1043426 - Crash in mozilla::layers::CompositorD3D11::DrawQuad(mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::EffectChain const&, float, mozilla::gfx::Matrix4x4 const&)

Status: VERIFIED FIXED

(Core :: Graphics: Layers, defect)

Description

[Johannes Pfrang [:johnp]]

This crash signature came up with the 2014/07/21 build.

Report: bp-99ff5834-5bdd-42e8-9a18-674032140721

Experienced this twice today but no STR.

Comment 1

[Nicolas Silva [:nical]]

Attachment: Don't crash when failing to apply a mask

Comment 3

[Bas Schouten (:bas.schouten)]

Comment on attachment 8461629 [details] [diff] [review]
Don't crash when failing to apply a mask

Review of attachment 8461629 [details] [diff] [review]:
-----------------------------------------------------------------

Umm... sure... but it would really be nice to know -why- this happens.

Comment 4

[Cornel Ionce [:noni] [Hubs QA]]

I can reproduce this on latest Nightly (build ID: 20140724030201) using the following scenarios:

1. Open Firefox using a new profile
2. Go to https://marketplace.allizom.org/
- At this point, Firefox crashes obtaining this signature

If that's not working try:
1. Open Firefox
2. Go to https://marketplace.allizom.org/ and sign in
3. Go to My submissions
4. Open the detailed page of any app
5. Click on View Listing (added a video with this step, when the crash occurs)
-- Firefox crashes with this signature.

Reproduced this issue on 3 different machines using Windows 7 64bit.
Unable to reproduce on Mac OS X 10.9 and Ubuntu 14.04.

This issue reproduces using a clean profile but DOES NOT reproduce in Safe Mode.

Crash reports:
bp-bee2c249-a848-434c-84a0-dbf002140725
bp-d0acc894-d7cd-4d86-8635-b04862140725
bp-2dc0c98d-672a-4f8d-9817-ef73a2140725
bp-b523bed6-8e48-4f66-b355-dd1542140725
bp-867e2a44-2dba-487b-8ecd-22a2d2140725
bp-f967f6e4-13de-4c55-a8b7-841732140725
bp-760388aa-4e19-4c1f-b4d7-559882140725
bp-74526a46-8805-41da-bcf8-26b522140725

Comment 5

[Cornel Ionce [:noni] [Hubs QA]]

Also reproduces with https://marketplace-dev.allizom.org (at the page load) with current Nightly.

Changing priority to Blocker. Please lower if disagree.

Comment 6

[Robert Kaiser]

[Tracking Requested - why for this release]:

Comment 7

[Benjamin Kerensa [:bkerensa]]

Tracking

Comment 8

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Reproduces for me every time with http://codepen.io/caseyyee/pen/Lfbcv sometimes before, sometimes after successfully drawing one fram eof the animation.

Comment 9

[Nicolas Silva [:nical]]

(In reply to Vladimir Vukicevic [:vlad] [:vladv] from comment #8)
> Reproduces for me every time with http://codepen.io/caseyyee/pen/Lfbcv
> sometimes before, sometimes after successfully drawing one fram eof the
> animation.

Nice test case, each little shape has its own layer, some of which being in a container layer with a mask, so it's kind of brutal for the compositor :)

Comment 10

[Hugh Nougher [:Hughman]]

This kinda needs more activity given its the number 1 top crash in nightly.

I get this very regularly when opening links in new tabs (middle click), maybe related to tree style tabs.

Comment 11

[Hossain Al Ikram [:ikram] (QA Contact)]

I used Latest Nightly and go to marketplace.firefox.com site. Then nightly crashes . As much as I do it , It crashes.

My Os Windows 7 x64 and Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0
Crash Report ID : bp-202e7b4e-9885-4a4f-bb09-d0f8c2140801
Build ID : 20140731030206

Comment 12

[Nicolas Silva [:nical]]

https://tbpl.mozilla.org/?tree=Mozilla-Inbound&rev=fe28abfc3842

Comment 13

[Ryan VanderMeulen [:RyanVM]]

Backed out for Android reftest failures.
https://hg.mozilla.org/integration/mozilla-inbound/rev/1f77da2f617e

https://tbpl.mozilla.org/php/getParsedLog.php?id=45058364&tree=Mozilla-Inbound
https://tbpl.mozilla.org/php/getParsedLog.php?id=45058057&tree=Mozilla-Inbound

Comment 14

[Ryan VanderMeulen [:RyanVM]]

And OSX:
https://tbpl.mozilla.org/php/getParsedLog.php?id=45058992&tree=Mozilla-Inbound

Comment 15

[Chris Peterson [:cpeterson]]

Hossain (comment 11) hit this crash when testing e10s, if that matters.

Comment 16

[Bas Schouten (:bas.schouten)]

Attachment: Avoid doing work for empty visible regions

With this patch there seem to be no issues for me locally. I hope it will fix things for others too, but it seems like it would be a good idea regardless.

Comment 18

[Ed Morley [:emorley]]

Backed out for B2G failures in async-scrolling/element-1.html:
https://tbpl.mozilla.org/php/getParsedLog.php?id=45170272&tree=Mozilla-Inbound
https://tbpl.mozilla.org/php/getParsedLog.php?id=45174148&tree=Mozilla-Inbound

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/e8c21ff47dc1

Comment 19

[Nicolas Silva [:nical]]

Fixed and relanded the first patch. It doesn't fix everything, so the crash will still occur until we land the other patch and/or the patch in bug 1045608.

https://hg.mozilla.org/integration/mozilla-inbound/rev/3596f811a264

Comment 20

[Liz Henry (:lizzard) (relman/hg->git project)]

This is still the #1 topcrash for Firefox 34.0a1 with 5965/14787 crashes in the last 7 days. I'll keep an eye on crash-stats as the patches land.

Comment 21

[Ryan VanderMeulen [:RyanVM]]

Something in this push was causing various crashes and reftest failures. Backed out.
https://hg.mozilla.org/integration/mozilla-inbound/rev/b072e506b81b

https://tbpl.mozilla.org/php/getParsedLog.php?id=45183586&tree=Mozilla-Inbound
https://tbpl.mozilla.org/php/getParsedLog.php?id=45180960&tree=Mozilla-Inbound

Comment 22

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/d7e3d485cd8d

Comment 23

[Bas Schouten (:bas.schouten)]

(In reply to Liz Henry :lizzard from comment #20)
> This is still the #1 topcrash for Firefox 34.0a1 with 5965/14787 crashes in
> the last 7 days. I'll keep an eye on crash-stats as the patches land.

The patch I -hope- fill fix this made it through. Let's see what that does. I'd like to uplift to Aurora ASAP if this works.

Comment 24

[Bas Schouten (:bas.schouten)]

(In reply to Ryan VanderMeulen [:RyanVM UTC-4] from comment #21)
> Something in this push was causing various crashes and reftest failures.
> Backed out.
> https://hg.mozilla.org/integration/mozilla-inbound/rev/b072e506b81b
> 
> https://tbpl.mozilla.org/php/getParsedLog.php?id=45183586&tree=Mozilla-
> Inbound
> https://tbpl.mozilla.org/php/getParsedLog.php?id=45180960&tree=Mozilla-
> Inbound

It looks like the push was corrupt, there's some hunks in there that aren't in the patch on this bug. I highly suspect those are responsible.

Comment 25

[Bas Schouten (:bas.schouten)]

(In reply to Bas Schouten (:bas.schouten) from comment #24)
> (In reply to Ryan VanderMeulen [:RyanVM UTC-4] from comment #21)
> > Something in this push was causing various crashes and reftest failures.
> > Backed out.
> > https://hg.mozilla.org/integration/mozilla-inbound/rev/b072e506b81b
> > 
> > https://tbpl.mozilla.org/php/getParsedLog.php?id=45183586&tree=Mozilla-
> > Inbound
> > https://tbpl.mozilla.org/php/getParsedLog.php?id=45180960&tree=Mozilla-
> > Inbound
> 
> It looks like the push was corrupt, there's some hunks in there that aren't
> in the patch on this bug. I highly suspect those are responsible.

Never mind, I didn't notice you backed out another patch as well.

Comment 26

[Nicolas Silva [:nical]]

try push with a fix for the first patch: https://tbpl.mozilla.org/?tree=Try&rev=ebc58d4d57dd

Comment 27

[Nicolas Silva [:nical]]

Sorry for the noise, I didn't see Bas's patch made it to central, I'll put the other patch in another bug.

Comment 28

[Liz Henry (:lizzard) (relman/hg->git project)]

Nicolas: which other bug? Thanks!

Comment 29

[Nicolas Silva [:nical]]

(In reply to Liz Henry :lizzard from comment #28)
> Nicolas: which other bug? Thanks!

Bug 1049596

Comment 30

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/0bc9fd5d0476

Comment 31

[Liz Henry (:lizzard) (relman/hg->git project)]

This is the #2 topcrasher for Firefox 34.0a1 with 490/3505 crashes in the last 3 days. There are a couple of hundred crashes with buildids from the last two days. Nicolas is this likely because of bug 1049596 not having landed yet?

Comment 32

[Nicolas Silva [:nical]]

(In reply to Liz Henry :lizzard from comment #31)
> This is the #2 topcrasher for Firefox 34.0a1 with 490/3505 crashes in the
> last 3 days. There are a couple of hundred crashes with buildids from the
> last two days. Nicolas is this likely because of bug 1049596 not having
> landed yet?

It actually has already landed. There are apparently other cases where we end up trying to composite a null surface, I'll submit a new patch today.

Comment 33

[Nicolas Silva [:nical]]

this try push has a patch that'll  avoid this crash but assert on a certain condition that could have caused the crash. If we still crash (this time asserting) at least we'll know for sure that it's because we are trying to create a render target off an empty region (which is unlikely since Bas's patch but I can't entirely rule out a race condition somewhere at this point).

https://tbpl.mozilla.org/?tree=Try&rev=fc3a037605ab

Comment 34

[Liz Henry (:lizzard) (relman/hg->git project)]

I'm still seeing a lot of crashes with this signature on Nightly on builds from yesterday (2014081703) and the day before so can't verify this fix yet (or for bug 1049596) 

Nical should this be marked REOPENED for now? Sorry to bug you.

Comment 35

[Cornel Ionce [:noni] [Hubs QA]]

Issue is no longer reproducing with the STR from comment 4 on latest Nighty, build ID: 20140820030202.
As Liz mentioned. there still are lots of crashes on latest Nightly builds. 
I also looked in the comments section of the crash and tried to reproduce this during exploratory testing on google maps, alibaba, ebay, youtube and several other tabs opened in the same time, without any luck.

Comment 36

[Nicolas Silva [:nical]]

(In reply to Liz Henry :lizzard from comment #34)
> I'm still seeing a lot of crashes with this signature on Nightly on builds
> from yesterday (2014081703) and the day before so can't verify this fix yet
> (or for bug 1049596) 
> 
> Nical should this be marked REOPENED for now? Sorry to bug you.

(Sorry for the late answer, just coming back from PTO)
There hasn't been a crash with this signature since 2014-08-20 so let's keep this one closed and open a new bug if it happens again. Plus, this signature could be caused by different issues than the one fixed in this bug. Bug 1054581 will help by having a more consistent behavior accross backends when running into the bad state that caused this bug, so if the problem still exists it'll help catching it.

Comment 38

[Cornel Ionce [:noni] [Hubs QA]]

Marking issue verified on Firefox 34 based on comment 36 and due to the fact that I can't reproduce it anymore.

Comment 39

[Sylvestre Ledru [:Sylvestre]]

Nicolas, 33 is marked as affected. Could you fill the uplift request for 33? merci!

Comment 40

[Nicolas Silva [:nical]]

The fix for this bug landed in anither another bug so there's nothing to uplift here.

Comment 41

[Sylvestre Ledru [:Sylvestre]]

OK. Marking 33 as fixed then. merci

Comment 42

[Robert Kaiser]

(In reply to Nicolas Silva [:nical] from comment #40)
> The fix for this bug landed in anither another bug so there's nothing to
> uplift here.

If you mean bug 1044129, then it's not uplifted yet.

(In reply to Sylvestre Ledru [:sylvestre] from comment #41)
> OK. Marking 33 as fixed then. merci

That's dangerous without knowing the actual bug that solved it and being sure it did - and we also need to see data to actually verify that it worked, of course.

Comment 43

[Robert Kaiser]

This still has a top spot in 33.0b4 early data as seen in https://crash-stats.mozilla.com/topcrasher/products/Firefox/versions/33.0b4

Comment 44

[Nicolas Silva [:nical]]

Bug 1044129 is where an uplift need to happen. I didn't realize Matt was on PTO so I didn't follow the bug too closely after the patch made it to m-c.

Comment 45

[Sylvestre Ledru [:Sylvestre]]

Kairo, now that bug 1044129 has been uplifted. Can you see more trace of this crash? Thanks

Comment 46

[Robert Kaiser]

(In reply to Nicolas Silva [:nical] from comment #44)
> Bug 1044129 is where an uplift need to happen. I didn't realize Matt was on
> PTO so I didn't follow the bug too closely after the patch made it to m-c.

As expected, it's gone from stats in 33.0b5. \o/