Closed Bug 1521368 Opened 9 months ago Closed 8 months ago

Crash in mozilla::gfx::DrawTargetD2D1::CreateBrushForPattern

Categories

(Core :: Graphics, defect, P1, critical)

All
Windows
defect

Tracking

()

RESOLVED FIXED
mozilla66
Tracking Status
firefox-esr60 --- unaffected
firefox64 --- unaffected
firefox65 --- unaffected
firefox66 blocking fixed
firefox67 + fixed

People

(Reporter: calixte, Assigned: bas.schouten)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(3 files, 1 obsolete file)

This bug is for crash report bp-c904982f-94a9-41f3-a27c-8da510190120.

Top 10 frames of crashing thread:

0 xul.dll struct already_AddRefed<ID2D1Brush> mozilla::gfx::DrawTargetD2D1::CreateBrushForPattern gfx/2d/DrawTargetD2D1.cpp:2075
1 xul.dll mozilla::gfx::DrawTargetD2D1::Fill gfx/2d/DrawTargetD2D1.cpp:650
2 xul.dll mozilla::gfx::DrawTarget::FillRoundedRect gfx/2d/DrawTarget.cpp:190
3 xul.dll void mozilla::gfx::DrawTargetCaptureImpl::ReplayToDrawTarget gfx/2d/DrawTargetCapture.cpp:313
4 xul.dll void mozilla::layers::PaintThread::AsyncPaintTask gfx/layers/PaintThread.cpp:199
5 xul.dll nsresult mozilla::detail::RunnableFunction<`lambda at z:/build/build/src/gfx/layers/PaintThread.cpp:174:30'>::Run xpcom/threads/nsThreadUtils.h:546
6 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1167
7 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:468
8 xul.dll mozilla::ipc::MessagePumpForNonMainThreads::Run ipc/glue/MessagePump.cpp:303
9 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:308

There are 28 crashes (from 22 installations) in nightly 66 starting with buildid 20190119095933. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1520877.

[1] https://hg.mozilla.org/mozilla-central/rev?node=5ab4532b7850

Flags: needinfo?(bas)
Priority: -- → P3

the signature is accounting for 14% of content crashes in affected builds.

OS: Windows 8 → Windows
Hardware: Unspecified → All

This is my fault.

Assignee: nobody → bas
Status: NEW → ASSIGNED
Flags: needinfo?(bas)
Attachment #9038186 - Attachment is obsolete: true
Priority: P3 → P1
Pushed by bschouten@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/9ec304cd5e28
Forego drawing if our drawtarget is invalid, this can happen on a devicereset. r=rhunt
Status: ASSIGNED → RESOLVED
Closed: 9 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla66
Depends on: 1522415

There still are some crashes in nightly with buildid 20190123165704.

Status: RESOLVED → REOPENED
Resolution: FIXED → ---

This signature appears to have disappeared in the 66 nightly build from the 28th, likely due to Bug 1522415. However, we have crashes in this signature in 66.0b1 and 66.0b2 that will have to be addressed.

(In reply to Marcia Knous [:marcia - needinfo? me] from comment #8)

This signature appears to have disappeared in the 66 nightly build from the 28th, likely due to Bug 1522415. However, we have crashes in this signature in 66.0b1 and 66.0b2 that will have to be addressed.

Scratch that - there are crashes in the build from the 28th as well as into Nightly 67 (I probably looked before the cron job ran). Marking 67 as affected.

Hello bas - This crash is still happening on Nightly, 25-30 crashes per build. Unfortunately it is also in Beta 66, where is caused hundreds of crashes in B1, B2 and I assume B3 which we just shipped. Can we back out the patch or get another fix and get users back in a good working state? Thanks.

Flags: needinfo?(bas)

High enough crash volume in beta 66 (~400 crashes/300 installs even in beta 1 and 2) that I consider this a release blocker.

Tracking for 67 as well.

Pushed by bschouten@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/afa70e5e516a
Part 2: Ensure destination DT is valid when replaying SourceSurfaceCapture. r=rhunt

Comment on attachment 9040459 [details]
Bug 1521368 - Part 2: Ensure destination DT is valid when replaying SourceSurfaceCapture. r=rhunt

Beta/Release Uplift Approval Request

Feature/Bug causing the regression

Bug 1519760

User impact if declined

Top crasher

Is this code covered by automated tests?

Yes

Has the fix been verified in Nightly?

No

Needs manual test from QE?

No

If yes, steps to reproduce

List of other uplifts needed

None

Risk to taking this patch

Low

Why is the change risky/not risky? (and alternatives if risky)

Single line fix.

String changes made/needed

None

Flags: needinfo?(bas)
Attachment #9040459 - Flags: approval-mozilla-beta?

Comment on attachment 9040459 [details]
Bug 1521368 - Part 2: Ensure destination DT is valid when replaying SourceSurfaceCapture. r=rhunt

Fix for top crash in beta, let's uplift for today's beta 4 build.

Attachment #9040459 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Status: REOPENED → RESOLVED
Closed: 9 months ago9 months ago
Resolution: --- → FIXED

(In reply to [:philipp] from comment #19)

there are still crashes in the most recent nightly build 20190131214909 containing the fix:
https://crash-stats.mozilla.com/search/?build_id=%3E%3D20190131214909&release_channel=nightly&signature=%3Dmozilla%3A%3Agfx%3A%3ADrawTargetD2D1%3A%3ACreateBrushForPattern#crash-reports

Hrm, this is a very different bug than the one in this bug (note the very different stack trace, it even occurs on a different thread). That doesn't make it invalid but I somewhat doubt this will be hit much on beta. Having said that it should probably be fixed. I have a fix.

Flags: needinfo?(bas)

Filed bug 1524554.

See Also: → 1524554

Found another case of this bug in crash stats. Fix upcoming.

Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Pushed by bschouten@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/be4b4f867823
Part 3: Ensure DrawTargetDual properly implements IsValid(). r=rhunt

:lizzard does Part 3 have approval for beta?

Flags: needinfo?(lhenry)

Comment on attachment 9040801 [details]
Bug 1521368 - Part 3: Ensure DrawTargetDual properly implements IsValid(). r=rhunt

Another part of this crash fix, ok to uplift for beta 5.

Flags: needinfo?(lhenry)
Attachment #9040801 - Flags: approval-mozilla-beta+
Status: REOPENED → RESOLVED
Closed: 9 months ago8 months ago
Resolution: --- → FIXED
Flags: qe-verify-
See Also: → 1526045
You need to log in before you can comment on or make changes to this bug.