927413 - crash in mozilla::gfx::DrawTargetSkia::DrawSurface

Status: VERIFIED FIXED

(Core :: Graphics: Canvas2D, defect)

Description

[Tracy Walker [:tracy]]

This bug was filed from the Socorro interface and is 
report bp-da3533ba-c98d-466c-aa7c-7c72c2131015.
=============================================================

This is a start up crasher that surfaced on Nightly. Previously was Bug 881634.   I don't see any reports of this on 26 or 25. So seems to be a regression on trunk only.

I'll investigate if the STR's from https://bugzilla.mozilla.org/show_bug.cgi?id=881634#c4 apply here.

Comment 1

[Adam Prescott]

Hi,
I submitted the crash report available at https://crash-stats.mozilla.com/report/index/42e8b27c-9e97-481c-8dda-fb4ac2131016 which seems to show a similar signature to the bug report above

The crash seems to occur when the Tree Style Tabs Plugin is enabled in my case (Extension ID [e-mail]) https://addons.mozilla.org/en-US/firefox/addon/tree-style-tab/

When I disable the Plugin under the Add-Ons system in Safe-Mode, I can then start Nightly up again as normal. This plugin used to work fine in an earlier version of nightly though I don't think I can pin-point the build version since I didn't take note and I'm currently not sure were to look.

Let me know if you need more info from me.

Thanks,
Adam.

Comment 2

[Honza Bambas (:mayhemer)]

I think I suffer this one two:

https://crash-stats.mozilla.com/report/index/bb63ac19-54b6-4aff-8084-277e32131017
https://crash-stats.mozilla.com/report/index/513de884-c954-4eb7-b176-0bbb82131017


works:
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-10-14-03-02-04-mozilla-central/

doesn't work:
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-10-15-03-03-19-mozilla-central/

I can start in safe mode, tho.  According comments and my own experience, this is problem with the Tree Style Tab extension.

Reported on the Tree Style Tab extension as well for tracking:
https://github.com/piroor/treestyletab/issues/578

Comment 3

[Adam Prescott]

I can confirm that the build from http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-10-14-03-02-04-mozilla-central/ also works fine for the 64bit version.

Comment 4

[Lucas Aliaga]

Got a crash with a similar signature. Was attempting to access Gallery. Can be found at https://crash-stats.mozilla.com/report/index/395eac25-f759-4082-bb82-14d962131021 

- Buri 1.3 10/21 -
Gaia   e10553a9099545157636a057c170c77fb4cb93a5
SourceStamp 7823e2985daf
BuildID 20131021040204
Version 27.0a1

Comment 5

[gbennett]

Do you guys need a 100% STR for 1.3?

Comment 6

[gbennett]

Repro Steps:
1) Open up Camera app
2) Rapidly take pictures moving between portrait and landscape.
3) Press the home button.

Actual:
A crash occurs and pressing other apps is unresponsive.

Expected:
No crash occurs and pressing other apps is responsive.

Crash stack: https://crash-stats.mozilla.com/report/index/2136d7c1-e877-432d-b327-a9fd42131022
Notes: After you get this crash to occur once, just opening up the Camera app and hitting the home button will cause the crash. Lucas and I were both able to get this repro 4/4 times, even after restarting the phone.

Comment 7

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Thanks Garrett!

You can also reproduce this by:
1. launching Gallery
2. selecting a picture
3. edit the picture
4. select the color tool
5. rapidly switch the color
6. hit home

Comment 8

[Wayne Mery (:wsmwk)]

I got this on first firefox startup after having booted vista with LAA (large address aware) (which I read firefox supports)
both with and without sessionstore.js 
safe mode does NOT crash


bp-7ba623e7-3669-42e4-b4eb-5d2672131026
0	gkmedias.dll	mozilla::gfx::DrawTargetSkia::DrawSurface(mozilla::gfx::SourceSurface *,mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const &,mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const &,mozilla::gfx::DrawSurfaceOptions const &,mozilla::gfx::DrawOptions const &)	gfx/2d/DrawTargetSkia.cpp
1	xul.dll	mozilla::dom::CanvasRenderingContext2D::DrawWindow(nsIDOMWindow *,double,double,double,double,nsAString_internal const &,unsigned int,mozilla::ErrorResult &)	content/canvas/src/CanvasRenderingContext2D.cpp
2	xul.dll	mozilla::dom::CanvasRenderingContext2DBinding::drawWindow	obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp
3	xul.dll	mozilla::dom::CanvasRenderingContext2DBinding::genericMethod	obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp
4	mozjs.dll	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct)	js/src/vm/Interpreter.cpp
5	mozjs.dll	Interpret	js/src/vm/Interpreter.cpp

Application Basics
------------------

Name: Firefox
Version: 27.0a1
User Agent: Mozilla/5.0 (Windows NT 6.0; rv:27.0) Gecko/20100101 Firefox/27.0

Extensions
----------

Name: about:jank
Version: 0.5
Enabled: false
ID: [e-mail]

Name: about:telemetry
Version: 0.14
Enabled: false
ID: [e-mail]

Name: Adblock Plus
Version: 2.4
Enabled: false
ID: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

Name: Aero Window Title
Version: 1.6
Enabled: false
ID: [e-mail]

Name: bugmasters
Version: 1.1.1
Enabled: false
ID: jid0-W98PHBMVm7TBsQGPGxpmu7XxGno@jetpack

Name: Collusion
Version: 0.9.0
Enabled: false
ID: jid1-7OBiDHPW1YAPaQ@jetpack

Name: Context Search
Version: 0.6.2
Enabled: false
ID: {902D2C4A-457A-4EF9-AD43-7014562929FF}

Name: Cookie Controller
Version: 2.8
Enabled: false
ID: {ac2cfa60-bc96-11e0-962b-0800200c9a66}

Name: CopyAllUrls
Version: 0.9.2
Enabled: false
ID: {960BE052-4847-422b-9AD6-8631D3D0A607}

Name: FindBar Tweak
Version: 1.4.9
Enabled: false
ID: fbt@quicksaver

Name: Firebug
Version: 1.12.4
Enabled: false
ID: [e-mail]

Name: Flashblock
Version: 1.5.17
Enabled: false
ID: {3d7eb24f-2740-49df-8937-200b1cc08f8a}

Name: Gmail panel
Version: 1.0.7
Enabled: false
ID: [e-mail]

Name: Hide Menubar
Version: 6.0.20110915
Enabled: false
ID: [e-mail]

Name: History Deleter
Version: 2.4.1
Enabled: false
ID: [e-mail]

Name: Integrated Google Calendar
Version: 1.2.0
Enabled: false
ID: [e-mail]

Name: MemChaser
Version: 0.5.2.1
Enabled: false
ID: [e-mail]

Name: Microsoft .NET Framework Assistant
Version: 0.0.0
Enabled: false
ID: {20a82645-c095-46ed-80e3-08825760534b}

Name: Nightly Tester Tools
Version: 3.7pre20131013
Enabled: false
ID: {8620c15f-30dc-4dba-a131-7c5d20cf4a29}

Name: NoSquint
Version: 2.1.9
Enabled: false
ID: [e-mail]

Name: Permanent List-all-tabs Button
Version: 1.0
Enabled: false
ID: [e-mail]

Name: Pocket
Version: 3.0.4
Enabled: false
ID: [e-mail]

Name: Readability
Version: 2.4
Enabled: false
ID: {6005d9b1-d115-485a-a92a-3f6453ca3fe2}

Name: Silvermel and Charamel XT
Version: 1.5.5
Enabled: false
ID: [e-mail]

Name: Snap Links Plus
Version: 2.3.2b15
Enabled: false
ID: [e-mail]

Name: Tabhunter
Version: 1.0.2
Enabled: false
ID: [e-mail]

Name: Tabloc
Version: 0.5
Enabled: false
ID: {60520222-6bbf-45dd-b547-3641ea9cd9cb}

Name: Theme Font & Size Changer
Version: 7.2
Enabled: false
ID: {f69e22c7-bc50-414a-9269-0f5c344cd94c}

Name: TinyURL Generator
Version: 2.6.1
Enabled: false
ID: [e-mail]

Name: Tree Style Tab
Version: 0.14.2013102300a024205
Enabled: false
ID: [e-mail]

Name: Unread Tabs
Version: 0.3
Enabled: false
ID: {99ec6690-8bb1-11da-a72b-0800200c9a66}

Name: Vertical Tabs
Version: 0.9.4
Enabled: false
ID: [e-mail]

Name: ViewAbout
Version: 2.0.1
Enabled: false
ID: [e-mail]

Important Modified Preferences
------------------------------

accessibility.typeaheadfind.flashBar: 0
browser.cache.disk.capacity: 750000
browser.cache.disk.smart_size_cached_value: 348160
browser.cache.disk.smart_size.first_run: false
browser.cache.disk.smart_size.use_old_max: false
browser.cache.use_new_backend: 1
browser.places.smartBookmarksVersion: 4
browser.privatebrowsing.dont_prompt_on_enter: true
browser.sessionstore.interval: 30000
browser.sessionstore.max_tabs_undo: 4
browser.sessionstore.restore_on_demand: false
browser.sessionstore.upgradeBackup.latestBuildID: 20131025100746
browser.startup.homepage: about:blank
browser.startup.homepage_override.buildID: 20131025100746
browser.startup.homepage_override.mstone: 27.0a1
browser.tabs.animate: false
browser.tabs.insertRelatedAfterCurrent: false
browser.tabs.loadFolderAndReplace: false
browser.tabs.onTop: false
browser.tabs.warnOnClose: false
browser.zoom.siteSpecific: false
dom.ipc.processes: 5
dom.mozApps.runUpdate: false
dom.mozApps.used: true
dom.w3c_touch_events.expose: false
extensions.checkCompatibility.4.2a: false
extensions.checkCompatibility.8.0a: false
extensions.checkCompatibility.nightly: false
extensions.lastAppVersion: 27.0a1
font.internaluseonly.changed: true
gfx.blacklist.suggested-driver-version: 10.6
gfx.direct2d.disabled: true
javascript.options.mem.log: true
javascript.options.mem.notify: true
layers.acceleration.disabled: true
mousewheel.withcontrolkey.action: 3
network.cookie.prefsMigrated: true
network.http.max-persistent-connections-per-server: 8
places.database.lastMaintenance: 1382456959
places.history.expiration.transient_current_max_pages: 46641
places.history.expiration.transient_optimal_database_size: 30173347
plugin.disable_full_page_plugin_for_types: audio/webm,audio/x-ms-wma,video/x-ms-wmv,application/x-mplayer2,video/x-ms-asf,video/x-ms-asf-plugin,video/x-ms-wvx,appl
plugin.importedState: true

privacy.sanitize.migrateFx3Prefs: true
security.warn_viewing_mixed: false
storage.vacuum.last.index: 1
storage.vacuum.last.places.sqlite: 1381685011
toolkit.startup.recent_crashes: 2

user.js Preferences
-------------------

Your profile folder contains a user.js file, which includes preferences that were not created by Nightly.

Graphics
--------

Adapter Description: ATI Radeon X1270
Adapter Drivers: atiumdag atiumdva atitmmxx
Adapter RAM: Unknown
Device ID: 0x791f
Direct2D Enabled: Blocked for your graphics driver version. Try updating your graphics driver to version 10.6 or newer.
DirectWrite Enabled: false (7.0.6002.23200)
Driver Date: 6-2-2008
Driver Version: 8.501.0.0
GPU #2 Active: false
GPU Accelerated Windows: 0/1 Basic Blocked for your graphics driver version. Try updating your graphics driver to version 10.6 or newer.
Vendor ID: 0x1002
WebGL Renderer: Blocked for your graphics driver version. Try updating your graphics driver to version 10.6 or newer.
windowLayerManagerRemote: false
AzureCanvasBackend: skia
AzureContentBackend: cairo
AzureFallbackCanvasBackend: cairo
AzureSkiaAccelerated: 0

JavaScript
----------

Incremental GC: true

Accessibility
-------------

Activated: false
Prevent Accessibility: 0

Library Versions
----------------

NSPR
Expected minimum version: 4.10.2 Beta
Version in use: 4.10.2 Beta

NSS
Expected minimum version: 3.15.2 Basic ECC Beta
Version in use: 3.15.2 Basic ECC Beta

NSSSMIME
Expected minimum version: 3.15.2 Basic ECC Beta
Version in use: 3.15.2 Basic ECC Beta

NSSSSL
Expected minimum version: 3.15.2 Basic ECC Beta
Version in use: 3.15.2 Basic ECC Beta

NSSUTIL
Expected minimum version: 3.15.2 Beta
Version in use: 3.15.2 Beta

Comment 9

[Wayne Mery (:wsmwk)]

regression list http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2013-10-14%2003:00:00&enddate=2013-10-15%2004:00:00 -- perhaps we should suspect bug 922942?

Ignore y comment 8.  My crash only happens with treestyletabs enabled. bcdedit /set IncreaseUserVa 3072  is not involved. So, as noted at mayhemer's comment 2 and https://github.com/piroor/treestyletab/issues/578#issuecomment-26654706

Comment 10

[Wayne Mery (:wsmwk)]

however, not everyone who crashes is using treestyletabs addon
bp-438cec5a-d973-4fd8-a858-cb8e02131021
bp-f865d7af-5da2-4122-871a-d44c12131019

Comment 11

[Jan Honza Odvarko [:Honza] (always need-info? me)]

I am also experiencing the crash. Here are my STRs:

1) Install Firebug 
https://getfirebug.com/releases/firebug/1.13/firebug-1.13.0a4.xpi

2) Install FBTest (Firebug's test harness)
https://getfirebug.com/releases/fbtest/1.12/fbTest-1.12b4.xpi

3) Run Firefox, open Firebug UI (press F12) and open FBTest console window: Firebug (icon) menu -> Open Test Console

4) The console should load this test list by default:
https://getfirebug.com/tests/head/firebug.html

5) Run test Css/5000/Issue5000.js by clicking on it -> CRASH

Honza

Comment 12

[Tracy Walker [:tracy]]

#2 topcrasher on Fx27
crash volume of this signature combined with the volume in Bug 805406 - crash in gfxContext::PushClipsToDT with Direct2D would put gfx crashes at #1 topcrasher on Fx27 above the Empty crash

Comment 13

[Milan Sreckovic [:milan] (needinfo for best results)]

Matt, if this is not because of bug 922942, let us know and we'll take it from there.

Comment 14

[Matt Woodrow (:mattwoodrow)]

Attachment: Protect against nullptr crashes

This crash happened because the w value passed to DrawWindow was 0, and we tried to allocate a 0 sized surface. This works for cairo backend DrawTargets (and maybe it shouldn't), but we failed trying to get that data out of that to draw it with Skia.

Comment 15

[Matt Woodrow (:mattwoodrow)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/33bf96af921c

Comment 16

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/33bf96af921c

Comment 17

[Tracy Walker [:tracy]]

Will need this uplifted to Aurora as this was reported on Nightly before the latest merge cycle.

Comment 18

[Adam Prescott]

Seems to be working for me now after the latest patch. Thanks.

Comment 19

[bhavana bajaj [:bajaj]]

NI on :mattwoodrow to help with uplift here.

Comment 20

[Matt Woodrow (:mattwoodrow)]

Comment on attachment 825012 [details] [diff] [review]
Protect against nullptr crashes

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Bug 922942
User impact if declined: Crash
Testing completed (on m-c, etc.): Been on m-c for over a week 
Risk to taking this patch (and alternatives if risky): Basically none, just a null check.
String or IDL/UUID changes made by this patch: None!

Comment 21

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/b93ea15eb356

Comment 22

[Tracy Walker [:tracy]]

This has been dropping down the topcrash list for Nightly since it was fixed there. We'll check for similar progress on Aurora over the next several days. Thanks for the uplift.

Comment 23

[Tracy Walker [:tracy]]

No longer seeing reports of this on Aurora beyond 20121108 builds

Comment 24

[Jason Smith [:jsmith]]

Top crash regression affecting b2g = blocker