Last Comment Bug 676690 - Firefox Crash [@ nsCanvasRenderingContext2DAzure::GetImageData_explicit(int, int, unsigned int, unsigned int, unsigned char*, unsigned int) ]
: Firefox Crash [@ nsCanvasRenderingContext2DAzure::GetImageData_explicit(int, ...
Status: RESOLVED FIXED
[qa-]
: crash
Product: Core
Classification: Components
Component: Graphics (show other bugs)
: Trunk
: x86 Windows 7
: -- critical (vote)
: mozilla9
Assigned To: Bas Schouten (:bas.schouten)
:
Mentors:
Depends on:
Blocks: 651858
  Show dependency treegraph
 
Reported: 2011-08-04 15:03 PDT by Marcia Knous [:marcia - use ni]
Modified: 2011-09-22 16:45 PDT (History)
8 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
+
fixed
fixed


Attachments
Don't release the DataSourceSurface until after we access the pixels (1.63 KB, patch)
2011-09-14 12:45 PDT, Matt Woodrow (:mattwoodrow)
no flags Details | Diff | Review
Don't release the DataSourceSurface until after we access the pixels v2 (971 bytes, patch)
2011-09-14 12:49 PDT, Matt Woodrow (:mattwoodrow)
bas: review+
christian: approval‑mozilla‑aurora+
christian: approval‑mozilla‑beta+
Details | Diff | Review

Description Marcia Knous [:marcia - use ni] 2011-08-04 15:03:58 PDT
Seen while looking at crash stats. Low volume crash which appears on the the trunk and Aurora. 

https://crash-stats.mozilla.com/report/list?signature=nsCanvasRenderingContext2DAzure::GetImageData_explicit%28int,%20int,%20unsigned%20int,%20unsigned%20int,%20unsigned%20char*,%20unsigned%20int%29

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsCanvasRenderingContext2DAzure::GetImageData_explicit 	content/canvas/src/nsCanvasRenderingContext2DAzure.cpp:4119
1 	xul.dll 	CreateImageData 	obj-firefox/dist/include/CustomQS_Canvas2D.h:196
2 	xul.dll 	nsIDOMCanvasRenderingContext2D_GetImageData 	obj-firefox/dist/include/CustomQS_Canvas2D.h:349
3 	xul.dll 	js::Invoke 	js/src/jsinterp.cpp:656
4 	xul.dll 	js::Interpret 	js/src/jsinterp.cpp:4008
Comment 1 Carlo Alberto Ferraris 2011-08-05 01:33:14 PDT
I can reproduce it consistently on http://www.mapnificent.net/torino/ (or any other city available on mapnificient)
Comment 2 Carlo Alberto Ferraris 2011-08-05 01:34:12 PDT
(In reply to Carlo Alberto Ferraris from comment #1)
> I can reproduce it consistently on http://www.mapnificent.net/torino/ (or
> any other city available on mapnificient)

(on current aurora: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0a2) Gecko/20110804 Firefox/7.0a2)
Comment 3 Bas Schouten (:bas.schouten) 2011-08-08 22:41:56 PDT
I can't seem to reproduce on that site. Have you seen it anywhere else on your machine?
Comment 4 christian 2011-08-09 15:11:05 PDT
Tracking for 7 as azure is new in 7
Comment 5 Matt Woodrow (:mattwoodrow) 2011-09-14 12:45:23 PDT
Created attachment 560228 [details] [diff] [review]
Don't release the DataSourceSurface until after we access the pixels

I've also included the s/abs/fabs change since this is required to mac.
Comment 6 Matt Woodrow (:mattwoodrow) 2011-09-14 12:49:10 PDT
Created attachment 560230 [details] [diff] [review]
Don't release the DataSourceSurface until after we access the pixels v2

Fine, removed the abs code.
Comment 7 Bas Schouten (:bas.schouten) 2011-09-14 12:52:24 PDT
Comment on attachment 560230 [details] [diff] [review]
Don't release the DataSourceSurface until after we access the pixels v2

Review of attachment 560230 [details] [diff] [review]:
-----------------------------------------------------------------

Yes! This is almost certainly the problem we're seeing here, although since we can't reproduce it we won't know for sure. This is completely safe though and fixes a nasty bug, it should be taken!
Comment 8 Matt Woodrow (:mattwoodrow) 2011-09-14 16:17:30 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/75cff72d1ff6
Comment 9 christian 2011-09-14 16:44:26 PDT
This needs to land on beta asap to make Firefox 7
Comment 11 :Ehsan Akhgari (busy, don't ask for review please) 2011-09-15 07:37:53 PDT
https://hg.mozilla.org/mozilla-central/rev/75cff72d1ff6
Comment 12 AndreiD[QA] 2011-09-19 05:18:04 PDT
I did tests to verify if the issue is fixed and while zooming in and out in the map here http://www.mapnificent.net/torino/ (comment 1) the browser freezes for a few seconds displaying the following message"
"A script on this page may be busy, or it may have stopped responding. You can stop the script now, or you can continue to see if the script will complete.Script: http://www.mapnificent.net/media/js/main.js:1"

This is visible on Windows 7 both x86 and x64 platforms on the latest Firefox builds on the following channels:

Beta, 7.0b6:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0) Gecko/20100101 Firefox/7.0

Aurora, 8.0a2
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0a2) Gecko/20110918 Firefox/8.0a2

Nightly, 9.0a1:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a1) Gecko/20110918 Firefox/9.0a1

Although, this issue is not visible on the Linux platform, or Mac or even other versions of Windows like XP or Vista.
Finally, it's unclear if this bug should be reopen or not. Thanks
Comment 13 Anthony Hughes (:ashughes) [GFX][QA][Mentor] 2011-09-19 09:31:02 PDT
I believe this bug was about the crash reported in the original comment, not a slow script warning. If you cannot crash Firefox by using the test you performed then I would say this is VERIFIED FIXED.
Comment 14 Anthony Hughes (:ashughes) [GFX][QA][Mentor] 2011-09-22 16:45:50 PDT
qa- as there really isn't much we can do to verify this is fixed

Note You need to log in before you can comment on or make changes to this bug.