1580511 - Crash in [@ mozilla::gfx::DrawTargetD2D1::DrawSurface]

Status: RESOLVED FIXED

(Core :: Graphics, defect, P1)

Description

[Molly Howell (she/her) (mostly inactive)]

This bug is for crash report bp-2ea9efad-2bba-45fd-9c8c-154430190911.

This crash consistently happens a few seconds after startup when gfx.canvas.remote is true. So far I've observed it when the focused tab is Phabricator or Gmail, but I'm not sure if that matters.

Top 10 frames of crashing thread:

0 xul.dll void mozilla::gfx::DrawTargetD2D1::DrawSurface gfx/2d/DrawTargetD2D1.cpp:199
1 xul.dll mozilla::gfx::RecordedDrawSurface::PlayEvent gfx/2d/RecordedEventImpl.h:2597
2 xul.dll static bool mozilla::gfx::RecordedEvent::DoWithEvent<mozilla::gfx::EventRingBuffer> gfx/2d/RecordedEventImpl.h
3 xul.dll mozilla::layers::CanvasTranslator::TranslateRecording gfx/layers/CanvasTranslator.cpp:83
4 xul.dll void mozilla::layers::CanvasParent::StartTranslation gfx/layers/ipc/CanvasParent.cpp:191
5 xul.dll nsresult mozilla::detail::RunnableMethodImpl< xpcom/threads/nsThreadUtils.h:1176
6 xul.dll nsresult nsThreadPool::Run xpcom/threads/nsThreadPool.cpp:246
7 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1225
8 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:486
9 xul.dll mozilla::ipc::MessagePumpForNonMainThreads::Run ipc/glue/MessagePump.cpp:333

Comment 1

[Molly Howell (she/her) (mostly inactive)]

I also submitted 726fbf0a-e1df-47e9-8e9f-b646d0190911 which looks much the same.

Comment 2

[Bob Owen (:bobowen)]

mhowell - thanks for testing and reporting.
Unfortunately, I can't reproduce this, but I've put together a build that logs all the events played for a surface if it's not in the lookup table.

https://treeherder.mozilla.org/#/jobs?repo=try&duplicate_jobs=visible&revision=707e2fb8b69ba1cb85500e1fe00d91c3093f5346

You should be able to get logging out of this build with:
MOZ_LOG="TranslatorLog:5,sync" MOZ_LOG_FILE="blah"

It will eat a bit of memory because of storing all the events, but hopefully you can reproduce while the logging is turned on, to try and give me a clue.

Comment 3

[Molly Howell (she/her) (mostly inactive)]

Well, it doesn't actually end up doing much logging with that command. I set MOZ_LOG_FILE to "remote_canvas", and on startup there's three files created with the names remote_canvas.child-1.moz_log, remote_canvas.child-10.moz_log, and remote_canvas.moz_log. Nothing is ever written to these files. When the crash occurs, a fourth file is created with the name remote_canvas.child-2.moz_log with one line:
[GPU 17220: CanvasWorkers #1]: I/TranslatorLog Events for surface: faaf54c0 : 20 15
and nothing else is ever written there after that.

Comment 4

[Bob Owen (:bobowen)]

(In reply to Matt Howell (he/him) [:mhowell] from comment #3)

Well, it doesn't actually end up doing much logging with that command. I set MOZ_LOG_FILE to "remote_canvas", and on startup there's three files created with the names remote_canvas.child-1.moz_log, remote_canvas.child-10.moz_log, and remote_canvas.moz_log. Nothing is ever written to these files. When the crash occurs, a fourth file is created with the name remote_canvas.child-2.moz_log with one line:
[GPU 17220: CanvasWorkers #1]: I/TranslatorLog Events for surface: faaf54c0 : 20 15
and nothing else is ever written there after that.

Thanks, yeah it only logs when the issue occurs.
Annoying how when you see (what I hope is) the problem, how obvious it is. :-(
It looks like the DrawTargetD2D1::CreateSourceSurfaceFromData call is returning null.

If you wouldn't mind doing the honours again ...
I've put in an extra log when that happens to log the size of the surface:
https://treeherder.mozilla.org/#/jobs?repo=try&duplicate_jobs=visible&revision=8877cedbeda004bf02a391b166f9d9544fb2eda4

I've also pushed a potential fix to try, assuming the issue is an invalid size:
https://treeherder.mozilla.org/#/jobs?repo=try&duplicate_jobs=visible&revision=0b25116981efb31df526d892538e1036b1cc8f19

Comment 5

[Molly Howell (she/her) (mostly inactive)]

(In reply to Bob Owen (:bobowen) from comment #4)

I've put in an extra log when that happens to log the size of the surface:
https://treeherder.mozilla.org/#/jobs?repo=try&duplicate_jobs=visible&revision=8877cedbeda004bf02a391b166f9d9544fb2eda4

I'm no expert but this size definitely looks suspicious:

[GPU 16248: CanvasWorkers #1]: I/TranslatorLog Surface creation failed 634feb20: width: 28 height: 33288
[GPU 16248: CanvasWorkers #1]: I/TranslatorLog Events for surface: 634feb20 : 20 15

I've also pushed a potential fix to try, assuming the issue is an invalid size:
https://treeherder.mozilla.org/#/jobs?repo=try&duplicate_jobs=visible&revision=0b25116981efb31df526d892538e1036b1cc8f19

This doesn't seem to have fixed it, I get the same crash as before (which I submitted this time, if it helps). :(

Comment 6

[Bob Owen (:bobowen)]

(In reply to Matt Howell (he/him) [:mhowell] from comment #5)

(In reply to Bob Owen (:bobowen) from comment #4)

I've put in an extra log when that happens to log the size of the surface:
https://treeherder.mozilla.org/#/jobs?repo=try&duplicate_jobs=visible&revision=8877cedbeda004bf02a391b166f9d9544fb2eda4

I'm no expert but this size definitely looks suspicious:

[GPU 16248: CanvasWorkers #1]: I/TranslatorLog Surface creation failed 634feb20: width: 28 height: 33288
[GPU 16248: CanvasWorkers #1]: I/TranslatorLog Events for surface: 634feb20 : 20 15

Thanks, yes that 33288 is the problem I think.

I've also pushed a potential fix to try, assuming the issue is an invalid size:
https://treeherder.mozilla.org/#/jobs?repo=try&duplicate_jobs=visible&revision=0b25116981efb31df526d892538e1036b1cc8f19

This doesn't seem to have fixed it, I get the same crash as before (which I submitted this time, if it helps). :(

Hmm, I must need to add the check somewhere else as well.

Comment 7

[Bob Owen (:bobowen)]

OK, here's another attempt to catch the problem surface, thanks:
https://treeherder.mozilla.org/#/jobs?repo=try&duplicate_jobs=visible&revision=33ab286a97c33afcad17ed9cf47423186af3d480

Comment 8

[Molly Howell (she/her) (mostly inactive)]

Okay I've been running that build for several minutes and nothing has happened, and it normally only takes a few seconds, so I think it's worked this time.

Comment 9

[Bob Owen (:bobowen)]

(In reply to Matt Howell (he/him) [:mhowell] from comment #8)

Okay I've been running that build for several minutes and nothing has happened, and it normally only takes a few seconds, so I think it's worked this time.

Great, thanks for all the testing.

Comment 10

[Bob Owen (:bobowen)]

Attachment: Bug 1580511: Check size is allowed in DrawTargetRecording::CreateSourceSurfaceFromData. r=jrmuizel

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e79e04964bee
Check size is allowed in DrawTargetRecording::CreateSourceSurfaceFromData. r=jrmuizel

Comment 12

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/e79e04964bee