Firefox reliably crashes (in image decoding), when running WebGL game

VERIFIED FIXED in Firefox 27

Status

()

--
critical
VERIFIED FIXED
5 years ago
5 years ago

People

(Reporter: dave, Assigned: seth)

Tracking

(4 keywords)

25 Branch
mozilla29
crash, regression, reproducible, topcrash-mac
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox26- wontfix, firefox27+ verified, firefox28+ verified, firefox29+ verified, firefox-esr24 unaffected)

Details

(Whiteboard: [bugday-20140122], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:25.0) Gecko/20100101 Firefox/25.0 (Beta/Release)
Build ID: 20131112160018

Steps to reproduce:

Run this game: http://apps.playcanvas.com/dave/goingaround/ld48

Play the game. (Click to start, then click to move through the rooms. Double click on items to interact, e.g. the fruit bowl, the toilet, the freezer)


Actual results:

Very soon into the game FF will crash.


Expected results:

The game should run without crashing the browser

Comment 1

5 years ago
bp-64a96eb1-4f98-4781-a801-1bb242131219
bp-edcf8715-9dcb-4e99-a5dc-b7b522131219
Severity: normal → critical
Status: UNCONFIRMED → NEW
Crash Signature: [@ RtlEnterCriticalSection | PR_Lock | imgFrame::ApplyDirtToSurfaces() ]
status-firefox28: --- → ?
status-firefox-esr24: --- → unaffected
tracking-firefox26: --- → ?
tracking-firefox27: --- → ?
tracking-firefox28: --- → ?
tracking-firefox29: --- → ?
Component: Untriaged → ImageLib
Ever confirmed: true
OS: Mac OS X → All
Product: Firefox → Core

Comment 2

5 years ago
Regression window(m-i):
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/a9d6d86a8090
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20130704 Firefox/25.0 ID:20130704094644
Bad:
http://hg.mozilla.org/integration/mozilla-inbound/rev/77c0bebf47ed
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20130704 Firefox/25.0 ID:20130704114744
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=a9d6d86a8090&tochange=77c0bebf47ed


In local build
First bad: 6bc751e34867
Last Good: a9d6d86a8090

Regressed by: Bug 888499
Blocks: 888499
Keywords: regression

Updated

5 years ago
Keywords: crash, reproducible
Milan - can you find someone to look at this regression? It doesn't look to me like a chemspill driver, but leaving the tracking noms up until we know more.
Assignee: nobody → milan
Flags: needinfo?(milan)

Comment 4

5 years ago
#1 Mac crash for Firefox 26. Other signatures...

 RtlpWaitOnCriticalSection | RtlpDeCommitFreeBlock | PR_Lock | mozilla::image::RasterImage::FinishedSomeDecoding(mozilla::image::RasterImage::eShutdownIntent, mozilla::image::RasterImage::DecodeRequest*)
bp-9faea48e-15fd-4e2b-91eb-f25502131225

 cairo_surface_detach_snapshot
bp-deb75156-1406-455d-8cbb-559962131224

Android PR_Lock | imgFrame::ApplyDirtToSurfaces()  bp-fbdfa188-47ea-4bc9-a8a9-2d87f2131225
Crash Signature: [@ RtlEnterCriticalSection | PR_Lock | imgFrame::ApplyDirtToSurfaces() ] → [@ RtlEnterCriticalSection | PR_Lock | imgFrame::ApplyDirtToSurfaces() ] [@ PR_Lock | imgFrame::ApplyDirtToSurfaces()] [@ RtlpWaitOnCriticalSection | RtlpDeCommitFreeBlock | PR_Lock | mozilla::image::RasterImage::FinishedSomeDecoding(mozilla::image::Ra…
Based on the regression range, it's the off main thread image animation that Seth has been maintaining.  CC-ing :jgilbert because of STR.
Assignee: milan → seth
Flags: needinfo?(milan)
At this point we would not chemspill FF26 for this, but tracking for later versions so we keep an eye on mac volume and hopefully find either a backout or a low risk forward fix in the next couple of weeks of FF27 (beta 4 going to build in a couple of days from now).
status-firefox26: --- → affected
status-firefox27: --- → affected
status-firefox28: ? → affected
status-firefox29: --- → affected
tracking-firefox26: ? → -
tracking-firefox27: ? → +
tracking-firefox28: ? → +
tracking-firefox29: ? → +
Keywords: topcrash-mac
Created attachment 8356741 [details]
backtrace of ABORT_IF_FALSE

In a debug build, the STR trigger:
{
###!!! ABORT: Asked to discard with open decoder!: '!mDecoder', file /mozilla-central/image/src/RasterImage.cpp, line 1876
}

Here's the backtrace of that abort.
Jeff, since :seth is away and this is releiably reproducible top-crash ,tracking for Firefox 27 which is going to be release in a few weeks, can you please help?
Flags: needinfo?(jmuizelaar)
(Alternately, bholley might also be able to help, since he added the abort quoted in comment 7, though that was ~3 years ago).

MXR link to the abort, for reference:
 http://mxr.mozilla.org/mozilla-central/source/image/src/RasterImage.cpp?rev=5a9badd6db00#1876
Hardware: x86 → All
Summary: Firefox reliably crashes running WebGL game. → Firefox reliably crashes (in image decoding), when running WebGL game
I'm not working on imagelib anymore. We should probably get someone who is to look at this.
(In reply to Daniel Holbert [:dholbert] from comment #7)
> Created attachment 8356741 [details]
> backtrace of ABORT_IF_FALSE
> 
> In a debug build, the STR trigger:
> {
> ###!!! ABORT: Asked to discard with open decoder!: '!mDecoder', file
> /mozilla-central/image/src/RasterImage.cpp, line 1876
> }
> 
> Here's the backtrace of that abort.

This sounds like the same issue as bug 943803.
Bug 943803 should have fixed this. If not please say so.
Flags: needinfo?(jmuizelaar)
(In reply to Dave Evans from comment #0)
> User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:25.0)
> Gecko/20100101 Firefox/25.0 (Beta/Release)
> Build ID: 20131112160018
> 
> Steps to reproduce:
> 
> Run this game: http://apps.playcanvas.com/dave/goingaround/ld48
> 
> Play the game. (Click to start, then click to move through the rooms. Double
> click on items to interact, e.g. the fruit bowl, the toilet, the freezer)
> 
> 
> Actual results:
> 
> Very soon into the game FF will crash.
> 
> 
> Expected results:
> 
> The game should run without crashing the browser

Hi Dave, can you confirm this is fixed for you now by trying our latest beta,aurora or nightly build ?
(Reporter)

Comment 14

5 years ago
Just tested in Aurora and latest Beta on OS X.

No crashes, seems to be fixed. :-) Thanks!

(In reply to bhavana bajaj [:bajaj] from comment #13)
> (In reply to Dave Evans from comment #0)
> > User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:25.0)
> > Gecko/20100101 Firefox/25.0 (Beta/Release)
> > Build ID: 20131112160018
> > 
> > Steps to reproduce:
> > 
> > Run this game: http://apps.playcanvas.com/dave/goingaround/ld48
> > 
> > Play the game. (Click to start, then click to move through the rooms. Double
> > click on items to interact, e.g. the fruit bowl, the toilet, the freezer)
> > 
> > 
> > Actual results:
> > 
> > Very soon into the game FF will crash.
> > 
> > 
> > Expected results:
> > 
> > The game should run without crashing the browser
> 
> Hi Dave, can you confirm this is fixed for you now by trying our latest
> beta,aurora or nightly build ?
Thanks.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Depends on: 943803
Resolution: --- → FIXED
status-firefox26: affected → wontfix
status-firefox27: affected → fixed
status-firefox28: affected → fixed
status-firefox29: affected → fixed
Target Milestone: --- → mozilla29

Comment 16

5 years ago
I check the fixed. It works for me on both firefox 27, 28 and 29.
status-firefox27: fixed → verified
status-firefox28: fixed → verified
status-firefox29: fixed → verified
Whiteboard: [bugday-20140122]

Updated

5 years ago
Status: RESOLVED → VERIFIED

Updated

5 years ago
Duplicate of this bug: 966366
You need to log in before you can comment on or make changes to this bug.