Closed Bug 1576372 Opened 4 months ago Closed 3 months ago

Crash in [@ mozilla::gfx::DrawTargetD2D1::CreateBrushForPattern] in void mozilla::SVGGeometryFrame::Render

Categories

(Core :: Graphics, defect, critical)

69 Branch
All
Windows
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla70
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- fixed
firefox68 --- wontfix
firefox69 + fixed
firefox70 --- fixed

People

(Reporter: philipp, Assigned: nical)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

This bug is for crash report bp-ce184417-af30-47ab-a3f7-33ccf0190824.

Top 10 frames of crashing thread:

0 xul.dll struct already_AddRefed<ID2D1Brush> mozilla::gfx::DrawTargetD2D1::CreateBrushForPattern gfx/2d/DrawTargetD2D1.cpp
1 xul.dll void mozilla::gfx::DrawTargetD2D1::Fill gfx/2d/DrawTargetD2D1.cpp:674
2 xul.dll void mozilla::SVGGeometryFrame::Render layout/svg/SVGGeometryFrame.cpp:702
3 xul.dll void mozilla::SVGGeometryFrame::PaintSVG layout/svg/SVGGeometryFrame.cpp:264
4 xul.dll void nsDisplaySVGGeometry::Paint layout/svg/SVGGeometryFrame.cpp:120
5 xul.dll void mozilla::FrameLayerBuilder::PaintItems layout/painting/FrameLayerBuilder.cpp:7143
6 xul.dll mozilla::FrameLayerBuilder::DrawPaintedLayer layout/painting/FrameLayerBuilder.cpp:7303
7 xul.dll void mozilla::layers::BasicPaintedLayer::PaintThebes gfx/layers/basic/BasicPaintedLayer.cpp:92
8 xul.dll void mozilla::layers::BasicLayerManager::PaintSelfOrChildren gfx/layers/basic/BasicLayerManager.cpp:700
9 xul.dll void mozilla::layers::BasicLayerManager::PaintLayer gfx/layers/basic/BasicLayerManager.cpp

content crashes with this stack are showing up more frequently in the past couple of days on nightly and now also on early data from 69.0b16, where they account for 1% of tab crash reports currently.

could this be related to the changes in bug 1562091?

Flags: needinfo?(nical.bugzilla)

One of the comments mentions Nvidia drivers - "It crashed whilst updating nvidia graphics drivers."

Assigning to Nical for now. Nical ping me if something else ends up making more sense.

Assignee: nobody → nical.bugzilla
Flags: needinfo?(nical.bugzilla)
Pushed by nsilva@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/4af7a75a66f2
Check the validity of the DrawTarget before rendering SVG content into it. r=aosmond

thank you for the quick fix, it looks fairly contained - could you request uplift to 69 (that's release at this point) if you deem fit to do so?

though it's not clear if we'd respin another rc build, it would be better to be prepared than not. otherwise this patch may be a good ride-along candidate for any 69 dot release as well...

Flags: needinfo?(nical.bugzilla)

Comment on attachment 9088695 [details]
Bug 1576372 - Check the validity of the DrawTarget before rendering SVG content into it. r=aosmond

Beta/Release Uplift Approval Request

  • User impact if declined: content process crashes when the driver resets
  • Is this code covered by automated tests?: No
  • Has the fix been verified in Nightly?: No
  • Needs manual test from QE?: No
  • If yes, steps to reproduce: We don't have clear STRs althouth reinstalling the driver while firefox is running on pa page with SVGs likely helps trigger the bug.
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): Simple patch.
  • String changes made/needed: None.
Flags: needinfo?(nical.bugzilla)
Attachment #9088695 - Flags: approval-mozilla-beta?
Attachment #9088695 - Flags: approval-mozilla-beta? → approval-mozilla-release?
Status: NEW → RESOLVED
Closed: 3 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla70

Looks like there's still some crashes lingering around on Beta and Nightly. Should we file a new bug for those, Nicolas?

Flags: needinfo?(nical.bugzilla)
Blocks: 1581475

(In reply to Ryan VanderMeulen [:RyanVM] from comment #8)

Looks like there's still some crashes lingering around on Beta and Nightly. Should we file a new bug for those, Nicolas?

Thanks for the heads up, I filed bug 1581475.

Flags: needinfo?(nical.bugzilla)

Comment on attachment 9088695 [details]
Bug 1576372 - Check the validity of the DrawTarget before rendering SVG content into it. r=aosmond

Simple null check to reduce (but not entirely eliminate) a spike with this signature in Fx69. Approved for 69.0.1.

Attachment #9088695 - Flags: approval-mozilla-release? → approval-mozilla-release+

Hello,

I could not reproduce this issue on Fx. 69.0b16 and I didn't encounter any crashes when I tried to reproduce this issue on Fx 69.0.1. I had a website with lots of SVG open in Fx, when I removed the Nvidia driver 430.64, then I reinstalled it (430.64) and I updated the nvidia driver to 436.30.

I used a Windows 10 x64, Nvidia GeForce 1050 GTX with a Intel Core i5-3470 CPU.

Comment on attachment 9088695 [details]
Bug 1576372 - Check the validity of the DrawTarget before rendering SVG content into it. r=aosmond

ESR Uplift Approval Request

  • If this is not a sec:{high,crit} bug, please state case for ESR consideration: This is needed if we choose to uplift bug 1562091, can be discarded otherwise. This fixes a crash spike caused by the patch on that bug.
  • User impact if declined: If declined, bug 1562091 should be decliened (or there will be crashes).
  • Fix Landed on Version: 69
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): Simple patch, has been baking, already in release.
  • String or UUID changes made by this patch: None.
Attachment #9088695 - Flags: approval-mozilla-esr68?

Comment on attachment 9088695 [details]
Bug 1576372 - Check the validity of the DrawTarget before rendering SVG content into it. r=aosmond

Needed for bug 1562091 to avoid a crash spike. Approved for 68.2esr.

Attachment #9088695 - Flags: approval-mozilla-esr68? → approval-mozilla-esr68+
You need to log in before you can comment on or make changes to this bug.