1595704 - Crash in [@ nv30_fp_state_bind]

Status: RESOLVED WORKSFORME

(External Software Affecting Firefox :: Other, defect, P3)

Description

[Gabriele Svelto [:gsvelto]]

This bug is for crash report bp-6ff962c9-a170-4a76-9974-561a10191112.

Top 10 frames of crashing thread:

0 nouveau_dri.so nv30_fp_state_bind /build/mesa-_I81I2/mesa-18.0.5/build/src/gallium/drivers/nouveau/../../../../../src/gallium/drivers/nouveau/nv30/nv30_fragprog.c:174
1 nouveau_dri.so cso_delete_fragment_shader /build/mesa-_I81I2/mesa-18.0.5/build/src/gallium/auxiliary/../../../../src/gallium/auxiliary/cso_cache/cso_context.c:660
2 nouveau_dri.so destroy_program_variants /build/mesa-_I81I2/mesa-18.0.5/build/src/mesa/../../../src/mesa/state_tracker/st_program.c:261
3 nouveau_dri.so destroy_shader_program_variants_cb /build/mesa-_I81I2/mesa-18.0.5/build/src/mesa/../../../src/mesa/state_tracker/st_program.c:1824
4 nouveau_dri.so _mesa_HashWalk /build/mesa-_I81I2/mesa-18.0.5/build/src/mesa/../../../src/mesa/main/hash.c:336
5 nouveau_dri.so st_destroy_context /build/mesa-_I81I2/mesa-18.0.5/build/src/mesa/../../../src/mesa/state_tracker/st_context.c:657
6 nouveau_dri.so dri_destroy_context /build/mesa-_I81I2/mesa-18.0.5/build/src/gallium/state_trackers/dri/../../../../../src/gallium/state_trackers/dri/dri_context.c:239
7 nouveau_dri.so driDestroyContext /build/mesa-_I81I2/mesa-18.0.5/build/src/mesa/drivers/dri/common/../../../../../../src/mesa/drivers/dri/common/dri_util.c:530
8 libGL.so.1.2.0 dri2_destroy_context /build/mesa-_I81I2/mesa-18.0.5/build/src/glx/../../../src/glx/dri2_glx.c:123
9 libGL.so.1.2.0 glXDestroyContext /build/mesa-_I81I2/mesa-18.0.5/build/src/glx/../../../src/glx/glxcmds.c:471

This is a NULL-pointer dereference in mesa's nouveau driver that causes crashes in content processes. The vast majority of the crashes are coming from Debian 9 and older with older Ubuntu LTS ranking somewhat below that. More recent versions of mesa seem unaffected. I will file a bug in Debian's tracker and link it back here.

Comment 1

[Gabriele Svelto [:gsvelto]]

It seems that reporting a bug to Debian w/o having Debian installed is tricky business. I'll let this lie until I have some spare time to install Debian in a VM.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:marcia, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 3

[Gabriele Svelto [:gsvelto]]

This is not something we can fix ourselves but we should try and make sure that it's fixed upstream so setting to P3.

Comment 4

[Pascal Chevrel:pascalc]

On Nightly this crash signature has been spiking 10x in the last days, the crashes started to spike after March 27

Comment 5

[Gabriele Svelto [:gsvelto]]

The second signature is being handled in bug 1626898 so I'm removing it from here since it's a different crash. After that lands the driver responsible for this will be blocked so this should go away too.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.