1576843 - Crash in [@ ssse3::S32_alpha_D32_filter_DX]

Status: RESOLVED FIXED

(Core :: Graphics, defect, P3)

Description

[[:philipp]]

This bug is for crash report bp-e0efff73-ded8-42b1-a4d5-0449f0190825.

Top 10 frames of crashing thread:

0 xul.dll static void ssse3::S32_alpha_D32_filter_DX gfx/skia/skia/src/opts/SkBitmapProcState_opts.h:141
1 xul.dll void BitmapProcShaderContext::shadeSpan gfx/skia/skia/src/shaders/SkBitmapProcShader.cpp:76
2 xul.dll void SkARGB32_Shader_Blitter::blitH gfx/skia/skia/src/core/SkBlitter_ARGB32.cpp:1005
3 xul.dll SkAAClipBlitter::blitRect gfx/skia/skia/src/core/SkAAClip.cpp:1972
4 xul.dll static void antifilldot8 gfx/skia/skia/src/core/SkScan_Antihair.cpp:683
5 xul.dll SkScan::AntiFillRect gfx/skia/skia/src/core/SkScan_Antihair.cpp
6 xul.dll SkScan::AntiFillRect gfx/skia/skia/src/core/SkScan_Antihair.cpp:813
7 xul.dll SkDraw::drawRect gfx/skia/skia/src/core/SkDraw.cpp:677
8 xul.dll void SkBitmapDevice::drawRect gfx/skia/skia/src/core/SkBitmapDevice.cpp:355
9 xul.dll void SkCanvas::onDrawRect gfx/skia/skia/src/core/SkCanvas.cpp:2088

this cross-platform crash signature is starting to show up in firefox 68, apparently related to bug 1539026.

Comment 1

[Daniel Veditz [:dveditz]]

sec-high because it's crashing in an interpolate function, and maybe if it's got the address wrong for one it might next write to a wrong address as well. But otherwise if the worst is a read in graphics this could be lowered to sec-moderate

Comment 2

[Jessie [:jbonisteel] pls NI]

Lee - per dveditz's comment - should this be a sec-high?

Comment 3

[Lee Salzman [:lsalzman]]

The problem isn't in Skia here as far as I understand. Rather, something higher up in OMTP is passing in a bad surface, but because this is from an OMTP recording, we don't have any real information on where the surface came from in the crash stack. The crash stacks don't show the memory being obviously wrong either like use-after-free, so this doesn't seem too concerning . We've also always had a low volume of these sorts of crashes occurring down in the Skia surface sampling functions ever since OMTP was introduced, and as yet I don't think we've found anything actionable in the global case to make them go away.

In summary, there could be a multitude of causes here, or at least nothing definitive, and looking at the stacks, not much we can do, and not much to be concerned about right now.

Comment 5

[Kris Taeleman (:ktaeleman)]

I've accidentally encountered this crash while recording a WinDbg Preview Time travel session:
https://drive.google.com/file/d/1tvTH00PaKjoqhYcolRIyyNcMPkQDfZeB/view?usp=sharing
( GFX Team drive )

The build was: https://archive.mozilla.org/pub/firefox/nightly/2020/09/2020-09-15-09-29-30-mozilla-central/firefox-82.0a1.en-US.win64.zip

Comment 6

[Kris Taeleman (:ktaeleman)]

I couldn't figure out what was going on, but it seemed to be caused by minimizing the window with two tabs open:

• https://xb.yrkz.me/#!/ptbr-ex-1
• about:processes

Comment 7

[Kris Taeleman (:ktaeleman)]

This should be fixed by 1656987

Comment 8

[BugBot [:suhaib / :marco]]

Since the bug is closed, the stalled keyword is now meaningless.
For more information, please visit auto_nag documentation.

Comment 9

[Tom Ritter [:tjr]]

Clearing advisory flag because the linked bug hasn't landed (completely) yet in beta.

Comment 10

[Julien Cristau [:jcristau]]

Bug 1656987 got uplifted to 82 and 78.4