1044129 - crash in mozilla::layers::CompositorD3D9::DrawQuad(mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::EffectChain const&, float, mozilla::gfx::Matrix4x4 const&)

Status: VERIFIED FIXED

(Core :: Graphics: Layers, defect)

Description

[Liz Henry (:lizzard) (privacy/fingerprinting team)]

This bug was filed from the Socorro interface and is 
report bp-8655934f-e39e-4b78-8d35-17c1f2140724.
=============================================================
This is the #10 topcrasher for 34.0a1 with 30 out of 2101 crashes, last appearing in the 20140724030201 build. 
It also appears in 33.0a1. 
May be related to bug 1043426. 

Crashing thread:
0 	xul.dll 	mozilla::layers::CompositorD3D9::DrawQuad(mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::EffectChain const&, float, mozilla::gfx::Matrix4x4 const&) 	gfx/layers/d3d9/CompositorD3D9.cpp
1 	xul.dll 	mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerComposite>(mozilla::layers::ContainerLayerComposite*, mozilla::layers::LayerManagerComposite*, nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
2 	xul.dll 	mozilla::layers::ContainerLayerComposite::RenderLayer(nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
3 	xul.dll 	mozilla::layers::RenderLayers<mozilla::layers::ContainerLayerComposite>(mozilla::layers::ContainerLayerComposite*, mozilla::layers::LayerManagerComposite*, nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
4 	xul.dll 	mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerComposite>(mozilla::layers::ContainerLayerComposite*, mozilla::layers::LayerManagerComposite*, nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
5 	xul.dll 	mozilla::layers::ContainerLayerComposite::RenderLayer(nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
6 	xul.dll 	mozilla::layers::RenderLayers<mozilla::layers::ContainerLayerComposite>(mozilla::layers::ContainerLayerComposite*, mozilla::layers::LayerManagerComposite*, nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
7 	xul.dll 	mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerComposite>(mozilla::layers::ContainerLayerComposite*, mozilla::layers::LayerManagerComposite*, nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
8 	xul.dll 	mozilla::layers::ContainerLayerComposite::RenderLayer(nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
9 	xul.dll 	mozilla::layers::LayerManagerComposite::Render() 	gfx/layers/composite/LayerManagerComposite.cpp
10 	xul.dll 	mozilla::layers::LayerManagerComposite::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/composite/LayerManagerComposite.cpp
11 	xul.dll 	mozilla::layers::LayerManagerComposite::EndEmptyTransaction(mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/composite/LayerManagerComposite.cpp
12 	xul.dll 	mozilla::layers::CompositorParent::CompositeToTarget(mozilla::gfx::DrawTarget*, nsIntRect const*) 	gfx/layers/ipc/CompositorParent.cpp
13 	xul.dll 	mozilla::layers::CompositorParent::CompositeCallback() 	gfx/layers/ipc/CompositorParent.cpp
14 	xul.dll 	MessageLoop::RunTask(Task*) 	ipc/chromium/src/base/message_loop.cc
15 	xul.dll 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) 	ipc/chromium/src/base/message_loop.cc
16 	xul.dll 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
17 	xul.dll 	base::MessagePumpDefault::Run(base::MessagePump::Delegate*) 	ipc/chromium/src/base/message_pump_default.cc
18 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
19 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
20 	xul.dll 	base::Thread::ThreadMain() 	ipc/chromium/src/base/thread.cc
21 	xul.dll 	`anonymous namespace'::ThreadFunc(void*) 	tools/profiler/platform-win32.cc
22 	kernel32.dll 	BaseThreadStart

Comment 1

[(Away)]

mTexture is null here:
      TextureSourceD3D9* source = texturedEffect->mTexture->AsSourceD3D9();

Is that expected?

Comment 2

[Matt Woodrow (:mattwoodrow)]

Nope, it looks like we use texturedEffect->mTexture unconditionally in the OGL compositor without issues.

Comment 3

[Matt Woodrow (:mattwoodrow)]

It looks like CreateRenderTargetFromSource is fallible on d3d9/11, but not on OGL.

Comment 4

[(Away)]

Ah, I missed Liz's mention of bug 1043426... that looks quite similar.

Comment 5

[Matt Woodrow (:mattwoodrow)]

Attachment: Don't crash if surface allocation fails

This also fixes a bug where we'd try take the surface copy path if allocation failed for the non-copy path.

Comment 6

[Jeff Muizelaar [:jrmuizel]]

Comment on attachment 8463808 [details] [diff] [review]
Don't crash if surface allocation fails

Review of attachment 8463808 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/layers/composite/ContainerLayerComposite.cpp
@@ +520,5 @@
>  
> +    if (!surface) {
> +      aContainer->mPrepared = nullptr;
> +      return;
> +    }

I'd prefer if (surface) { } instead of the early return if it's not too messy.

Comment 7

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

I get crashes on https://www.mozilla.org/en-US/firefox/desktop/ when I start scrolling down

https://crash-stats.mozilla.com/report/index/d24d17ae-6100-478e-b163-d6d102140828
https://crash-stats.mozilla.com/report/index/bfbe7611-e233-479e-8dab-5449c2140828

Firefox 34.0a1 Crash Report [@ mozilla::layers::CompositorD3D11::DrawQuad(mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::EffectChain const&, float, mozilla::gfx::Matrix4x4 const&) ]

Same bug or should I open a new one?

Comment 8

[Nicolas Silva [:nical]]

(In reply to Matt Woodrow (:mattwoodrow) from comment #3)
> It looks like CreateRenderTargetFromSource is fallible on d3d9/11, but not
> on OGL.

Yup, Bug 1054581 aims at having a more consistent behavior there.

(In reply to Virtual_ManPL [:Virtual] from comment #7)
> I get crashes on https://www.mozilla.org/en-US/firefox/desktop/ when I start
> scrolling down
> Same bug or should I open a new one?

It's fine to continue in this bug.

Comment 9

[Liz Henry (:lizzard) (privacy/fingerprinting team)]

This is currently the #3 topcrash on Firefox 34.0a1 with 528/15568 crashes in the last 7 days.

Comment 10

[Liz Henry (:lizzard) (privacy/fingerprinting team)]

Matt is this ready to be checked in? Thanks!

Comment 11

[Matt Woodrow (:mattwoodrow)]

 https://hg.mozilla.org/integration/mozilla-inbound/rev/971f1ff8f6ba

I guess it is!

Comment 12

[Liz Henry (:lizzard) (privacy/fingerprinting team)]

[Tracking Requested - why for this release]: This is a topcrasher for Firefox 34 and is affecting 33 as well.

Comment 13

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

Any idea when this will be pushed to mozilla-central?

Comment 14

[(Away)]

I think this was already merged. Matt can you confirm?

Comment 15

[Matt Woodrow (:mattwoodrow)]

Sure was, I think this is another case of me breaking mcMerge by using different email accounts for bugzilla and ldap.

https://hg.mozilla.org/mozilla-central/rev/971f1ff8f6ba

Comment 16

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

I requesting uplift for 33 as it's also affected.

Comment 17

[Nicolas Silva [:nical]]

Comment on attachment 8463808 [details] [diff] [review]
Don't crash if surface allocation fails

Approval Request Comment
[Feature/regressing bug #]:
[User impact if declined]: Lots of crashes
[Describe test coverage new/current, TBPL]: baked for a while in central and aurora
[Risks and why]: low risk, trivial patch
[String/UUID change made/needed]:

Comment 18

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/11e34dc2f591

Comment 19

[Cornel Ionce [:noni]]

Given a single crash with this signature on Firefox 33 beta 6 on Soccoro for the last week I consider that we can mark this Verified.
I'll keep an eye on the crash-stats in the following days to see if other crashes with this signature are reported.

Comment 20

[DARSHAN S]

[Tracking Requested - why for this release]:

[Blocking Requested - why for this release]:

Comment 21

[Wesly Huang (EPM)]

[Triage] de-nom as this should belong to Firefox browser.