1026893 - crash in @0x0 | CContext::ID3D11DeviceContext1_SetSamplers_<int, 5>(ID3D11DeviceContext1*, unsigned int, unsigned int, ID3D11SamplerState* const*)

Status: VERIFIED FIXED

(Core :: Graphics: Layers, defect)

Description

[juan becerra [:juanb]]

This bug was filed from the Socorro interface and is 
report bp-9b33f29a-d34b-4cc5-90a6-8443d2140615.
=============================================================

This is a startup crash currently in the top #20 in the list of top crashers for Fx32 Aurora. All of these are in Windows 7. Mostly dupes.

More reports here: https://crash-stats.mozilla.com/report/list?product=Firefox&signature=%400x0+%7C+CContext%3A%3AID3D11DeviceContext1_SetSamplers_%3Cint%2C+5%3E%28ID3D11DeviceContext1%2A%2C+unsigned+int%2C+unsigned+int%2C+ID3D11SamplerState%2A+const%2A%29

0 		@0x0 	
1 	d3d11.dll 	CContext::ID3D11DeviceContext1_SetSamplers_<4,5>(ID3D11DeviceContext1 *,unsigned int,unsigned int,ID3D11SamplerState * const *) 	
2 	d3d11.dll 	CContext::InitializeDefaults() 	
3 	d3d11.dll 	CDevice::LLOCompleteLayerConstruction() 	
4 	d3d11.dll 	CBridgeImpl<ILayeredLockOwner,ID3D11LayeredDevice,CLayeredObject<CDevice> >::LLOCompleteLayerConstruction() 	
5 	d3d11.dll 	NDXGI::CDevice::LLOCompleteLayerConstruction() 	
6 	d3d11.dll 	CBridgeImpl<ILayeredLockOwner,ID3D11LayeredDevice,CLayeredObject<NDXGI::CDevice> >::LLOCompleteLayerConstruction() 	
7 	d3d11.dll 	NOutermost::CDevice::LLOCompleteLayerConstruction() 	
8 	d3d11.dll 	NOutermost::CDevice::FinalConstruct(NOutermost::CDevice::TConstructorArgs const &) 	
9 	d3d11.dll 	TComObject<NOutermost::CDevice>::TComObject<NOutermost::CDevice>(void *,NOutermost::CDevice::TConstructorArgs const &,_GUID const &,void * *) 	
10 	d3d11.dll 	TComObject<NOutermost::CDevice>::CreateInstance(NOutermost::CDevice::TConstructorArgs const &,void *,void *,_GUID const &,void * *) 	
11 	d3d11.dll 	D3D11CreateLayeredDevice(unsigned int,void const *,unsigned long,ID3D11LayeredDevice *,_GUID const &,void * *) 	
12 	d3d11.dll 	D3D11CoreCreateLayeredDevice 	
13 	d3d11.dll 	D3D11CoreCreateDevice 	
14 	d3d11.dll 	D3D11CreateDeviceAndSwapChain 	
15 	d3d11.dll 	D3D11CreateDevice 	
16 	xul.dll 	gfxWindowsPlatform::GetD3D11Device() 	gfx/thebes/gfxWindowsPlatform.cpp
17 	xul.dll 	mozilla::layers::CompositorD3D11::Initialize() 	gfx/layers/d3d11/CompositorD3D11.cpp
18 	xul.dll 	mozilla::layers::CompositorParent::InitializeLayerManager(nsTArray<mozilla::layers::LayersBackend> const &) 	gfx/layers/ipc/CompositorParent.cpp
19 	xul.dll 	mozilla::layers::CompositorParent::AllocPLayerTransactionParent(nsTArray<mozilla::layers::LayersBackend> const &,unsigned __int64 const &,mozilla::layers::TextureFactoryIdentifier *,bool *) 	gfx/layers/ipc/CompositorParent.cpp
20 	xul.dll 	mozilla::layers::PCompositorParent::OnMessageReceived(IPC::Message const &,IPC::Message * &) 	obj-firefox/ipc/ipdl/PCompositorParent.cpp
21 	xul.dll 	mozilla::ipc::MessageChannel::DispatchSyncMessage(IPC::Message const &) 	ipc/glue/MessageChannel.cpp
22 	xul.dll 	mozilla::ipc::MessageChannel::DispatchMessageW(IPC::Message const &) 	ipc/glue/MessageChannel.cpp
23 	xul.dll 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	ipc/glue/MessageChannel.cpp
24 	xul.dll 	MessageLoop::RunTask(Task *) 	ipc/chromium/src/base/message_loop.cc
25 	xul.dll 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const &) 	ipc/chromium/src/base/message_loop.cc
26 	xul.dll 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
27 	xul.dll 	base::MessagePumpDefault::Run(base::MessagePump::Delegate *) 	ipc/chromium/src/base/message_pump_default.cc
28 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
29 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
30 	xul.dll 	base::Thread::ThreadMain() 	ipc/chromium/src/base/thread.cc
31 	xul.dll 	`anonymous namespace'::ThreadFunc(void *) 	ipc/chromium/src/base/platform_thread_win.cc
32 	kernel32.dll 	BaseThreadInitThunk 	
33 	ntdll.dll 	__RtlUserThreadStart 	
34 	ntdll.dll 	_RtlUserThreadStart

Comment 1

[Makoto Kato [:m_kato]]

Now this is top 3 crash of Firefox 33.  This depends on Intel GPU driver.  Should we add this driver / version to block list?

Comment 2

[Robert Kaiser]

Bug 1021265 is also connected.

Comment 3

[Tracy Walker [:tracy]]

A slight variation.

@0x0 | CContext::ID3D11DeviceContext1_SetSamplers_<int, 1>(ID3D11DeviceContext1*, unsigned int, unsigned int, ID3D11SamplerState* const*)

Combined, these two startup crashers account for 5% of all crashes on Fx 33.

Comment 4

[Tracy Walker [:tracy]]

and another slight variation

@0x0 | CContext::ID3D11DeviceContext_SetSamplers_<int, 5>(ID3D11DeviceContext*, unsigned int, unsigned int, ID3D11SamplerState* const*)

Comment 5

[Sylvestre Ledru [:Sylvestre]]

Nicolas, Bas, can you help here? Looks it is critical.

Comment 6

[Bas Schouten (:bas.schouten)]

Is there a driver correlation here? This is the CreateDevice call, when this crashes there's not much we can do? We'll have to blacklist.

Comment 7

[Tracy Walker [:tracy]]

Graphics Adapter Report: The number of crashes for a particular signature by graphics vendor and chipset. Vendor 	Adapter 	Report Count 	Percentage
0x8086 	0x0116	1080 	55.756 %
0x8086 	0x0102	403 	20.805 %
0x8086 	0x0126	373 	19.257 %
0x8086 	0x0106	71 	3.665 %
0x8086 	0x0112	8 	0.413 %
0x8086 	0x010a	1 	0.052 %
0x8086 	0x0122	1 	0.052 %

Comment 8

[Jeff Muizelaar [:jrmuizel]]

QA, is it possible to find a way to reproduce this problem? It's very mysterious and we don't really have much to go on.

Comment 9

[Jeff Muizelaar [:jrmuizel]]

Those devices are all Intel Sandy Bridge. Is there a driver version correlation?

Comment 10

[Tracy Walker [:tracy]]

My super search skills aren't deft enough to pull out that information.

A brief random sampling of crash reports initially shows (it's not a comprehensive list):

AdapterVendorID: 0x8086, AdapterDeviceID: 0x0102, AdapterSubsysID: 1497103c, AdapterDriverVersion: 9.17.10.3062
D2D? D2D+ DWrite? DWrite+ 

AdapterVendorID: 0x8086, AdapterDeviceID: 0x0126, AdapterSubsysID: 21cf17aa, AdapterDriverVersion: 9.17.10.2843
D2D? D2D+ DWrite? DWrite+ D3D11 Layers? D3D11 Layers+ 

AdapterVendorID: 0x8086, AdapterDeviceID: 0x0116, AdapterSubsysID: 21ce17aa, AdapterDriverVersion: 9.17.10.3347
D2D? D2D+ DWrite? DWrite+ 

bsmedberg, is there a way to get better diver correlations here?

Comment 11

[Benjamin Smedberg]

Not strict correlations, but:

https://crash-stats.mozilla.com/search/?signature=~CContext%3A%3AID3D11DeviceContext&_facets=signature&_facets=adapter_vendor_id&_facets=adapter_driver_version&_columns=date&_columns=signature&_columns=product&_columns=build_id&_columns=platform

97% intel graphics cards
A bunch of driver versions in the 8.15.*-9.17.* range.

Comment 12

[Bas Schouten (:bas.schouten)]

Attachment: Bandaid to catch crashes and deal with them

Comment 13

[Sylvestre Ledru [:Sylvestre]]

Jeff, could you review this patch asap? We need it for 33.0.1 Thanks

Comment 14

[Sylvestre Ledru [:Sylvestre]]

Thanks Jeff


Like for bug 1083071, I would like this patch in both mozilla-release and mozilla-release branch GECKO330_2014101104_RELBRANCH

Comment 15

[Carsten Book [:Tomcat]]

remote:   https://hg.mozilla.org/releases/mozilla-release/rev/b9e31f93e53c for release
and
https://hg.mozilla.org/releases/mozilla-release/rev/efe12ab0e9ac for the relbranch

Comment 16

[Lawrence Mandel [:lmandel] (use needinfo)]

I'm assuming that all branches are affected and that we're going to want to land the fix everywhere (may not be the case).

Comment 17

[Lawrence Mandel [:lmandel] (use needinfo)]

We took your band-aid patch on release. Should we land it on m-c, aurora, and beta as well?

Comment 18

[Lawrence Mandel [:lmandel] (use needinfo)]

Meant to ni Bas but I'll leave the ni in Jeff in case he can answer.

Comment 19

[Liz Henry (:lizzard) (relman/hg->git project)]

This is still showing up in 34.0b, at a pretty low rate of ~50-60 crashes per beta release cycle. But since it's a startup crash I still think that's significant.

Comment 20

[Jeff Muizelaar [:jrmuizel]]

Yes. I guess let's land this on all of the other places.

Comment 21

[Lawrence Mandel [:lmandel] (use needinfo)]

Comment on attachment 8507035 [details] [diff] [review]
Bandaid to catch crashes and deal with them

This shipped in 33. It needs to land on 34, 35, and 36. 

Bas - Can you please handle the landings yourself on Wed?

Comment 22

[Ryan VanderMeulen [:RyanVM]]

This needs rebasing around bug 1092260.

Comment 23

[Liz Henry (:lizzard) (relman/hg->git project)]

Bas can you help with this, since Jeff is on PTO?

Comment 24

[Milan Sreckovic [:milan] (needinfo for best results)]

I'll get you the rebased patch shortly.

Comment 25

[Milan Sreckovic [:milan] (needinfo for best results)]

Attachment: Bandaid to catch crashes... beta patch. r=jmuizelaar

Comment 26

[Milan Sreckovic [:milan] (needinfo for best results)]

Attachment: Catch exceptions during D3D11 initialization. Trunk patch. Carry r=jmuizelaar

Bas, can you confirm this is the right patch for the trunk?

Comment 27

[Bas Schouten (:bas.schouten)]

Comment on attachment 8527888 [details] [diff] [review]
Catch exceptions during D3D11 initialization.  Trunk patch.  Carry r=jmuizelaar

Review of attachment 8527888 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/thebes/gfxWindowsPlatform.cpp
@@ +1719,5 @@
> +                             // Use
> +                             // D3D11_CREATE_DEVICE_PREVENT_INTERNAL_THREADING_OPTIMIZATIONS
> +                             // to prevent bug 1092260. IE 11 also uses this flag
> +                             D3D11_CREATE_DEVICE_BGRA_SUPPORT |
> +                             D3D11_CREATE_DEVICE_PREVENT_INTERNAL_THREADING_OPTIMIZATIONS,

This flag was added here accidentally. It does not apply to the D2D device.

Comment 28

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b688a0a26509
https://hg.mozilla.org/releases/mozilla-aurora/rev/71acc38804b8
https://hg.mozilla.org/releases/mozilla-beta/rev/5461eeca3daf
https://hg.mozilla.org/releases/mozilla-release/rev/5461eeca3daf

Bas is pushing a follow-up for his review comment.

Comment 29

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/b688a0a26509
https://hg.mozilla.org/mozilla-central/rev/d909e1fe5d13

Comment 30

[Jacek Caban]

I landed a trivial fixup for mingw (which doesn't support __try/__except, but we have macros to take care of that):

https://hg.mozilla.org/integration/mozilla-inbound/rev/193801221d25

Comment 31

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/193801221d25

Comment 32

[[SV Manager] Florin Mezei, QA (:FlorinMezei)]

Socorro shows ~500 crashes (for the three signatures combined) over the past 2 weeks, but all of them are in builds older than November 24th. I think we can call this fixed.

Comment 33

[Tyler Downer [He/Him]]

[Tracking Requested - why for this release]:

Have a user reporting that this has resurfaced in 38 Beta

https://crash-stats.mozilla.com/report/index/0c9cf2f3-98f0-4b68-83fb-73a7e2150429

https://support.mozilla.org/en-US/questions/1059732

Comment 34

[(Away)]

The crash report doesn't show it but there is an old DisplayLink driver (8.6.0.33743) at the top of the stack.

Comment 35

[Sylvestre Ledru [:Sylvestre]]

Tracking. We could take a patch in 38.0.5 if safe.

Comment 36

[Liz Henry (:lizzard) (relman/hg->git project)]

I don't see any crash signatures for 39 for any of these for the last month. So I'm not sure 39 is affected.

Comment 37

[Liz Henry (:lizzard) (relman/hg->git project)]

Noting we still don't have crash data for 39 beta, so we'll keep tracking this for 39 until we can verify it's fixed.

Comment 38

[Sylvestre Ledru [:Sylvestre]]

Wonfix for 38.0.5

Comment 39

[[:philipp]]

next to the sumo question in tyler's comment 33, we also got feedback on irc by an affected user that updating the displaylink drivers on the system did solve this crash. 
(reportedly safemode/disabling hwa didn't help, neither did an update to firefox 39 beta)

Comment 40

[(Away)]

This is getting hard to keep track of. I'm going to clone this bug for the remaining reports.

Comment 41

[Liz Henry (:lizzard) (relman/hg->git project)]

Dropping tracking here to track bug 1171094 instead since that's where David wants to do things!