1576372 - Crash in [@ mozilla::gfx::DrawTargetD2D1::CreateBrushForPattern] in void mozilla::SVGGeometryFrame::Render

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[[:philipp]]

This bug is for crash report bp-ce184417-af30-47ab-a3f7-33ccf0190824.

Top 10 frames of crashing thread:

0 xul.dll struct already_AddRefed<ID2D1Brush> mozilla::gfx::DrawTargetD2D1::CreateBrushForPattern gfx/2d/DrawTargetD2D1.cpp
1 xul.dll void mozilla::gfx::DrawTargetD2D1::Fill gfx/2d/DrawTargetD2D1.cpp:674
2 xul.dll void mozilla::SVGGeometryFrame::Render layout/svg/SVGGeometryFrame.cpp:702
3 xul.dll void mozilla::SVGGeometryFrame::PaintSVG layout/svg/SVGGeometryFrame.cpp:264
4 xul.dll void nsDisplaySVGGeometry::Paint layout/svg/SVGGeometryFrame.cpp:120
5 xul.dll void mozilla::FrameLayerBuilder::PaintItems layout/painting/FrameLayerBuilder.cpp:7143
6 xul.dll mozilla::FrameLayerBuilder::DrawPaintedLayer layout/painting/FrameLayerBuilder.cpp:7303
7 xul.dll void mozilla::layers::BasicPaintedLayer::PaintThebes gfx/layers/basic/BasicPaintedLayer.cpp:92
8 xul.dll void mozilla::layers::BasicLayerManager::PaintSelfOrChildren gfx/layers/basic/BasicLayerManager.cpp:700
9 xul.dll void mozilla::layers::BasicLayerManager::PaintLayer gfx/layers/basic/BasicLayerManager.cpp

content crashes with this stack are showing up more frequently in the past couple of days on nightly and now also on early data from 69.0b16, where they account for 1% of tab crash reports currently.

could this be related to the changes in bug 1562091?

Comment 1

[Marcia Knous [:marcia]]

One of the comments mentions Nvidia drivers - "It crashed whilst updating nvidia graphics drivers."

Comment 2

[Jessie [:jbonisteel] pls NI]

Assigning to Nical for now. Nical ping me if something else ends up making more sense.

Comment 3

[Nicolas Silva [:nical]]

Attachment: Bug 1576372 - Check the validity of the DrawTarget before rendering SVG content into it. r=aosmond

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4af7a75a66f2
Check the validity of the DrawTarget before rendering SVG content into it. r=aosmond

Comment 5

[[:philipp]]

thank you for the quick fix, it looks fairly contained - could you request uplift to 69 (that's release at this point) if you deem fit to do so?

though it's not clear if we'd respin another rc build, it would be better to be prepared than not. otherwise this patch may be a good ride-along candidate for any 69 dot release as well...

Comment 6

[Nicolas Silva [:nical]]

Comment on attachment 9088695 [details]
Bug 1576372 - Check the validity of the DrawTarget before rendering SVG content into it. r=aosmond

Beta/Release Uplift Approval Request

• User impact if declined: content process crashes when the driver resets
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce: We don't have clear STRs althouth reinstalling the driver while firefox is running on pa page with SVGs likely helps trigger the bug.
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Simple patch.
• String changes made/needed: None.

Comment 7

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/4af7a75a66f2

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Looks like there's still some crashes lingering around on Beta and Nightly. Should we file a new bug for those, Nicolas?

Comment 9

[Nicolas Silva [:nical]]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #8)

Looks like there's still some crashes lingering around on Beta and Nightly. Should we file a new bug for those, Nicolas?

Thanks for the heads up, I filed bug 1581475.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9088695 [details]
Bug 1576372 - Check the validity of the DrawTarget before rendering SVG content into it. r=aosmond

Simple null check to reduce (but not entirely eliminate) a spike with this signature in Fx69. Approved for 69.0.1.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-release/rev/988125c1cc08

Comment 12

[Daniel Cicas [:dcicas], Release QA]

Hello,

I could not reproduce this issue on Fx. 69.0b16 and I didn't encounter any crashes when I tried to reproduce this issue on Fx 69.0.1. I had a website with lots of SVG open in Fx, when I removed the Nvidia driver 430.64, then I reinstalled it (430.64) and I updated the nvidia driver to 436.30.

I used a Windows 10 x64, Nvidia GeForce 1050 GTX with a Intel Core i5-3470 CPU.

Comment 13

[Nicolas Silva [:nical]]

Comment on attachment 9088695 [details]
Bug 1576372 - Check the validity of the DrawTarget before rendering SVG content into it. r=aosmond

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: This is needed if we choose to uplift bug 1562091, can be discarded otherwise. This fixes a crash spike caused by the patch on that bug.
• User impact if declined: If declined, bug 1562091 should be decliened (or there will be crashes).
• Fix Landed on Version: 69
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Simple patch, has been baking, already in release.
• String or UUID changes made by this patch: None.

Comment 14

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9088695 [details]
Bug 1576372 - Check the validity of the DrawTarget before rendering SVG content into it. r=aosmond

Needed for bug 1562091 to avoid a crash spike. Approved for 68.2esr.

Comment 15

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr68/rev/f8879f983a65