951258 - crash in @0x0 | mozilla::layers::AsyncPanZoomController::SampleContentTransformForFrame(mozilla::TimeStamp const&, mozilla::layers::ViewTransform*, mozilla::gfx::PointTyped<mozilla::ScreenPixel>&)

Status: RESOLVED DUPLICATE of bug 952116

(Core :: Panning and Zooming, defect)

Description

[Tony Nguyen]

This bug was filed from the Socorro interface and is 
report bp-2153c89f-c1d2-42ad-8f86-776a92131217.
=============================================================

This crash was found when scrolling down a website that had a lot of content quickly. I will investigate this issue further and attempt to provide more accurate repro steps.

Repro Steps: 
1. Updated Buri to BuildID: 20131217004001
2. Navigate to Browser App
3. Load to a website 
4. Scroll the page quickly as it is loading

Actual: Device crashes

Expected: Device doesn't crash

Environmental Variables:
Device: Buri v1.3 mozRIL
BuildID: 20131217004001
Gaia: dca0a3dcf062ce3e422a9c56d141c14543c816fb
Gecko: 1f7db4cc788e
Version: 28.0a2
RIL Version: 01.02.00.019.102

Comment 1

[Marcia Knous [:marcia]]

Tony: Can you please provide the URL where you hit the crash? Thanks.

Comment 2

[Tony Nguyen]

Marcia: The URL where I encountered the crash is www.itsbx.com. The website appears to have a lot of gifs and content on the main page being loaded. 

Note:
Viewer discretion is advised.

Comment 3

[Jason Smith [:jsmith]]

Leaving qawanted to see if this is possible to reproduce by using the target URL a few times in a row.

Comment 4

[Sarah Parsons]

I can reproduce this issue 5/5 attempts following the steps in comment 0 using the url that was provided in comment 2 on the Buri 1.3 Build ID:20131218004002

Gaia   a99b23e73fe5630a877004746d0e7fcec1b6d653
SourceStamp 369bdbff6c38
BuildID 20131218004002
Version 28.0a2

Comment 5

[Sarah Parsons]

This issue is reproduces on every 1.2 Build starting at the 6/12 build and this issue also reproduces on the Buri 1.1 Build ID: 20131217041201

Gaia   6ff3a607f873320d00cb036fa76117f6fadd010f
SourceStamp bdac595a4e46
BuildID 20131217041201
Version 18.0


Jason: Since this issue is occurring on 1.1, is it still a necessary to find a regression window?

Comment 6

[Jason Smith [:jsmith]]

Are we absolutely sure here that the crash seen on 1.1 & 1.2 is the same crash stack as this bug? Did you check the crash report URL?

Comment 7

[Kartikaya Gupta (email:[e-mail])]

Probably the same issue as bug 952116, at least on 1.3+. The code was different in 1.1 and 1.2 so I'm not sure that would be the same crash. I have a hypothesis and possible fix outlined at https://bugzilla.mozilla.org/show_bug.cgi?id=952116#c2 and https://bugzilla.mozilla.org/show_bug.cgi?id=952116#c3

Comment 8

[Kartikaya Gupta (email:[e-mail])]

Based on the crash data so far I believe this is fixed by bug 952116. Will wait to see if the signature disappears on aurora as well now that it has been uplifted.

Comment 9

[Sarah Parsons]

Attachment: 951258_dmesg

On today's 1.2 when scrolling www.itsbx.com I am not seeing the whole browser crash just the tab. I think this is a different issue than this bug because I am not getting a crash report but I am seeing an OOM in the dmesg log which I've attached. 

Gaia   724d36716bcbbc5cee1af18b94cc328c289d0ccc
SourceStamp 931864adcf68
BuildID 20131223004001
Version 26.0

Comment 10

[Jason Smith [:jsmith]]

Ok - that implies that crash only happens 1.3+.

Comment 11

[Kartikaya Gupta (email:[e-mail])]

I see no more crashes from this