734948 - Various crashes with gfx.content.azure.enabled

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect)

Description

[Alistair Vining]

Since the Azure-Thebes wrapper was landed back in January, Nightly crashes for me about every 24 hours with gfx.content.azure.enabled set to true, about 30 times in total, latest crash report bp-694e59aa-244a-42f5-af3a-1f9002120312 .  There is no specific site that seems to trigger it.

With gfx.content.azure.enabled set back to false for a month, I saw no crashes; in safe mode I see no crashes (presumably because acceleration is disabled).  I have tried disabling all plugins or all extensions but still see crashes.

Sometimes I see graphical corruption before crashing as bug 717457, but not always.

Adapter Description: Intel(R) HD Graphics
Vendor ID: 0x8086
Device ID: 0x0102
Adapter RAM: Unknown
Adapter Drivers: igdumd64 igd10umd64 igd10umd64 igdumd32 igd10umd32 igd10umd32
Driver Version: 8.15.10.2653
Driver Date: 2-14-2012
Direct2D Enabled: true
DirectWrite Enabled: true (6.1.7601.17563)
ClearType Parameters: ClearType parameters not found
WebGL Renderer: Google Inc. -- ANGLE (Intel(R) HD Graphics) -- OpenGL ES 2.0 (ANGLE 1.0.0.963)
GPU Accelerated Windows: 1/1 Direct3D 10
AzureBackend: direct2d

Comment 1

[Scoobidiver (away)]

(In reply to Alistair Vining from comment #0)
> Since the Azure-Thebes wrapper was landed back in January, Nightly crashes
> for me about every 24 hours with gfx.content.azure.enabled set to true,
> about 30 times in total
I see only 3 crash reports with this kind of crash signature:
https://crash-stats.mozilla.com/query/query?product=Firefox&version=ALL%3AALL&range_value=4&range_unit=weeks&query_search=signature&query_type=contains&query=D2DFactoryLocking&reason=&build_id=&process_type=any&hang_type=any&do_query=1

Can you provide other crash reports?

Comment 2

[Alistair Vining]

I was assuming that they were all related, maybe this is several bugs, but I will list every crash since January.  I see that I noted one crash was immediately after waking the computer from sleep, and I've felt that on other occasions, but since I can never reproduce the crash, it's hard to know.

bp-694e59aa-244a-42f5-af3a-1f9002120312
[@ xul.dll@0x91d314 | xul.dll@0x3ad0e8 | xul.dll@0x2702f2 | xul.dll@0x8efad | xul.dll@0xe4b80 | D2DFactoryLocking<MultiThreadedTrait>::Leave() ]

bp-b8e10c33-be0a-47bf-979e-cab352120312
[@ xul.dll@0x4b56d2 | xul.dll@0x36f401 | xul.dll@0xe8751 ] 

bp-711f41d7-1308-4527-9244-2cd132120309
[@ xul.dll@0x4b6b6b | xul.dll@0x36f1d5 | xul.dll@0x399f69 | xul.dll@0x600bf | ... | ... | _GetClientRect | GetClientRect | xul.dll@0x5c604 ]

bp-51f1212c-d47c-44c8-881e-b19c02120308
[@ xul.dll@0x91ae44 | xul.dll@0x7d92b2 | xul.dll@0x7d93ef | xul.dll@0x3aa66b | xul.dll@0x13c2d8 | xul.dll@0x1685ac ] 

bp-7e0c17b9-7749-4ac6-9bea-4f1a92120308
[@ xul.dll@0x4b5e63 | xul.dll@0x36dff7 | xul.dll@0x145e79 ]

bp-e2d83663-24d5-4da7-a0b0-c64d22120229
[@ xul.dll@0x91a5a0 | xul.dll@0x3bc013 | xul.dll@0x27254e | xul.dll@0x1b18f1 | xul.dll@0x79260 | DrawingContext::PushAxisAlignedClip(D2D_RECT_F const*, D2D1_ANTIALIAS_MODE) ]

bp-445b852a-bd43-4abd-90da-be46f2120228
[@ xul.dll@0x4aef6d | xul.dll@0x410074 | xul.dll@0x4101e9 | xul.dll@0x9cc3c | ... | ... | _GetClientRect | GetClientRect | xul.dll@0xb4de5 ] 

bp-b5012ecb-7629-4dd0-bbe7-c58472120228
[@ xul.dll@0x8f6e44 | xul.dll@0x40f8ac | xul.dll@0x26cdbf | xul.dll@0x126661 ]

bp-44008e23-aaa5-482b-8117-7fba52120227
[@ EMPTY: no crashing thread identified; corrupt dump ] 

bp-cbd5e32e-b8ca-4e4b-8b78-075ab2120227
[@ xul.dll@0x4b72d3 | xul.dll@0x36ff8e | xul.dll@0x3958c5 | xul.dll@0x94e5c | ... | ... | _GetClientRect | GetClientRect | xul.dll@0x1dda59 ] 

bp-34de56d2-d690-4cf2-b48f-6f0442120226
[@ xul.dll@0x8f6ead | xul.dll@0x40f45a | xul.dll@0x26bb50 | xul.dll@0xb07c1 ] 

bp-b21a529e-ea78-4e70-b872-047c22120224
[@ xul.dll@0x918a82 | xul.dll@0x7f0a8d | xul.dll@0x7f0bc1 | xul.dll@0x3b8c7b | xul.dll@0x1c5488 | xul.dll@0x1ee26c ] 

bp-dcbea4e3-b252-42ca-9bb5-a3fa82120223
[@ xul.dll@0x916875 | xul.dll@0x3b92f5 | xul.dll@0x26fa08 | xul.dll@0x1da804 | xul.dll@0x16efb0 | D2DFactoryLocking<MultiThreadedTrait>::Leave() ] 

bp-3dc7d783-57de-4e22-b4d2-218af2120223
[@ xul.dll@0x916875 | xul.dll@0x3b92f5 | xul.dll@0x26fa08 | xul.dll@0x1da804 | xul.dll@0x16efb0 | D2DFactoryLocking<MultiThreadedTrait>::Leave() ] 

bp-77739cd2-9222-4793-8d3d-895322120222
[@ EMPTY: no crashing thread identified; corrupt dump ]

bp-909d1548-752b-400a-9187-42cad2120222
[@ xul.dll@0x9174de | xul.dll@0x7eefbb | xul.dll@0x7ef0ef | xul.dll@0x3b64aa | xul.dll@0x17f0f8 | xul.dll@0x191a9c ] 

bp-44c0859a-2e25-463d-8edf-a0e972120221
[@ xul.dll@0x916a17 | xul.dll@0x7f36ac | xul.dll@0x7f37da | xul.dll@0x3b76fd | xul.dll@0x73fa0 | DrawingContext::PushAxisAlignedClip(D2D_RECT_F const*, D2D1_ANTIALIAS_MODE) ] 

bp-57775603-364d-4df6-a06e-f6c032120221
[@ xul.dll@0x916a17 | xul.dll@0x7f36ac | xul.dll@0x7f37da | xul.dll@0x3b76fd | xul.dll@0x73fa0 | DrawingContext::PushAxisAlignedClip(D2D_RECT_F const*, D2D1_ANTIALIAS_MODE) ] 

bp-08b5275a-f604-47cc-94b1-f56242120220
[@ xul.dll@0x4b44ce | xul.dll@0x36cf5c | xul.dll@0x391f7c | xul.dll@0x17ff71 | ... | ... | _GetClientRect | GetClientRect | xul.dll@0x54a4d ] 

bp-80cae1d5-7cd7-4613-9b2e-932242120219
[@ xul.dll@0x4b6b78 | xul.dll@0x36ebd3 | xul.dll@0x393563 | xul.dll@0x1b8292 | ... | ... | _GetClientRect | GetClientRect | xul.dll@0xa05dd ] 

bp-3408a9b5-2489-4561-820a-5579b2120126
[@ xul.dll@0x8da431 | xul.dll@0x887712 | xul.dll@0x88e89b | xul.dll@0x406f33 | DrawingContext::PushAxisAlignedClip(D2D_RECT_F const*, D2D1_ANTIALIAS_MODE) ] 

bp-37bade15-743c-4380-b1c7-582b92120125
[@ xul.dll@0x4a2f45 | xul.dll@0x35dcf4 | xul.dll@0x1b6180 ] 

bp-e91bdc75-1725-4aec-a349-6e4662120124
[@ EMPTY: no crashing thread identified; corrupt dump ] 

bp-61b19d08-30f3-41f0-89ab-1e3202120120
[@ xul.dll@0x8f5bb5 | xul.dll@0x788b2c | xul.dll@0x788c5e | xul.dll@0x381464 | xul.dll@0x132ecc | xul.dll@0x130000 | xul.dll@0x15b81e ] 

bp-e5557eec-4087-4bb8-8546-18fb42120119
[@ igd10umd32.dll@0x8d2a68 ]
** unrelated: Bug 719136 **

bp-f3e433c3-96e3-4a24-9d08-934272120118
[@ xul.dll@0x8eef11 | xul.dll@0x783e7a | xul.dll@0x783fac | xul.dll@0x37f498 | xul.dll@0xd371c | xul.dll@0xd0000 | xul.dll@0xb7e9e ] 

bp-3394b5bd-86b9-49ba-a02a-e480c2120117
[@ xul.dll@0x8ee51d | xul.dll@0x796056 | xul.dll@0x796186 | xul.dll@0x3b4beb ] 

bp-8a281588-655e-400f-9f54-4c5172120115
[@ xul.dll@0x8d5585 | xul.dll@0x771aa6 | xul.dll@0x771bd8 | xul.dll@0x3ffdfb | xul.dll@0x62dec | xul.dll@0x100000 | xul.dll@0x12772e ] 

bp-453bfbf3-33dd-4b29-8201-493432120113
[@ xul.dll@0x8f32a9 | xul.dll@0x79acc5 | xul.dll@0x79adf5 | xul.dll@0x3ba81f | DrawingContext::PushAxisAlignedClip(D2D_RECT_F const*, D2D1_ANTIALIAS_MODE) ] 

bp-ab22d303-59c4-4fbb-b868-73b1a2120113
[@ xul.dll@0x8f32a9 | ... | DrawingContext::PushAxisAlignedClip ] 

bp-4c1f89dd-af0b-439b-8097-5d69d2120112
[@ xul.dll@0x8f3ca7 | ... | xul.dll@0x1740ae ]

bp-2315b0f0-5404-40a4-91fc-26fb82120112
[@ xul.dll@0x49fc20 | ... | @0x3fffffff ] 

bp-c04e71e9-d48e-4b81-8a30-68de92120111
[@ xul.dll@0x8d460e | ... | DrawingContext::PushAxisAlignedClip ]

Comment 3

[Scoobidiver (away)]

Crash signatures containing DrawingContext::PushAxisAlignedClip and D2DFactoryLocking<MultiThreadedTrait>::Leave are probably related. For others with only XUL, we can't conclude.
Do you have reliable steps to reproduce in order to get a valid stacktrace with a debugger?

Comment 4

[Alistair Vining]

Attachment: WinDbg output

I still have no reliable steps to reproduce, but I had a go with WinDbg and managed to get it to crash under the debugger just with random browsing.  There are various problems with ntdll32!LdrpDoDebuggerBreak at the beginning and (I think) with plugin-container processes closing themselves, and I interrupted the first '|* ~* kp' command, but it seems to make sense at the end.

Comment 5

[Scoobidiver (away)]

The stacktrace in the log has the gfxContext::PushClipsToDT signature but doesn't contain d2d1.dll so it's probably related to XUL signatures in comment 2.

More reports at:
https://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=gfxContext%3A%3APushClipsToDT%28mozilla%3A%3Agfx%3A%3ADrawTarget*%29

Comment 6

[Alistair Vining]

Attachment: WinDbg log - crash @ gfxPlatform::GetSourceSurfaceForSurface

Over the last week, several crashes with the same signature as previously, but a couple of new ones.  The first...

[@ gfxPlatform::GetSourceSurfaceForSurface(DrawTarget *aTarget, gfxASurface *aSurface)]

PRIMARY_PROBLEM_CLASS:  NULL_CLASS_PTR_WRITE
http://mxr.mozilla.org/mozilla-central/source/gfx/thebes/gfxPlatform.cpp#548

Comment 7

[Alistair Vining]

Attachment: WinDbg log - crash @ _d2d_compute_bitmap_mem_size

... and the second.

[@ _d2d_compute_bitmap_mem_size(ID2D1Bitmap *bitmap)]

PRIMARY_PROBLEM_CLASS:  NULL_POINTER_READ_BEFORE_CALL
http://mxr.mozilla.org/mozilla-central/source/gfx/cairo/cairo/src/cairo-d2d-surface.cpp#1199

Comment 8

[Gary [:streetwolf52]]

Clicking on this large picture will cause a crash when gfx.content.azure.enabled is set to True: 

http://en.wikipedia.org/wiki/File:Messier_81_HST.jpg

When set to False no crash.

Comment 9

[Gary [:streetwolf52]]

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20120329 Firefox/14.0a1

Build: http://hg.mozilla.org/mozilla-central/rev/af214ef4172e

Comment 10

[Scoobidiver (away)]

I filed bug 740817 for comment 8.

Comment 11

[Scoobidiver (away)]

Alistair, does Firefox still crash?

Comment 12

[Alistair Vining]

No, for me this bug was fixed with the checkin of 2012-05-30 mentioned in bug 758531 -- I have seen exactly zero similar crashes since, but left this bug open for a while as other comments said they were still happening occasionally.  Then forgot about it.