876721 - crash in mozilla::gl::SharedSurface_ANGLEShareHandle::Create

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect)

Description

[Simona Badau, Desktop QA]

This bug was filed from the Socorro interface and is 
report bp-4ea3490a-08b4-42fb-8f19-e74a42130528 .
============================================================= 
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20130528 Firefox/24.0

Steps to reproduce:
1. Go to http://sam3dsnakegame.tk/
2. Load the game several times.

Results: At some point, while the game is loading - Firefox crashes.

Note: 
Reproduced the crash on Firefox 22 beta 2, on Aurora 23.a2 and on the latest Nightly.
I could not reproduce the crash on Firefox 21.

Reproduced the issue on Windows 7 x64 bit with the following specs:
Adapter Description:	NVIDIA GeForce GT 610
Adapter Drivers	nvd3dumx,nvwgf2umx,nvwgf2umx nvd3dum,nvwgf2um,nvwgf2um
Adapter RAM	1023
Device ID	0x104a
Direct2D Enabled	true
DirectWrite Enabled	true (6.2.9200.16492)
Driver Date	5-12-2013
Driver Version	9.18.13.2018
GPU #2 Active	false
GPU Accelerated Windows	1/1 Direct3D 10
Vendor ID	0x10de
WebGL Renderer	Google Inc. -- ANGLE (NVIDIA GeForce GT 610 Direct3D9Ex vs_3_0 ps_3_0)
windowLayerManagerRemote	false
AzureCanvasBackend	direct2d
AzureContentBackend	direct2d
AzureFallbackCanvasBackend	cairo

I could not reproduce the issue on a PC running with ATI Radeon HD 5450 video card.
I'm working on the regression range and I'll post it as soon as I get it.

Comment 1

[Scoobidiver (away)]

(In reply to Simona B [QA] from comment #0)
> Reproduced the crash on Firefox 22 beta 2, on Aurora 23.a2 and on the latest
> Nightly.
> I could not reproduce the crash on Firefox 21.
Confirmed by crash stats: https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Agl%3A%3ASharedSurface_ANGLEShareHandle%3A%3ACreate%28mozilla%3A%3Agl%3A%3AGLContext*%2C+ID3D10Device1*%2C+void*%2C+void*%2C+nsIntSize+const%26%2C+bool%29
First crash seen in 22.0a1/20130221.

Comment 2

[Simona Badau, Desktop QA]

(In reply to Scoobidiver from comment #1)
> First crash seen in 22.0a1/20130221.

The Nightly from 20130221 did not crash for me.
Unfortunately I could not determine the exact regression range and apparently I currently can't access the game from http://sam3dsnakegame.tk/ (hopefully I wasn't restricted in using the game).

Comment 3

[Simona Badau, Desktop QA]

This is the regression I got to after using the STR from the Description:

Last good build: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130321 Firefox/22.0, Build ID: 20130321030940

First bad build: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130322 Firefox/22.0, Build ID: 20130322031028

Pushlog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1d6fe70c79c5&tochange=0e9badd3cf39

Comment 4

[Scoobidiver (away)]

(In reply to Simona B [QA] from comment #3)
> Last good build: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130321
> Firefox/22.0, Build ID: 20130321030940
Are you sure of that?

Based on the stack trace, it's a regression from bug 716859 that landed in 22.0a1/20130222.

Comment 5

[Kelsey Gilbert [:jgilbert]]

This looks a lot like some flavor of OOM, so I could understand a seemingly unrelated change (GC change, especially) start to cause issues.

Comment 6

[Kelsey Gilbert [:jgilbert]]

Attachment: patch: Allow SwapProd to fail for ANGLE ShSurfs

Comment 7

[u279076]

Nominating for tracking since this is a regression in Firefox 22.

Comment 8

[Lukas Blakk [:lsblakk] use ?needinfo]

Can this get landed soon so we can see if the volume of crashes decreases?

Comment 9

[Kelsey Gilbert [:jgilbert]]

It is blocked on its dependency.

Comment 10

[Kelsey Gilbert [:jgilbert]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1b9cbc30e085

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/1b9cbc30e085

Comment 12

[Scoobidiver (away)]

Uplift to Aurora and Beta as the tracking flags suggest?

Comment 13

[Alex Keybl [:akeybl]]

(In reply to Scoobidiver from comment #12)
> Uplift to Aurora and Beta as the tracking flags suggest?

Has this verifiably fixed the underlying issue? What's the risk/reward here?

Comment 14

[Kelsey Gilbert [:jgilbert]]

(In reply to Alex Keybl [:akeybl] (out till 6/10) from comment #13)
> (In reply to Scoobidiver from comment #12)
> > Uplift to Aurora and Beta as the tracking flags suggest?
> 
> Has this verifiably fixed the underlying issue? What's the risk/reward here?

It eliminates an unnecessary crash, but whether the rest of the browser handles the potential GPU OOM situation well is unknown.

Comment 15

[Kelsey Gilbert [:jgilbert]]

Comment on attachment 756888 [details] [diff] [review]
patch: Allow SwapProd to fail for ANGLE ShSurfs

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 716859
User impact if declined: Crash on Vista/Win7 if allocating a new ideal-typed frame fails.
Testing completed (on m-c, etc.): On m-c.
Risk to taking this patch (and alternatives if risky): Very low. It basically just removes the crash call.
String or IDL/UUID changes made by this patch: None.

Comment 16

[Alex Keybl [:akeybl]]

Comment on attachment 756888 [details] [diff] [review]
patch: Allow SwapProd to fail for ANGLE ShSurfs

Based upon our uncertainty about whether or not this is a better user experience, we'll take this on Aurora but not Beta. It's unfortunate that we're taking a regression, but it's manageable given where we are in the cycle.

Comment 17

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/f157e8898517

Comment 18

[Manuela Muntean [Away]]

Verified fixed with Firefox 23 beta 1 (build ID: 20130625125232) on a Win 7 64bit machine.

Loading the game in a few tabs doesn't cause a crash anymore, and the game works smoothly also.

Comment 19

[Manuela Muntean [Away]]

Verified fixed with Firefox 24 beta 1 (build ID: 20130806170643) on a Win 7 64bit machine.

Loading the game in a few tabs doesn't cause a crash, and the game works smoothly.