1904737 - Crash in [@ RtlEnterCriticalSection | Mutex::Lock]

Status: RESOLVED WORKSFORME

(Core :: Graphics: WebRender, defect)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/8891e94e-8bac-4992-b3b9-a74c70240621

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  ntdll.dll  RtlEnterCriticalSection  
1  mozglue.dll  Mutex::Lock  memory/build/Mutex.h:81
1  mozglue.dll  MaybeMutex::Lock  memory/build/Mutex.h:200
1  mozglue.dll  AutoLock<MaybeMutex>::AutoLock  memory/build/Mutex.h:247
1  mozglue.dll  arena_t::MallocSmall  memory/build/mozjemalloc.cpp:3457
1  mozglue.dll  arena_t::Malloc  memory/build/mozjemalloc.cpp:3513
1  mozglue.dll  BaseAllocator::malloc  memory/build/mozjemalloc.cpp:4736
1  mozglue.dll  MozJemalloc::malloc  memory/build/malloc_decls.h:51
1  mozglue.dll  PageMalloc  memory/build/PHC.cpp:1339
1  mozglue.dll  MozJemallocPHC::malloc  memory/build/PHC.cpp:1346

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-06-21
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: No

By analyzing the backtrace, the regression may have been introduced by a patch [1] to fix Bug 1896503.

[1] https://hg.mozilla.org/mozilla-central/rev?node=c2eaf893e115

:ahale, since you are the author of the potential regressor, could you please take a look?

Comment 1

[Ashley Hale [:ahale]]

I'm looking into this.

Comment 2

[Timothy Nikkel (:tnikkel)]

There's only two crashes with that signature on nightly. The buildids are 20240620213827 and 20240623211133, I don't think bug 1896503 was in either of those builds so the bot must have made a mistake.

The signatures of the two crashes look very different.

Comment 3

[Ashley Hale [:ahale]]

Yeah I can't figure out how the WR SVGFE integration would provoke this, it even tries to avoid using memory allocation for performance reasons (limited graph size is allowed by SVG spec, so might as well make use of that).

The SVGFE integration landed 2024-06-18, was backed out the same day, then was landed again on 2024-06-25 and has not been backed out. So the buildids do not overlap the first time it landed or the second time.

Comment 4

[Erich Gubler [:ErichDonGubler] (he/him)]

Triaging as S3, as I see no indication of a production issue yet.

Comment 5

[Timothy Nikkel (:tnikkel)]

In the last seven days all of the crashes with this signature are on 115 or older. The two crashes in nightly mentioned above are now outside the seven day window. I think this was just noise. I'm gonna close this bug.