1572415 - Crash in [@ mozilla::gfx::DrawTargetD2D1::PopClip]

Status: VERIFIED FIXED

(Core :: Graphics: Canvas2D, defect, P1)

Description

[Gian-Carlo Pascutto [:gcp]]

This bug is for crash report bp-5fe4e0b3-e929-4457-9fff-d37aa0190808.

Top 10 frames of crashing thread:

0 xul.dll void CrashStatsLogForwarder::CrashAction gfx/thebes/gfxPlatform.cpp:406
1 xul.dll mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::Flush gfx/2d/Logging.h:279
2 xul.dll void mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::~Log gfx/2d/Logging.h:272
3 xul.dll void mozilla::gfx::DrawTargetD2D1::PopClip gfx/2d/DrawTargetD2D1.cpp:944
4 xul.dll mozilla::dom::CanvasRenderingContext2D::Restore dom/canvas/CanvasRenderingContext2D.cpp:1730
5 xul.dll static bool mozilla::dom::CanvasRenderingContext2D_Binding::restore dom/bindings/CanvasRenderingContext2DBinding.cpp:6274
6 xul.dll mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3163
7  @0x243aa8dba9d 
8 xul.dll js::LiveSavedFrameCache::~LiveSavedFrameCache js/src/vm/Stack.h:1330
9  @0xbb839fcad7 

Reproducible trying to read https://arxiv.org/pdf/1709.01507.pdf , crashes when trying to scroll down.

Comment 1

[Dzmitry Malyshau [:kvark]]

Looks like a regression in CanvasRenderingContext2D logic that mismanages push and pops of the clips.

Comment 2

[Gian-Carlo Pascutto [:gcp]]

Hit this again on: https://www.geraardsbergen.be/file/download/12132/122EFF35B21A2EFA320AA3CD8511C673

Comment 3

[Marcia Knous [:marcia]]

Looks to be still happening on 72 and 71, but in very low volume. Not sure based on volume if this is worth keeping open.

Beside the crash URLs in the comments, I see another 2 that appear to be crashes while downloading PDFs.

Comment 4

[Bob Owen (:bobowen)]

Attachment: Bug 1572415: Convert clip paths when potentially changing canvas backend in CanvasRenderingContext2D. r=jrmuizel!

Comment 5

[Bob Owen (:bobowen)]

I'm moving this to block riding the trains, because bug 1596791 actually fixes the issue here.
The PopClip crash is a result of the fallback to normal rendering.
I still think we should fix this, but we possibly should also fall back to software rendering if the remote canvas fails.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/604a9ee95607
Convert clip paths when potentially changing canvas backend in CanvasRenderingContext2D. r=jrmuizel

Comment 7

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/604a9ee95607

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Comment 9

[Anca Soncutean, Desktop QA]

I've tried to reproduce this crash with Fx 70.0a1 on Windows 10, using different configuration, but I couldn't trigger it (note, that I can’t cover the GeForce RTX 2080 mentioned in crash).
Gian-Carlo, if time permits, can you please confirm this issue no longer occurs on Fx73?

Comment 10

[Gian-Carlo Pascutto [:gcp]]

WORKSFORME both with and without gfx.canvas.remote=true.

Comment 11

[Anca Soncutean, Desktop QA]

(In reply to Gian-Carlo Pascutto [:gcp] from comment #10)

WORKSFORME both with and without gfx.canvas.remote=true.

Thank you for your time!
Based on comment 10 I will mark this issue as verified fixed.