Closed Bug 1637339 Opened 1 year ago Closed 11 months ago

Crash in [@ mozilla::gfx::ReadElementConstrained<T>]

Categories

(Core :: Graphics, defect, P1)

Unspecified
Windows 10
defect

Tracking

()

RESOLVED FIXED
mozilla78
Tracking Status
firefox-esr68 --- unaffected
firefox76 --- disabled
firefox77 --- disabled
firefox78 --- fixed

People

(Reporter: achronop, Assigned: bobowen)

References

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

This bug is for crash report bp-092b93ff-7db8-4829-8b97-e0c110200511.

Top 10 frames of crashing thread:

0 xul.dll CrashStatsLogForwarder::CrashAction gfx/thebes/gfxPlatform.cpp:407
1 xul.dll mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::Flush gfx/2d/Logging.h:279
2 xul.dll mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::~Log gfx/2d/Logging.h:272
3 xul.dll mozilla::gfx::ReadElementConstrained<mozilla::gfx::EventRingBuffer, mozilla::gfx::BackendType> gfx/2d/RecordingTypes.h:53
4 xul.dll mozilla::gfx::RecordedDrawTargetCreation::RecordedDrawTargetCreation<mozilla::gfx::EventRingBuffer> gfx/2d/RecordedEventImpl.h:1912
5 xul.dll static mozilla::gfx::RecordedEvent::DoWithEvent<mozilla::gfx::EventRingBuffer> gfx/2d/RecordedEventImpl.h:3875
6 xul.dll mozilla::layers::CanvasTranslator::TranslateRecording gfx/layers/ipc/CanvasTranslator.cpp:192
7 xul.dll mozilla::layers::CanvasTranslator::StartTranslation gfx/layers/ipc/CanvasTranslator.cpp:154
8 xul.dll mozilla::detail::RunnableMethodImpl< xpcom/threads/nsThreadUtils.h:1236
9 xul.dll mozilla::TaskQueue::Runner::Run xpcom/threads/TaskQueue.cpp:208

Started being more often in previous release after 20200407093520.

Severity: -- → S3
Flags: needinfo?(bobowencode)
Priority: -- → P3

I think all I need to do here is not crash if the stream is not good.
i.e. we didn't read the value correctly because the writer has failed for some reason, so checking the enum doesn't make sense.

Assignee: nobody → bobowencode
Status: NEW → ASSIGNED
Flags: needinfo?(bobowencode)
Priority: P3 → P1
Blocks: 1548487
Crash Signature: [@ mozilla::gfx::ReadElementConstrained<T>] → [@ mozilla::gfx::ReadElementConstrained<T>] [@ mozilla::gfx::ReadDrawOptions<T> ]
Pushed by bobowencode@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/a2bde621288c
Only validate constrained values when element read succeeded. r=jrmuizel
Status: ASSIGNED → RESOLVED
Closed: 11 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla78

There are 15 crashes since the patch landed: https://mzl.la/2X7Mdw1
:bobowen, should we reopen this bug or file a new one ?

Flags: needinfo?(bobowencode)

(In reply to Calixte Denizet (:calixte) from comment #5)

There are 15 crashes since the patch landed: https://mzl.la/2X7Mdw1
:bobowen, should we reopen this bug or file a new one ?

I'm looking at these crashes now.
I think they're subtly different, so I think the best thing is to file a new bug.
These appear to be issues occurring after another problem, which should probably have set the stream as bad, so we stop reading from it.

Flags: needinfo?(bobowencode)

I've filed bug 1641256.

See Also: → 1641256
You need to log in before you can comment on or make changes to this bug.