The default bug view has changed. See this FAQ.

Firefox Crash [@ nsCanvasRenderingContext2DAzure::GetImageData_explicit(int, int, unsigned int, unsigned int, unsigned char*, unsigned int) ]

RESOLVED FIXED in Firefox 7

Status

()

Core
Graphics
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: marcia, Assigned: bas)

Tracking

({crash})

Trunk
mozilla9
x86
Windows 7
crash
Points:
---

Firefox Tracking Flags

(firefox7+ fixed, firefox8 fixed)

Details

(Whiteboard: [qa-], crash signature)

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

6 years ago
Seen while looking at crash stats. Low volume crash which appears on the the trunk and Aurora. 

https://crash-stats.mozilla.com/report/list?signature=nsCanvasRenderingContext2DAzure::GetImageData_explicit%28int,%20int,%20unsigned%20int,%20unsigned%20int,%20unsigned%20char*,%20unsigned%20int%29

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsCanvasRenderingContext2DAzure::GetImageData_explicit 	content/canvas/src/nsCanvasRenderingContext2DAzure.cpp:4119
1 	xul.dll 	CreateImageData 	obj-firefox/dist/include/CustomQS_Canvas2D.h:196
2 	xul.dll 	nsIDOMCanvasRenderingContext2D_GetImageData 	obj-firefox/dist/include/CustomQS_Canvas2D.h:349
3 	xul.dll 	js::Invoke 	js/src/jsinterp.cpp:656
4 	xul.dll 	js::Interpret 	js/src/jsinterp.cpp:4008
Assignee: nobody → bas.schouten
I can reproduce it consistently on http://www.mapnificent.net/torino/ (or any other city available on mapnificient)
(In reply to Carlo Alberto Ferraris from comment #1)
> I can reproduce it consistently on http://www.mapnificent.net/torino/ (or
> any other city available on mapnificient)

(on current aurora: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0a2) Gecko/20110804 Firefox/7.0a2)
tracking-firefox7: --- → ?
(Assignee)

Comment 3

6 years ago
I can't seem to reproduce on that site. Have you seen it anywhere else on your machine?

Comment 4

6 years ago
Tracking for 7 as azure is new in 7
tracking-firefox7: ? → +
(Assignee)

Updated

6 years ago
Blocks: 651858
Created attachment 560228 [details] [diff] [review]
Don't release the DataSourceSurface until after we access the pixels

I've also included the s/abs/fabs change since this is required to mac.
Attachment #560228 - Flags: review?
Attachment #560228 - Flags: review? → review?(bas.schouten)
Created attachment 560230 [details] [diff] [review]
Don't release the DataSourceSurface until after we access the pixels v2

Fine, removed the abs code.
Attachment #560228 - Attachment is obsolete: true
Attachment #560228 - Flags: review?(bas.schouten)
Attachment #560230 - Flags: review?(bas.schouten)
(Assignee)

Comment 7

6 years ago
Comment on attachment 560230 [details] [diff] [review]
Don't release the DataSourceSurface until after we access the pixels v2

Review of attachment 560230 [details] [diff] [review]:
-----------------------------------------------------------------

Yes! This is almost certainly the problem we're seeing here, although since we can't reproduce it we won't know for sure. This is completely safe though and fixes a nasty bug, it should be taken!
Attachment #560230 - Flags: review?(bas.schouten)
Attachment #560230 - Flags: review+
Attachment #560230 - Flags: approval-mozilla-beta?
Attachment #560230 - Flags: approval-mozilla-aurora?

Updated

6 years ago
Attachment #560230 - Flags: approval-mozilla-beta?
Attachment #560230 - Flags: approval-mozilla-beta+
Attachment #560230 - Flags: approval-mozilla-aurora?
Attachment #560230 - Flags: approval-mozilla-aurora+
https://hg.mozilla.org/integration/mozilla-inbound/rev/75cff72d1ff6
Whiteboard: [inbound]

Comment 9

6 years ago
This needs to land on beta asap to make Firefox 7
https://hg.mozilla.org/releases/mozilla-aurora/rev/f9c333d4a095
https://hg.mozilla.org/releases/mozilla-beta/rev/1a894427bc94

Updated

6 years ago
status-firefox7: --- → fixed
status-firefox8: --- → fixed
https://hg.mozilla.org/mozilla-central/rev/75cff72d1ff6
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Whiteboard: [inbound]
Target Milestone: --- → mozilla9

Comment 12

6 years ago
I did tests to verify if the issue is fixed and while zooming in and out in the map here http://www.mapnificent.net/torino/ (comment 1) the browser freezes for a few seconds displaying the following message"
"A script on this page may be busy, or it may have stopped responding. You can stop the script now, or you can continue to see if the script will complete.Script: http://www.mapnificent.net/media/js/main.js:1"

This is visible on Windows 7 both x86 and x64 platforms on the latest Firefox builds on the following channels:

Beta, 7.0b6:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0) Gecko/20100101 Firefox/7.0

Aurora, 8.0a2
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0a2) Gecko/20110918 Firefox/8.0a2

Nightly, 9.0a1:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a1) Gecko/20110918 Firefox/9.0a1

Although, this issue is not visible on the Linux platform, or Mac or even other versions of Windows like XP or Vista.
Finally, it's unclear if this bug should be reopen or not. Thanks
I believe this bug was about the crash reported in the original comment, not a slow script warning. If you cannot crash Firefox by using the test you performed then I would say this is VERIFIED FIXED.
qa- as there really isn't much we can do to verify this is fixed
Whiteboard: [qa-]
You need to log in before you can comment on or make changes to this bug.