898768 - crash in mozilla::dom::CanvasRenderingContext2D::Demote

Status: RESOLVED FIXED

(Core :: Graphics: Canvas2D, defect)

Description

[Scoobidiver (away)]

It started spiking in 25.0a1/20130723 but is discontinuous across builds.

Signature 	mozilla::dom::CanvasRenderingContext2D::Demote() More Reports Search
UUID 	1c5ac354-01c7-4714-a393-93a602130726
Date Processed	2013-07-26 21:05:53.167777
Uptime	81
Last Crash	97 seconds before submission
Install Age 	10198 since version was first installed.
Install Time 	2013-07-26 18:15:45
Product 	FennecAndroid
Version 	25.0a1
Build ID 	20130726030203
Release Channel 	nightly
OS 	Android
OS Version 	0.0.0 Linux 3.1.10-gce1331f #1 SMP PREEMPT Sun Dec 2 17:01:04 CST 2012 armv7l o2_uk/endeavoru/endeav
Build Architecture 	arm
Build Architecture Info 	ARMv0 | 4
Crash Reason 	SIGSEGV
Crash Address 	0x30
App Notes 	
AdapterDescription: 'NVIDIA Corporation -- NVIDIA Tegra 3 -- OpenGL ES 2.0 14.01002 -- Model: HTC One X, Product: endeavoru, Manufacturer: HTC, Hardware: endeavoru'
GL Layers! EGL? EGL+ GL Context? GL Context+ GL Layers+ 
HTC HTC One X
o2_uk/endeavoru/endeavoru:4.1.1/JRO03C/128187.27:user/release-keys

Frame 	Module 	Signature 	Source
0 	libxul.so 	mozilla::dom::CanvasRenderingContext2D::Demote() 	content/canvas/src/CanvasRenderingContext2D.cpp
1 	libxul.so 	mozilla::dom::CanvasRenderingContext2D::EnsureTarget() 	content/canvas/src/CanvasRenderingContext2D.cpp
2 	libxul.so 	mozilla::dom::CanvasRenderingContext2D::Save() 	content/canvas/src/CanvasRenderingContext2D.cpp
3 	libxul.so 	mozilla::dom::CanvasRenderingContext2DBinding::save 	obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp
4 	libxul.so 	mozilla::dom::CanvasRenderingContext2DBinding::genericMethod 	obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp
5 	libxul.so 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/jscntxtinlines.h
6 	libxul.so 	Interpret 	js/src/vm/Interpreter.cpp
7 	libxul.so 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
8 	libxul.so 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
9 	libxul.so 	js_fun_call(JSContext*, unsigned int, JS::Value*) 	js/src/jsfun.cpp
10 		@0x619ee81a 	

More reports at:
https://crash-stats.mozilla.com/report/list?product=FennecAndroid&signature=mozilla%3A%3Adom%3A%3ACanvasRenderingContext2D%3A%3ADemote%28%29

Comment 1

[Scoobidiver (away)]

It's #6 top crasher (#1 unfixed) in 25.0a1.

It started spiking in 25.0a1/20130726. The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a4c1961bf723&tochange=46d73e889cb4

Comment 2

[Milan Sreckovic [:milan] (needinfo for best results)]

The obvious graphics change I can see here is the one where we limit number of layers to 20.  It did cause a test failure, got backed out, etc. but the reports are newer than the backout of that change.

Comment 3

[James Willcox (:snorp) ([e-mail]) (he/him)]

Attachment: Make CRC2D::IsTargetValid also check for null

Comment 4

[James Willcox (:snorp) ([e-mail]) (he/him)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/51f5228300fc

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/51f5228300fc