1081171 - crash in D3d::CSurface::DeleteGHAL3DStateProcessorHandles()

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Tracy Walker [:tracy]]

This bug was filed from the Socorro interface and is 
report bp-0798ae26-ee0b-4550-88c0-b4f442141010.
=============================================================

[Tracking Requested - why for this release]:

This crash has spiked significantly in volume the 33.0RC build.  Something checked in to it has caused this regression.

Frame 	Module 	Signature 	Source
0 		@0xe8560974 	
1 	igdumd32.dll 	D3d::CSurface::DeleteGHAL3DStateProcessorHandles() 	
2 	igdumd32.dll 	D3d::CSurface::~CSurface() 	
3 	igdumd32.dll 	D3d::D3DRESOURCE::~D3DRESOURCE() 	
4 	igdumd32.dll 	D3d::D3DRESOURCE::Delete(D3d::D3DRESOURCE*) 	
5 	igdumd32.dll 	UmDestroyResource(void*, void*) 	
6 	igdumd32.dll 	USERMODE_DEVICE_CONTEXT::DeleteLRU() 	
7 	igdumd32.dll 	USERMODE_DEVICE_CONTEXT::Delete(USERMODE_DEVICE_CONTEXT*&) 	
8 	igdumd32.dll 	DestroyDevice(void*) 	
9 	d3d9.dll 	CBaseDevice::~CBaseDevice() 	
10 	d3d9.dll 	D3D8DeleteDirectDrawObject 	
11 	d3d9.dll 	CBaseDevice::~CBaseDevice() 	
12 	d3d9.dll 	CD3DBase::~CD3DBase() 	
13 	d3d9.dll 	CD3DHal::~CD3DHal() 	
14 	d3d9.dll 	CD3DHal::`vector deleting destructor'(unsigned int) 	
15 	d3d9.dll 	VSOutputDecl::~VSOutputDecl() 	
16 	d3d9.dll 	CIndexBuffer::Release()

Comment 1

[Tracy Walker [:tracy]]

nical, bas. can you take a look?  We may have to put out a 33.0RC build for a cert issue. So might have a chance to solve this along with it.

Comment 2

[Robert Kaiser]

Those three signatures are the ones that obviously jumped in 33.0 RC data:

https://crash-stats.mozilla.com/report/list?signature=D3d%3A%3ACSurface%3A%3ADeleteGHAL3DStateProcessorHandles%28%29
https://crash-stats.mozilla.com/report/list?signature=%400x0%20|%20DdDestroySurfaceLH
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Alayers%3A%3ADataTextureSourceD3D9%3A%3AUpdateFromTexture%28IDirect3DTexture9*%2C%20nsIntRegion%20const*%29

Looks like all three have those adapters as the majority of the crashes:
Intel Corporation 	Mobile Intel 4 Series Chipset Family Intel Mobile Graphic
Intel Corporation 	PCI\VEN_8086&DEV_2E32&SUBSYS_31031565&REV_03 Intel G41 express graphics
Intel Corporation 	- Intel Q45/Q43 Express Chipset

Comment 3

[Robert Kaiser]

[Tracking Requested - why for this release]:
Those jumped in early 33.0 RC data (from yesterday). The signatures themselves have been around in other 33 build but very low volume and are around in 34 and 35 as well.

Comment 4

[Robert Kaiser]

As they jumped together, I'm putting those three signatures all on this bug for now, hoping they are all related.

Comment 5

[Robert Kaiser]

Oh, and those 3 signatures are #3, #4, and #7 in early 33 RC build 1 data, summed up they match the OOM|small signature roughly in volume.

Comment 6

[Robert Kaiser]

Decision between Bas, Sylvestre and me on IRC: We are doing a backout of bug 1074378, bug 1076825 and bug 1044975 (all gfx-related changes between b9 and RC) on 33 for the RC build 2 that is required for a different bug anyhow.

As 34 is affected as well, this can be properly investigated there, hopefully next week, and we can see if we can bring back some of those gfx fixes for the scheduled 33 update - but I guess we'll only do that if we are very sure of what's going on here.

Comment 7

[Nicolas Silva [:nical]]

Did the backout fix this bug?

Comment 8

[Tracy Walker [:tracy]]

Each of the associated signatures here is still present in 33.0. However, in substantially far less volume than in 33.0 rc1. We're talking thousands of crashes down to dozens.

Comment 9

[Liz Henry (:lizzard) (relman/hg->git project)]

This is the #3 topcrash in 34.0b1 right now, with 2052/43672 crashes. 
Did these backouts also happen in 34?

Comment 10

[Liz Henry (:lizzard) (relman/hg->git project)]

Ah, looks like they did not.  It might be a good idea to give that a try now, early in the Beta cycle!

Comment 11

[Sylvestre Ledru [:Sylvestre]]

Liz, no, I don't think so. They are still in 34 (and 35 & 36)

Comment 12

[Benjamin Smedberg]

Solved by backout in 33, but we want to do something smarter for 34. Nical, can you decide what combination of backouts/fixes we should be taking for 34?

Comment 13

[Sylvestre Ledru [:Sylvestre]]

OK. Wontfix for 33 then.

Comment 14

[Robert Kaiser]

I think everything has been answered so far. Comment #6 has the plan for 33 and 34, comment #8 and comment #12 have the gist of the current status on those trains.

Comment 15

[Liz Henry (:lizzard) (relman/hg->git project)]

Bas, is it possible we could do this backout for Beta 3 to see if that brings down the crash rate? I am worried that while the goal to fix it "the right way" is good, all the issues coming up in 33 and 33.1 are going to mean that we don't get enough time to test those hypothetical fixes. So I lean towards putting the fix we know works into 34 now.   It's your call -- but I'm hoping we don't have to leave this till the last couple of beta cycles.

Comment 16

[Robert Kaiser]

FWIW, the backout of bug 1074378 is what I think we should try for b3 as Bas thought it to be most likely to be behind the crash spike we've seen here.

Comment 17

[Bas Schouten (:bas.schouten)]

KaiRo is right.

Comment 18

[Robert Kaiser]

BTW, for some reason those crashes are basically gone in 34.0b2 already (but they still were high in 34.0b2) - might make sense to look into what patches went in there.

Comment 19

[cmtalbert]

(In reply to Robert Kaiser (:[e-mail]) from comment #18)
> BTW, for some reason those crashes are basically gone in 34.0b2 already (but
> they still were high in 34.0b2) - might make sense to look into what patches
> went in there.

Kairo, I think you have the wrong beta numbers here. I think you mean that the crash disappeared in beta 3. Has anyone reviewed the patches to find out why?

Comment 20

[Nicolas Silva [:nical]]

(In reply to Clint Talbert ( :ctalbert ) from comment #19)
> Kairo, I think you have the wrong beta numbers here. I think you mean that
> the crash disappeared in beta 3. Has anyone reviewed the patches to find out
> why?

My understanding is that the combination of device and driver from bug 1074378 doesn't like [what we do with] D3D9. The patch that was backed out was blacklisting D3D11 with a fallback to D3D9.

Comment 21

[Robert Kaiser]

(In reply to Clint Talbert ( :ctalbert ) from comment #19)
> Kairo, I think you have the wrong beta numbers here. I think you mean that
> the crash disappeared in beta 3. Has anyone reviewed the patches to find out
> why?

No, I was pretty surprised myself, but the main 3d::CSurface::DeleteGHAL3DStateProcessorHandles() signature disappeared in beta 2 (and the others went to significantly lower volume which might stem from something else). Within the 34 beta cycle, it was only in beta 1 where this spiked (it was in 33.0.1 as well, though, of course, so it's not a single-build fluke).

Comment 22

[Robert Kaiser]

So, the backout of bug 1074378 helped on 34 and 33, but we are still seeing those crashes on 35 and 36.

Comment 23

[Robert Kaiser]

[Tracking Requested - why for this release]:
Seeing that we get this onto the radar for 36 as well.
I'm marking the branches disabled where we undid those crashes via the backout.

Comment 24

[Robert Kaiser]

I'm marking this WFM and "disabled" for the trains as the original bug has been backed out on all channels now.

Comment 25

[Tobias B. Besemer [:BesTo] (QA)]

[@ mozilla::layers::DataTextureSourceD3D9::UpdateFromTexture(IDirect3DTexture9*, nsIntRegion const*)]

Still there. Keep reopened or new bug?

https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Alayers%3A%3ADataTextureSourceD3D9%3A%3AUpdateFromTexture%28IDirect3DTexture9*%2C+nsIntRegion+const*%29&range_value=28&range_unit=days&date=2015-03-14

Comment 26

[Nicolas Silva [:nical]]

(In reply to Tobias B. Besemer from comment #25)
> [@
> mozilla::layers::DataTextureSourceD3D9::UpdateFromTexture(IDirect3DTexture9*,
> nsIntRegion const*)]
> 
> Still there. Keep reopened or new bug?
> 
> https://crash-stats.mozilla.com/report/
> list?signature=mozilla%3A%3Alayers%3A%3ADataTextureSourceD3D9%3A%3AUpdateFrom
> Texture%28IDirect3DTexture9*%2C+nsIntRegion+const*%29&range_value=28&range_un
> it=days&date=2015-03-14

This is a different signature, filed bug 1143653.