Closed Bug 1771349 Opened 10 months ago Closed 10 months ago

Assertion failure: result, at /gfx/2d/InlineTranslator.h:60

Categories

(Core :: Graphics: WebRender, defect)

Product:
Core
Component:
Graphics: WebRender
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
102 Branch
Tracking Flags:
Tracking Status
firefox-esr91 --- wontfix
firefox101 --- wontfix
firefox102 --- verified

People

(Reporter: jkratzer, Assigned: lsalzman)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase, Whiteboard: [bugmon:bisected,confirmed])

Crash Data

Attachments

(2 files)

Testcase
590 bytes, text/plain
Details
Bug 1771349 - Add some null checks to DrawTargetRecording. r?aosmond
48 bytes, text/x-phabricator-request
Details | Review

Testcase found while fuzzing mozilla-central rev e7aef329a267 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build e7aef329a267 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: result, at /gfx/2d/InlineTranslator.h:60

    ==2509798==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f4b273fe559 bp 0x7f4a9fbfb280 sp 0x7f4a9fbfb280 T2509889)
    ==2509798==The signal is caused by a WRITE memory access.
    ==2509798==Hint: address points to the zero page.
        #0 0x7f4b273fe559 in mozilla::gfx::InlineTranslator::LookupSourceSurface(mozilla::gfx::ReferencePtr) /gfx/2d/InlineTranslator.h:60:5
        #1 0x7f4b273eff04 in mozilla::gfx::RecordedMaskSurface::PlayEvent(mozilla::gfx::Translator*) const /gfx/2d/RecordedEventImpl.h:3764:41
        #2 0x7f4b27403a3b in operator() /gfx/2d/InlineTranslator.cpp:82:31
        #3 0x7f4b27403a3b in std::_Function_handler<bool (mozilla::gfx::RecordedEvent*), mozilla::gfx::InlineTranslator::TranslateRecording(char*, unsigned long)::$_0>::_M_invoke(std::_Any_data const&, mozilla::gfx::RecordedEvent*&&) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:301:9
        #4 0x7f4b273f3b53 in bool mozilla::gfx::RecordedEvent::DoWithEvent<mozilla::gfx::InlineTranslator::TranslateRecording(char*, unsigned long)::MemReader>(mozilla::gfx::InlineTranslator::TranslateRecording(char*, unsigned long)::MemReader&, mozilla::gfx::RecordedEvent::EventType, std::function<bool (mozilla::gfx::RecordedEvent*)> const&) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/include/x86_64-linux-gnu/bits/string3.h
        #5 0x7f4b273f0799 in mozilla::gfx::InlineTranslator::TranslateRecording(char*, unsigned long) /gfx/2d/InlineTranslator.cpp:72:20
        #6 0x7f4b279515fe in Moz2DRenderCallback /gfx/webrender_bindings/Moz2DImageRenderer.cpp:427:20
        #7 0x7f4b279515fe in wr_moz2d_render_cb /gfx/webrender_bindings/Moz2DImageRenderer.cpp:471:10
        #8 0x7f4b2f0c9590 in webrender_bindings::moz2d_renderer::rasterize_blob::_$u7b$$u7b$closure$u7d$$u7d$::h1d8fa286df371169 /gfx/webrender_bindings/src/moz2d_renderer.rs:612:16
        #9 0x7f4b2f0c9590 in webrender_bindings::moz2d_renderer::autoreleasepool::h83a00b1a813304d3 /gfx/webrender_bindings/src/moz2d_renderer.rs:594:9
        #10 0x7f4b2f0c9590 in webrender_bindings::moz2d_renderer::rasterize_blob::hbd23df4115751cd0 /gfx/webrender_bindings/src/moz2d_renderer.rs:610:18
        #11 0x7f4b2f0b49e5 in core::ops::function::Fn::call::hc88037e91f8c2285 /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/core/src/ops/function.rs:70:5
        #12 0x7f4b2f0b49e5 in core::ops::function::impls::_$LT$impl$u20$core..ops..function..FnMut$LT$A$GT$$u20$for$u20$$RF$F$GT$::call_mut::h8b8f65c64b713ef5 /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/core/src/ops/function.rs:247:13
        #13 0x7f4b2f0b49e5 in core::ops::function::impls::_$LT$impl$u20$core..ops..function..FnOnce$LT$A$GT$$u20$for$u20$$RF$mut$u20$F$GT$::call_once::h036560f75480a311 /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/core/src/ops/function.rs:280:13
        #14 0x7f4b2f0b49e5 in core::option::Option$LT$T$GT$::map::h6f7659594bcc511a /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/core/src/option.rs:906:29
        #15 0x7f4b2f0b49e5 in _$LT$core..iter..adapters..map..Map$LT$I$C$F$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::next::h203c3d2da4bb9cf8 /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/core/src/iter/adapters/map.rs:103:9
        #16 0x7f4b2f0b49e5 in rayon::iter::plumbing::Folder::consume_iter::h697e9c04eb301664 /third_party/rust/rayon/src/iter/plumbing/mod.rs:178:21
        #17 0x7f4b2f0b49e5 in _$LT$rayon..iter..map..MapFolder$LT$C$C$F$GT$$u20$as$u20$rayon..iter..plumbing..Folder$LT$T$GT$$GT$::consume_iter::h225f3eb7cb639979 /third_party/rust/rayon/src/iter/map.rs:248:21
        #18 0x7f4b2f0b49e5 in rayon::iter::plumbing::Producer::fold_with::h79454cb5bd522068 /third_party/rust/rayon/src/iter/plumbing/mod.rs:110:9
        #19 0x7f4b2f0b49e5 in rayon::iter::plumbing::bridge_producer_consumer::helper::hc592e5c9ed70e976 /third_party/rust/rayon/src/iter/plumbing/mod.rs:438:13
        #20 0x7f4b2f0b1d09 in rayon::iter::plumbing::bridge_producer_consumer::helper::_$u7b$$u7b$closure$u7d$$u7d$::h970d8aea9cc97a23 /third_party/rust/rayon/src/iter/plumbing/mod.rs:427:21
        #21 0x7f4b2f0b1d09 in rayon_core::join::join_context::call_b::_$u7b$$u7b$closure$u7d$$u7d$::hfbe423c3600077ca /third_party/rust/rayon-core/src/join/mod.rs:129:25
        #22 0x7f4b2f0b1d09 in rayon_core::job::StackJob$LT$L$C$F$C$R$GT$::run_inline::h99e49d73496e9d45 /third_party/rust/rayon-core/src/job.rs:97:9
        #23 0x7f4b2f0b1d09 in rayon_core::join::join_context::_$u7b$$u7b$closure$u7d$$u7d$::he160ed7d554170ed /third_party/rust/rayon-core/src/join/mod.rs:158:36
        #24 0x7f4b2f0b4c20 in rayon_core::registry::in_worker::h214125aba86af87f /third_party/rust/rayon-core/src/registry.rs:877:13
        #25 0x7f4b2f0b4c20 in rayon_core::join::join_context::hf766a588651d44f2 /third_party/rust/rayon-core/src/join/mod.rs:132:5
        #26 0x7f4b2f0b4c20 in rayon::iter::plumbing::bridge_producer_consumer::helper::hc592e5c9ed70e976 /third_party/rust/rayon/src/iter/plumbing/mod.rs:416:47
        #27 0x7f4b2f0b1d09 in rayon::iter::plumbing::bridge_producer_consumer::helper::_$u7b$$u7b$closure$u7d$$u7d$::h970d8aea9cc97a23 /third_party/rust/rayon/src/iter/plumbing/mod.rs:427:21
        #28 0x7f4b2f0b1d09 in rayon_core::join::join_context::call_b::_$u7b$$u7b$closure$u7d$$u7d$::hfbe423c3600077ca /third_party/rust/rayon-core/src/join/mod.rs:129:25
        #29 0x7f4b2f0b1d09 in rayon_core::job::StackJob$LT$L$C$F$C$R$GT$::run_inline::h99e49d73496e9d45 /third_party/rust/rayon-core/src/job.rs:97:9
        #30 0x7f4b2f0b1d09 in rayon_core::join::join_context::_$u7b$$u7b$closure$u7d$$u7d$::he160ed7d554170ed /third_party/rust/rayon-core/src/join/mod.rs:158:36
        #31 0x7f4b2f0b4c20 in rayon_core::registry::in_worker::h214125aba86af87f /third_party/rust/rayon-core/src/registry.rs:877:13
        #32 0x7f4b2f0b4c20 in rayon_core::join::join_context::hf766a588651d44f2 /third_party/rust/rayon-core/src/join/mod.rs:132:5
        #33 0x7f4b2f0b4c20 in rayon::iter::plumbing::bridge_producer_consumer::helper::hc592e5c9ed70e976 /third_party/rust/rayon/src/iter/plumbing/mod.rs:416:47
        #34 0x7f4b2f0b1b38 in rayon::iter::plumbing::bridge_producer_consumer::helper::_$u7b$$u7b$closure$u7d$$u7d$::h8a20bb15e83f638b /third_party/rust/rayon/src/iter/plumbing/mod.rs:418:21
        #35 0x7f4b2f0b1b38 in rayon_core::join::join_context::call_a::_$u7b$$u7b$closure$u7d$$u7d$::h160e566da15c7363 /third_party/rust/rayon-core/src/join/mod.rs:124:17
        #36 0x7f4b2f0b1b38 in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::hfa8a68915f17cacc /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/core/src/panic/unwind_safe.rs:271:9
        #37 0x7f4b2f0b1b38 in std::panicking::try::do_call::had08e453e6f7ad30 /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/std/src/panicking.rs:492:40
        #38 0x7f4b2f0b1b38 in std::panicking::try::hc152c53c866d8ca5 /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/std/src/panicking.rs:456:19
        #39 0x7f4b2f0b1b38 in std::panic::catch_unwind::h46c4741a5b284c9c /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/std/src/panic.rs:137:14
        #40 0x7f4b2f0b1b38 in rayon_core::unwind::halt_unwinding::he125defd8de83c76 /third_party/rust/rayon-core/src/unwind.rs:17:5
        #41 0x7f4b2f0b1b38 in rayon_core::join::join_context::_$u7b$$u7b$closure$u7d$$u7d$::he160ed7d554170ed /third_party/rust/rayon-core/src/join/mod.rs:141:24
        #42 0x7f4b2f0b4c20 in rayon_core::registry::in_worker::h214125aba86af87f /third_party/rust/rayon-core/src/registry.rs:877:13
        #43 0x7f4b2f0b4c20 in rayon_core::join::join_context::hf766a588651d44f2 /third_party/rust/rayon-core/src/join/mod.rs:132:5
        #44 0x7f4b2f0b4c20 in rayon::iter::plumbing::bridge_producer_consumer::helper::hc592e5c9ed70e976 /third_party/rust/rayon/src/iter/plumbing/mod.rs:416:47
        #45 0x7f4b2f0b1d09 in rayon::iter::plumbing::bridge_producer_consumer::helper::_$u7b$$u7b$closure$u7d$$u7d$::h970d8aea9cc97a23 /third_party/rust/rayon/src/iter/plumbing/mod.rs:427:21
        #46 0x7f4b2f0b1d09 in rayon_core::join::join_context::call_b::_$u7b$$u7b$closure$u7d$$u7d$::hfbe423c3600077ca /third_party/rust/rayon-core/src/join/mod.rs:129:25
        #47 0x7f4b2f0b1d09 in rayon_core::job::StackJob$LT$L$C$F$C$R$GT$::run_inline::h99e49d73496e9d45 /third_party/rust/rayon-core/src/job.rs:97:9
        #48 0x7f4b2f0b1d09 in rayon_core::join::join_context::_$u7b$$u7b$closure$u7d$$u7d$::he160ed7d554170ed /third_party/rust/rayon-core/src/join/mod.rs:158:36
        #49 0x7f4b2f0b4c20 in rayon_core::registry::in_worker::h214125aba86af87f /third_party/rust/rayon-core/src/registry.rs:877:13
        #50 0x7f4b2f0b4c20 in rayon_core::join::join_context::hf766a588651d44f2 /third_party/rust/rayon-core/src/join/mod.rs:132:5
        #51 0x7f4b2f0b4c20 in rayon::iter::plumbing::bridge_producer_consumer::helper::hc592e5c9ed70e976 /third_party/rust/rayon/src/iter/plumbing/mod.rs:416:47
        #52 0x7f4b2f0ae149 in rayon::iter::plumbing::bridge_producer_consumer::helper::_$u7b$$u7b$closure$u7d$$u7d$::h970d8aea9cc97a23 /third_party/rust/rayon/src/iter/plumbing/mod.rs:427:21
        #53 0x7f4b2f0ae149 in rayon_core::join::join_context::call_b::_$u7b$$u7b$closure$u7d$$u7d$::hfbe423c3600077ca /third_party/rust/rayon-core/src/join/mod.rs:129:25
        #54 0x7f4b2f0ae149 in _$LT$rayon_core..job..StackJob$LT$L$C$F$C$R$GT$$u20$as$u20$rayon_core..job..Job$GT$::execute::call::_$u7b$$u7b$closure$u7d$$u7d$::hfaff3e92b92eca7b /third_party/rust/rayon-core/src/job.rs:113:21
        #55 0x7f4b2f0ae149 in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h6dc2e5e60bb47e9d /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/core/src/panic/unwind_safe.rs:271:9
        #56 0x7f4b2f0ae149 in std::panicking::try::do_call::h854efcf8e42f4324 /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/std/src/panicking.rs:492:40
        #57 0x7f4b2f0ae149 in std::panicking::try::hff3f7171b176e7dc /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/std/src/panicking.rs:456:19
        #58 0x7f4b2f0ae149 in std::panic::catch_unwind::hcc194558b936a7fc /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/std/src/panic.rs:137:14
        #59 0x7f4b2f0ae149 in rayon_core::unwind::halt_unwinding::h4d2dbae0688571f7 /third_party/rust/rayon-core/src/unwind.rs:17:5
        #60 0x7f4b2f0ae149 in _$LT$rayon_core..job..StackJob$LT$L$C$F$C$R$GT$$u20$as$u20$rayon_core..job..Job$GT$::execute::h5548a5760524b529 /third_party/rust/rayon-core/src/job.rs:119:38
        #61 0x7f4b25ffcbfb in rayon_core::job::JobRef::execute::h40bd21558a6778d7 /third_party/rust/rayon-core/src/job.rs:59:9
        #62 0x7f4b25ffcbfb in rayon_core::registry::WorkerThread::execute::hdb76323dae2a0aea /third_party/rust/rayon-core/src/registry.rs:752:9
        #63 0x7f4b25ffcbfb in rayon_core::registry::WorkerThread::wait_until_cold::hdc9f94eb95d4da59 /third_party/rust/rayon-core/src/registry.rs:729:17
        #64 0x7f4b30649981 in rayon_core::registry::WorkerThread::wait_until::hdcfa4779e1790ef1 /third_party/rust/rayon-core/src/registry.rs:703:13
        #65 0x7f4b30649981 in rayon_core::registry::main_loop::hb30837b677b99a79 /third_party/rust/rayon-core/src/registry.rs:836:5
        #66 0x7f4b30649981 in rayon_core::registry::ThreadBuilder::run::h85e2a2f6b055b5c9 /third_party/rust/rayon-core/src/registry.rs:55:18
        #67 0x7f4b306576d7 in _$LT$rayon_core..registry..DefaultSpawn$u20$as$u20$rayon_core..registry..ThreadSpawn$GT$::spawn::_$u7b$$u7b$closure$u7d$$u7d$::hf1254015c83b177f /third_party/rust/rayon-core/src/registry.rs:100:20
        #68 0x7f4b306576d7 in std::sys_common::backtrace::__rust_begin_short_backtrace::h7d1c8722cf9111ba /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/std/src/sys_common/backtrace.rs:122:18
        #69 0x7f4b3063f394 in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h79eaf304b2294128 /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/std/src/thread/mod.rs:498:17
        #70 0x7f4b3063f394 in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::ha7c1c4260d2205f0 /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/core/src/panic/unwind_safe.rs:271:9
        #71 0x7f4b3063f394 in std::panicking::try::do_call::hc915c9c36e28c4a7 /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/std/src/panicking.rs:492:40
        #72 0x7f4b3063f394 in std::panicking::try::h9a249f6330fa7849 /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/std/src/panicking.rs:456:19
        #73 0x7f4b3063f394 in std::panic::catch_unwind::h4706b48a02efe01f /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/std/src/panic.rs:137:14
        #74 0x7f4b3063f394 in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::ha0a6d69a5e1891df /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/std/src/thread/mod.rs:497:30
        #75 0x7f4b3063f394 in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h3feb275f272184f0 /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/core/src/ops/function.rs:227:5
        #76 0x7f4b30754332 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::hf70ac038171e3e1a /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/alloc/src/boxed.rs:1853:9
        #77 0x7f4b30754332 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::he6690128792365ad /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/alloc/src/boxed.rs:1853:9
        #78 0x7f4b30754332 in std::sys::unix::thread::Thread::new::thread_start::ha07928d93d5a5ec9 /rustc/7737e0b5c4103216d6fd8cf941b7ab9bdbaace7c/library/std/src/sys/unix/thread.rs:108:17
        #79 0x7f4b3ce6f608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
        #80 0x7f4b3ca36132 in __clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /gfx/2d/InlineTranslator.h:60:5 in mozilla::gfx::InlineTranslator::LookupSourceSurface(mozilla::gfx::ReferencePtr)
    ==2509798==ABORTING
Attached file Testcase — 

    
    

    
  
Refining to WR since it appears to be involved.  Feel free to re-categorize if I'm mistaken.


Severity: -- → S3
Component: Graphics → Graphics: WebRender

    
    

    
  
Bugmon Analysis

Verified bug as reproducible on mozilla-central 20220526213638-f392452506ec.

Unable to bisect testcase (Testcase reproduces on start build!):




Start: 6adf3e04d40e2a9a1a69dc06fe101dc5a54ef615 (20210528214803)

End: e7aef329a267c324e972b46f50dcea1d7a5bd956 (20220526093328)

BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False)




Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

    
    

    
  
Got a crash on my Winx64 nightly : https://crash-stats.mozilla.org/report/index/75cc2c42-d7a2-434b-bd3a-6847b0220527#tab-bugzilla


Crash Signature: [@ OOM | unknown | wr_moz2d_render_cb ]

    
  
Keywords: crash

    
    

    
  
This isn't really a regression. It just looks like it's failing because of a gigantic source surface that Moz2D can't allocate, i.e.


Crash Annotation GraphicsCriticalError: |[0][GFX1-]: Failed to allocate a surface due to invalid size (DSS) Size(20829,20849) (t=5.74984)


This in turn causes LookupSurface to hit an assert and the playback to fail.


Severity: S3 → S4

    
  
Assignee: nobody → lsalzman
Status: NEW → ASSIGNED

    
    

    
  
Pushed by lsalzman@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/6b14bf7e1883
Add some null checks to DrawTargetRecording. r=aosmond,gfx-reviewers

    
    

    
  
Pushed by lsalzman@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/27e5e72d595c
Add some null checks to DrawTargetRecording. r=aosmond,gfx-reviewers

    
  
Flags: needinfo?(lsalzman)

    
    

    
  
https://hg.mozilla.org/mozilla-central/rev/27e5e72d595c


Status: ASSIGNED → RESOLVED
Closed: 10 months ago

          status-firefox102:
          --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 102 Branch

    
    

    
  
Bugmon Analysis

Verified bug as fixed on rev mozilla-central 20220529090310-ac2e51f9332e.

Removing bugmon keyword as no further action possible.  Please review the bug and re-add the keyword for further analysis.


Status: RESOLVED → VERIFIED

          status-firefox102:
          fixed → verified
Keywords: bugmon

    
    

    
  
Can still repro the same crash with nightly from https://hg.mozilla.org/mozilla-central/rev/ef6f66b77f1ecb456abc098151b5092f62bf8bd6

Sometimes it also crashes with this signature: https://crash-stats.mozilla.org/report/index/fce3b29c-aabf-479b-81e7-5ed340220530 (when the DPI is 1.5 or higher)



    
    

    
  
(In reply to Mayank Bansal from comment #13)




Can still repro the same crash with nightly from https://hg.mozilla.org/mozilla-central/rev/ef6f66b77f1ecb456abc098151b5092f62bf8bd6

Sometimes it also crashes with this signature: https://crash-stats.mozilla.org/report/index/fce3b29c-aabf-479b-81e7-5ed340220530 (when the DPI is 1.5 or higher)




That's a different signature. Please file a new bug.



    
    

    
  
(In reply to Lee Salzman [:lsalzman] from comment #14)




(In reply to Mayank Bansal from comment #13)




Can still repro the same crash with nightly from https://hg.mozilla.org/mozilla-central/rev/ef6f66b77f1ecb456abc098151b5092f62bf8bd6

Sometimes it also crashes with this signature: https://crash-stats.mozilla.org/report/index/fce3b29c-aabf-479b-81e7-5ed340220530 (when the DPI is 1.5 or higher)




That's a different signature. Please file a new bug.




Sorry, i wasnt clear enough.

I can still repro the original crash with the signature  [@ OOM | unknown | wr_moz2d_render_cb ].


With a different DPI, the crash signature is different. Will file a new bug for the new signature



    
  
See Also:  → 1771782

    
    

    
  
:lsalzman, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?

For more information, please visit auto_nag documentation.


Flags: needinfo?(lsalzman)

    
  
Flags: needinfo?(lsalzman)

          You need to log in
          before you can comment on or make changes to this bug.