950731 - Firefox reliably crashes (in image decoding), when running WebGL game

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Dave Evans]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:25.0) Gecko/20100101 Firefox/25.0 (Beta/Release)
Build ID: 20131112160018

Steps to reproduce:

Run this game: http://apps.playcanvas.com/dave/goingaround/ld48

Play the game. (Click to start, then click to move through the rooms. Double click on items to interact, e.g. the fruit bowl, the toilet, the freezer)


Actual results:

Very soon into the game FF will crash.


Expected results:

The game should run without crashing the browser

Comment 1

[Alice0775 White]

bp-64a96eb1-4f98-4781-a801-1bb242131219
bp-edcf8715-9dcb-4e99-a5dc-b7b522131219

Comment 2

[Alice0775 White]

Regression window(m-i):
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/a9d6d86a8090
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20130704 Firefox/25.0 ID:20130704094644
Bad:
http://hg.mozilla.org/integration/mozilla-inbound/rev/77c0bebf47ed
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20130704 Firefox/25.0 ID:20130704114744
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=a9d6d86a8090&tochange=77c0bebf47ed


In local build
First bad: 6bc751e34867
Last Good: a9d6d86a8090

Regressed by: Bug 888499

Comment 3

[Lukas Blakk [:lsblakk] use ?needinfo]

Milan - can you find someone to look at this regression? It doesn't look to me like a chemspill driver, but leaving the tracking noms up until we know more.

Comment 4

[Wayne Mery (:wsmwk)]

#1 Mac crash for Firefox 26. Other signatures...

 RtlpWaitOnCriticalSection | RtlpDeCommitFreeBlock | PR_Lock | mozilla::image::RasterImage::FinishedSomeDecoding(mozilla::image::RasterImage::eShutdownIntent, mozilla::image::RasterImage::DecodeRequest*)
bp-9faea48e-15fd-4e2b-91eb-f25502131225

 cairo_surface_detach_snapshot
bp-deb75156-1406-455d-8cbb-559962131224

Android PR_Lock | imgFrame::ApplyDirtToSurfaces()  bp-fbdfa188-47ea-4bc9-a8a9-2d87f2131225

Comment 5

[Milan Sreckovic [:milan] (needinfo for best results)]

Based on the regression range, it's the off main thread image animation that Seth has been maintaining.  CC-ing :jgilbert because of STR.

Comment 6

[Lukas Blakk [:lsblakk] use ?needinfo]

At this point we would not chemspill FF26 for this, but tracking for later versions so we keep an eye on mac volume and hopefully find either a backout or a low risk forward fix in the next couple of weeks of FF27 (beta 4 going to build in a couple of days from now).

Comment 7

[Daniel Holbert [:dholbert][mostly away until Oct 6]]

Attachment: backtrace of ABORT_IF_FALSE

In a debug build, the STR trigger:
{
###!!! ABORT: Asked to discard with open decoder!: '!mDecoder', file /mozilla-central/image/src/RasterImage.cpp, line 1876
}

Here's the backtrace of that abort.

Comment 8

[bhavana bajaj [:bajaj]]

Jeff, since :seth is away and this is releiably reproducible top-crash ,tracking for Firefox 27 which is going to be release in a few weeks, can you please help?

Comment 9

[Daniel Holbert [:dholbert][mostly away until Oct 6]]

(Alternately, bholley might also be able to help, since he added the abort quoted in comment 7, though that was ~3 years ago).

MXR link to the abort, for reference:
 http://mxr.mozilla.org/mozilla-central/source/image/src/RasterImage.cpp?rev=5a9badd6db00#1876

Comment 10

[Bobby Holley (:bholley)]

I'm not working on imagelib anymore. We should probably get someone who is to look at this.

Comment 11

[Timothy Nikkel (:tnikkel)]

(In reply to Daniel Holbert [:dholbert] from comment #7)
> Created attachment 8356741 [details]
> backtrace of ABORT_IF_FALSE
> 
> In a debug build, the STR trigger:
> {
> ###!!! ABORT: Asked to discard with open decoder!: '!mDecoder', file
> /mozilla-central/image/src/RasterImage.cpp, line 1876
> }
> 
> Here's the backtrace of that abort.

This sounds like the same issue as bug 943803.

Comment 12

[Timothy Nikkel (:tnikkel)]

Bug 943803 should have fixed this. If not please say so.

Comment 13

[bhavana bajaj [:bajaj]]

(In reply to Dave Evans from comment #0)
> User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:25.0)
> Gecko/20100101 Firefox/25.0 (Beta/Release)
> Build ID: 20131112160018
> 
> Steps to reproduce:
> 
> Run this game: http://apps.playcanvas.com/dave/goingaround/ld48
> 
> Play the game. (Click to start, then click to move through the rooms. Double
> click on items to interact, e.g. the fruit bowl, the toilet, the freezer)
> 
> 
> Actual results:
> 
> Very soon into the game FF will crash.
> 
> 
> Expected results:
> 
> The game should run without crashing the browser

Hi Dave, can you confirm this is fixed for you now by trying our latest beta,aurora or nightly build ?

Comment 14

[Dave Evans]

Just tested in Aurora and latest Beta on OS X.

No crashes, seems to be fixed. :-) Thanks!

(In reply to bhavana bajaj [:bajaj] from comment #13)
> (In reply to Dave Evans from comment #0)
> > User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:25.0)
> > Gecko/20100101 Firefox/25.0 (Beta/Release)
> > Build ID: 20131112160018
> > 
> > Steps to reproduce:
> > 
> > Run this game: http://apps.playcanvas.com/dave/goingaround/ld48
> > 
> > Play the game. (Click to start, then click to move through the rooms. Double
> > click on items to interact, e.g. the fruit bowl, the toilet, the freezer)
> > 
> > 
> > Actual results:
> > 
> > Very soon into the game FF will crash.
> > 
> > 
> > Expected results:
> > 
> > The game should run without crashing the browser
> 
> Hi Dave, can you confirm this is fixed for you now by trying our latest
> beta,aurora or nightly build ?

Comment 15

[Timothy Nikkel (:tnikkel)]

Thanks.

Comment 16

[Ashickur Rahman]

I check the fixed. It works for me on both firefox 27, 28 and 29.