903722 - pdf.js crash in CGGStackRestore() from CanvasRenderingContext2D::Restore()

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Chris Peterson [:cpeterson]]

STR:
1. Open http://www.ebmud.com/sites/default/files/pdfs/2013-lafayette-recreation-area-fees.pdf

RESULT:
CRASH!


creating 1!
[TabChild] SHOW (w,h)= (10, 10)
loading about:blank, 1
Assertion failed: (s->stack->next != NULL), function CGGStackRestore, file Context/CGGStack.c, line 77.
[Child 1203] ###!!! ABORT: ActorDestroy by IPC channel failure at LayerTransactionChild: file ../../../../gfx/layers/ipc/LayerTransactionChild.cpp, line 83

###!!! [Child][AsyncChannel] Error: Channel error: cannot send/recv

Abort trap: 6

Comment 1

[Chris Peterson [:cpeterson]]

Jeff, could this crash be a regression from Azure bug 897532?

This crash is a regression in Nightly 26 build 2013-08-09. Here is the pushlog from 08-08 to 08-09:

https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=fd4cf30428b0&tochange=e33c2011643e

Comment 2

[Scoobidiver (away)]

Crash ID from about:crashes please

Comment 3

[Jeff Muizelaar [:jrmuizel]]

(In reply to Chris Peterson (:cpeterson) from comment #1)
> Jeff, could this crash be a regression from Azure bug 897532?
> 
> This crash is a regression in Nightly 26 build 2013-08-09. Here is the
> pushlog from 08-08 to 08-09:
> 
> https://hg.mozilla.org/mozilla-central/
> pushloghtml?fromchange=fd4cf30428b0&tochange=e33c2011643e

That bug has been backed out. So you should see if it still crashes.

Comment 4

[Chris Peterson [:cpeterson]]

I can still repro this crash in build 2013-08-09, so this crash is not a regression from bug 897532.

I don't have a Crash ID because this crash is caught by Apple's crash reporter, not Firefox's. But here is the stack trace from Apple's crash reporter:


Exception Type:  EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000

Application Specific Information:
Assertion failed: (s->stack->next != NULL), function CGGStackRestore, file Context/CGGStack.c, line 77.
 

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib        	0x00007fff880bd212 __pthread_kill + 10
1   libsystem_c.dylib             	0x00007fff8cc7db54 pthread_kill + 90
2   libsystem_c.dylib             	0x00007fff8ccc1dce abort + 143
3   libsystem_c.dylib             	0x00007fff8ccc2e2a __assert_rtn + 146
4   com.apple.CoreGraphics        	0x00007fff86237b78 CGGStackRestore + 145
5   com.apple.CoreGraphics        	0x00007fff86237abe CGContextRestoreGState + 32
6   XUL                           	0x0000000101a058f0 mozilla::dom::CanvasRenderingContext2D::Restore() + 176
7   XUL                           	0x0000000102586ad1 mozilla::dom::CanvasRenderingContext2DBinding::restore(JSContext*, JS::Handle<JSObject*>, mozilla::dom::CanvasRenderingContext2D*, JSJitMethodCallArgs const&) + 17
8   XUL                           	0x0000000102580df5 mozilla::dom::CanvasRenderingContext2DBinding::genericMethod(JSContext*, unsigned int, JS::Value*) + 469
9   ???                           	0x000000010f9e4705 0 + 4556998405
10  ???                           	0x00000001389fb088 0 + 5244956808
11  ???                           	0x00000001007cd5f9 0 + 4303148537
12  XUL                           	0x00000001033dc8fe EnterBaseline(JSContext*, js::ion::EnterJitData&) + 206
13  XUL                           	0x00000001033dc7db js::ion::EnterBaselineMethod(JSContext*, js::RunState&) + 171
14  XUL                           	0x00000001031aff92 js::RunScript(JSContext*, js::RunState&) + 178
15  XUL                           	0x00000001031b94d4 js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) + 1540
16  XUL                           	0x00000001032c133e js_fun_apply(JSContext*, unsigned int, JS::Value*) + 1358
17  ???                           	0x0000000116ef235e 0 + 4679738206

Comment 5

[Jeff Muizelaar [:jrmuizel]]

We should try to get a tighter window

Comment 6

[Scoobidiver (away)]

The crash of comment 0 is a Graphics Layer bug, the one of comment 4 is a Canvas2D one.
I suspect bug 902103.

Comment 7

[Chris Peterson [:cpeterson]]

Matt, I bisected archived mozilla-inbound builds and I believe this OSX crash is regression from these SkiaGL changes:

https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=7abe5be6f8d2&tochange=5e519aedb9d1

Comment 8

[Matt Woodrow (:mattwoodrow)]

I think we're calling Demote() even without SkiaGL enabled. We only have the check inside an ifdef (which should be hit, because we're compiling with SkiaGL support), and don't have a runtime backend check.

This still shouldn't crash though, so I guess there's two bugs to be fixed here.

Comment 9

[Jesse Ruderman]

(In reply to Chris Peterson (:cpeterson) from comment #4)
> I don't have a Crash ID because this crash is caught by Apple's crash
> reporter, not Firefox's.

Breakpad misses this because of bug 717758.

Comment 10

[Jesse Ruderman]

I hit this reliably by loading
http://www.blackhat.com/docs/bh-us-12/sponsors/bh-us-13-recap12.pdf

Comment 12

[Till Schneidereit [:till]]

This is making Shumway development close to impossible in Nightly: the browser crashes very quickly no matter what content I'm looking at in Shumway. (Note: I'm not sure, but it might have gotten worse recently, so there might be something aggravating it.)

Comment 13

[Chris Peterson [:cpeterson]]

snorp, needinfo poke! Your SkiaGL changes may have caused a 100% reproducible OSX crash for pdf.js:

https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=7abe5be6f8d2&tochange=5e519aedb9d1

Comment 14

[Yury Delendik (:yury)]

The first bad revision is:
changeset:   141698:cf17bd948e44
user:        George Wright <[e-mail]>
date:        Wed Jul 24 15:14:27 2013 -0400
files:       content/canvas/src/CanvasRenderingContext2D.cpp
description:
Bug 897635 - Demote to software canvas if we use a non-standard composite mode r=mattwoodrow

Comment 15

[George Wright (:gw280) (needinfo me!)]

Attachment: 0001-Bug-903722-Only-demote-to-a-software-canvas-if-we-re.patch

We should look into why Demote() is causing it to crash, but we definitely only want to Demote() in the case of a Skia/GL canvas anyway. Doing it in any other case is a lot of wasted work.

Comment 16

[George Wright (:gw280) (needinfo me!)]

Attachment: 0001-Bug-903722-Only-demote-to-a-software-canvas-if-we-re.patch

That last patch was complete rubbish. Let's try that again.

Comment 17

[George Wright (:gw280) (needinfo me!)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f6d0b53da118

Comment 18

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/f6d0b53da118