are pre-existing (rare) wildptr crashes, and also 58a1 UAF crashes which are separate from this.  There have been no crashes like this in 58 in the last month, though perhaps bug 1413857 made them go away.

Also: I see no crashes in 57b14 (yet?) so maybe something went away?  However, this makes me wonder if the compiler tripped over something in 57b13; looking at the code generated for this in b13 vs b14 vs b12 might be interesting (code, where in the page it is, etc).

Comment 1

[(Away)]

https://crash-stats.mozilla.com/search/?signature=%3DSkRefCntBase%3A%3Aunref&version=57.0b13&product=Firefox&date=%3E%3D2017-08-07T18%3A33%3A46.000Z&date=%3C2017-11-07T17%3A33%3A46.000Z&_sort=-date&_facets=signature&_facets=cpu_info&_facets=reason&_facets=release_channel&_facets=version&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-cpu_info

Yes, that is a classic sign of the AMD CPU bug.

Comment 2

[Milan Sreckovic [:milan] (needinfo for best results)]

I don't see us dealing with the AMD CPU bug as 57 uplifts.

Comment 3

[Bas Schouten (:bas.schouten)]

The AMD/57 portion of this crash is in no way related to OMTP.

Comment 4

[Daniel Veditz [:dveditz]]

Can we close this bug INCOMPLETE or WORKSFORME? the specific slice of crashes you're describing seem to have gone away.

Comment 5

[Randell Jesup [:jesup] (needinfo me)]

probably dup to the AMD bug

Comment 6

[Frederik Braun [:freddy]]

(In reply to Daniel Veditz [:dveditz] from comment #4)
> Can we close this bug INCOMPLETE or WORKSFORME? the specific slice of
> crashes you're describing seem to have gone away.

(In reply to Randell Jesup [:jesup] from comment #5)
> probably dup to the AMD bug


Sounds like a "yes".