1943715 - Crash in [@ qcms::iccread::ColourPrimaries::white_point]

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Andrew McCreight [:mccr8]]

Crash report: https://crash-stats.mozilla.org/report/index/2e4790dd-fe41-48bb-bf0e-3e0980250123

MOZ_CRASH Reason:

CP=0 is reserved

Top 10 frames:

0  libxul.so  MOZ_Crash(char const*, int, char const*)  mfbt/Assertions.h:337
0  libxul.so  RustMozCrash  mozglue/static/rust/wrappers.cpp:18
1  libxul.so  mozglue_static::panic_hook  mozglue/static/rust/lib.rs:102
2  libxul.so  core::ops::function::FnOnce::call_once{{vtable.shim}}  /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:79
3  libxul.so  <alloc::boxed::Box<F, A> as core::ops::function::Fn<Args>>::call  library/alloc/src/boxed.rs:1986
3  libxul.so  std::panicking::rust_panic_with_hook  library/std/src/panicking.rs:809
4  libxul.so  std::panicking::begin_panic_handler::{{closure}}  library/std/src/panicking.rs:674
5  libxul.so  std::sys::backtrace::__rust_end_short_backtrace  library/std/src/sys/backtrace.rs:170
6  libxul.so  rust_begin_unwind  library/std/src/panicking.rs:665
7  libxul.so  core::panicking::panic_fmt  library/core/src/panicking.rs:76

This looks like a Nightly regression. First build is 20250122090205. This is the set of changes in that build. Bug 1862245 is the only one that has color in the summary. It mentions PNGs, and this crash has nsPNGDecoder in the stack, so I'm going to guess that it is the regressor.

7 crashes so far, all with the crash reason "CP=0 is reserved", on both Linux and Windows.

Comment 1

[Andrew McCreight [:mccr8]]

Looks like there are some Fenix crashes, too.

Comment 2

[Timothy Nikkel (:tnikkel)]

Weird that that panics, we should probably just reject the cicp chunk in that case.

Comment 3

[Donal Meehan [:dmeehan]]

:tnikkel, this is the final week of nightly before Fx136 goes to beta.
Any concerns with assigning this bug and fixing the crash?

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The bug is marked as tracked for firefox136 (nightly). We have limited time to fix this, the soft freeze is in 2 days. However, the bug still isn't assigned.

:bhood, could you please find an assignee for this tracked bug? Given that it is a regression and we know the cause, we could also simply backout the regressor. If you disagree with the tracking decision, please talk with the release managers.

For more information, please visit BugBot documentation.

Comment 5

[Timothy Nikkel (:tnikkel)]

Attachment: Bug 1943715. Handle (ignore) invalid color primaries and transfer characteristics in the cicp chunk of pngs. r?#gfx-reviewers

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d6602ccf54b7
Handle (ignore) invalid color primaries and transfer characteristics in the cicp chunk of pngs. r=gfx-reviewers,aosmond,lsalzman

Comment 7

[amarc]

https://hg.mozilla.org/mozilla-central/rev/d6602ccf54b7

Comment 8

[Alex Finder]

(In reply to Pulsebot from comment #6)

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d6602ccf54b7
Handle (ignore) invalid color primaries and transfer characteristics in the
cicp chunk of pngs. r=gfx-reviewers,aosmond,lsalzman

Perfherder has detected a browsertime performance change from push d6602ccf54b7c955c3f7000d97b6b20891f4ba3d.

Improvements:

Ratio	Test	Platform	Options	Absolute values (old vs new)	Performance Profiles
3%	espn LastVisualChange	linux1804-64-shippable-qr	fission warm webrender	956.33 -> 925.24	Before/After

Details of the alert can be found in the alert summary, including links to graphs and comparisons for each of the affected tests.

If you need the profiling jobs you can trigger them yourself from treeherder job view or ask a sheriff to do that for you.

You can run these tests on try with ./mach try perf --alert 43558

For more information on performance sheriffing please see our FAQ.

Comment 9

[Timothy Nikkel (:tnikkel)]

It seems unlikely this bug changed perf. Perhaps there is another landing nearby that caused this?

Comment 10

[Alex Finder]

(In reply to Timothy Nikkel (:tnikkel) from comment #9)

It seems unlikely this bug changed perf. Perhaps there is another landing nearby that caused this?

Hi Timothy, the side-by-side job for espn for this revision seems to confirm an improvement on the LastVisualChange metric for the warm version.

Comment 11

[Timothy Nikkel (:tnikkel)]

(In reply to Alex Finder from comment #10)

(In reply to Timothy Nikkel (:tnikkel) from comment #9)

It seems unlikely this bug changed perf. Perhaps there is another landing nearby that caused this?

Hi Timothy, the side-by-side job for espn for this revision seems to confirm an improvement on the LastVisualChange metric for the warm version.

A side-by-side job is just one iteration of the test put into an a side by side animation? I'm not sure how that can confirm anything since there is fairly high variance in this test that is larger than the reported change here.

I did a bunch of re-triggers. From the re-triggers it looks pretty clear to me that bug 1943551 is actually responsible for the difference. That bug also caused a regression on this very same test in other metrics, so that makes sense.