bugzilla.mozilla.org will be intermittently unavailable on Saturday, March 24th, from 16:00 until 20:00 UTC.

crash in mozilla::gl::ReadbackSharedSurface(mozilla::gl::SharedSurface*, mozilla::gfx::DrawTarget*) with HWA on and OMTC off

VERIFIED FIXED in Firefox 36



4 years ago
3 years ago


(Reporter: JasnaPaka, Assigned: milan)


({crash, regression, reproducible})

36 Branch
Windows NT
crash, regression, reproducible

Firefox Tracking Flags

(firefox35 unaffected, firefox36 verified, firefox37- verified, firefox38+ verified)


(crash signature)


(1 attachment)



4 years ago
This bug was filed from the Socorro interface and is 
report bp-3fd3a380-eb9b-41b1-acc9-f54172141024.

How to reproduce:
1) Visit http://mapy.google.cz (Google Maps - new design).
2) Crash :(

OTMC disabled. HWA enabled.

Adapter Description	Intel(R) HD Graphics 3000
Adapter Drivers	igdumd64 igd10umd64 igd10umd64 igdumd32 igd10umd32 igd10umd32
Adapter RAM	Unknown
Device ID	0x0126
Direct2D Enabled	true
DirectWrite Enabled	true (6.2.9200.16571)
Driver Date	1-29-2014
Driver Version
GPU #2 Active	false
GPU Accelerated Windows	1/1 Direct3D 11 (OMTC)
Subsys ID	04941028
Vendor ID	0x8086
WebGL Renderer	Google Inc. -- ANGLE (Intel(R) HD Graphics 3000 Direct3D9Ex vs_3_0 ps_3_0)
windowLayerManagerRemote	true
AzureCanvasBackend	direct2d
AzureContentBackend	direct2d 1.1
AzureFallbackCanvasBackend	cairo
AzureSkiaAccelerated	0

Comment 1

4 years ago
Can destTarget set in http://dxr.mozilla.org/mozilla-central/source/gfx/layers/d3d10/CanvasLayerD3D10.cpp#157 be nullptr?
Flags: needinfo?(bas)

Comment 2

4 years ago
1) Disable OMTC
2) Open http://www.goodboydigital.com/pixijs/examples/25/
NB: the rendering bug about this WebGL demo in FF35+ is bug 1089140.

Regression range:
status-firefox35: --- → unaffected
status-firefox36: --- → ?
Keywords: regression, reproducible


3 years ago
Duplicate of this bug: 1122285


3 years ago
Summary: crash in mozilla::gl::ReadbackSharedSurface(mozilla::gl::SharedSurface*, mozilla::gfx::DrawTarget*) → crash in mozilla::gl::ReadbackSharedSurface(mozilla::gl::SharedSurface*, mozilla::gfx::DrawTarget*) with HWA on and OMTC off


3 years ago
tracking-firefox37: --- → ?
tracking-firefox38: --- → ?


3 years ago
Version: unspecified → 36 Branch

Comment 4

3 years ago
Created attachment 8551901 [details] [diff] [review]
Catch D3D11 canvas draw target failure.  Speculative patch.  r=bschouten
Flags: needinfo?(bas)
Attachment #8551901 - Flags: review?(bas)
Given that this is a but with OMTC disabled, do we need to fix this? Are there still system configurations for which OMTC should be disabled?
Flags: needinfo?(milan)

Comment 6

3 years ago
Yes this should be fixed! OMTC causes issues on many systems.
Tab freeze and hang because of it for example. See here: http://forums.mozillazine.org/viewtopic.php?f=9&t=2880521
Comment on attachment 8551901 [details] [diff] [review]
Catch D3D11 canvas draw target failure.  Speculative patch.  r=bschouten

Review of attachment 8551901 [details] [diff] [review]:

As far as I can tell this contains purely improvements :-).
Attachment #8551901 - Flags: review?(bas) → review+
tracking-firefox38: ? → +


3 years ago
Assignee: nobody → milan

Comment 9

3 years ago
The OS X try failure should be OK.
Keywords: checkin-needed
Last Resolved: 3 years ago
status-firefox38: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla38

Comment 12

3 years ago
mozilla38? This NEEDS to be pushed up to mozilla36, the branch where it first broke. Users unable to use OMTC due to the freezing issue won't be pleased when Google Maps crashes their browser for three months.

Comment 13

3 years ago
Thanks for the Fx38 fix.

Blackwind is right, this fix should be pushed to Fx36/37 asap and btw. not only 'Google Maps' is affected, Youtube and probably other websites crash Fx36 too.

Comment 14

3 years ago
So, Aris+blackwind, it sounds like this does deal with the problem on 38?  Just want to confirm so that we don't uplift something that doesn't actually help.
Flags: needinfo?(bugzilla)
Flags: needinfo?(aris-t2)

Comment 15

3 years ago
I can confirm Fx38 nighly builds don't crash anymore with HWA on and OMTC off.
Flags: needinfo?(aris-t2)

Comment 16

3 years ago
Comment on attachment 8551901 [details] [diff] [review]
Catch D3D11 canvas draw target failure.  Speculative patch.  r=bschouten

Approval Request Comment
[Feature/regressing bug #]:
[User impact if declined]: The community is using HWA on/OMTC off to work around existing bugs, so the Genie is out of the bottle.
[Describe test coverage new/current, TreeHerder]:
[Risks and why]: Low risk.  This is for the most part a null pointer check with better reporting if something goes wrong.
[String/UUID change made/needed]: n/a
Flags: needinfo?(bugzilla)
Attachment #8551901 - Flags: approval-mozilla-beta?
Attachment #8551901 - Flags: approval-mozilla-aurora?
Attachment #8551901 - Flags: approval-mozilla-beta?
Attachment #8551901 - Flags: approval-mozilla-beta+
Attachment #8551901 - Flags: approval-mozilla-aurora?
Attachment #8551901 - Flags: approval-mozilla-aurora+
Marking as tracking- for 37. This bug has already been uplifted so it should ship in 36+.
tracking-firefox37: ? → -

Comment 19

3 years ago
Fixed in Fx 37 (2015-01-29).
Not fixed in Fx 36 beta 4 yet, probably in Fx 36 beta 5.

Comment 20

3 years ago
Despite of my yesterdays report where the crash was fixed for "maps.google.com" a crash can still be reproduced on Youtube using Fx 37 or Fx 36b5.

E.g. here: https://www.youtube.com/watch?v=upZAIN0dahU

- Fx 36b5 / 37
- new profile
- no add-ons installed
- all plugins disabled
- HWA on
- OMTC off

Crash reports

Comment 21

3 years ago
Yeah, I think this is hitting bug 1099074 where we go into D2D1.1 and D3D10, which we do not want to.  That one's in review.
I reproduced the crash on Windows 7 x64, with Firefox 36 Beta 1, using scenarios from comment 0 and comment 2. 

The crash no longer reproduces on the same environment, with the same scenarios, when using:
- Firefox 36 Beta 7 - BuildID: 20150205114429
- latest Firefox 37 Aurora - BuildID: 20150205004014
- latest Firefox 38 Nightly - BuildID: 20150205030205

Note though that the behavior for Aurora 37 is very weird in these scenarios:
- http://www.goodboydigital.com/pixijs/examples/25/ - displays upside down
- http://mapy.google.cz/ - displays ok, until you zoom out 3-4 times, then zoom in 3-4 times, after which the whole map also displays upside down
The above behavior affects only 37 Aurora (no issue on Beta 36 and Nightly 38). Does this issue sound familiar to anyone? Otherwise I guess I should file a new issue.

I crashed with scenario from comment 20, but with signature from bug 1099074. I also got the signature from comment 20 on Aurora 37 after navigating on http://mapy.google.cz/ for a while. I cannot reproduce that consistently though.

Since Socorro [1] also no longer shows any crashes after this fix landed in any of the branches, I'm closing this now. I would like though some feedback on the Aurora 37 issues.

[1] - https://crash-stats.mozilla.com/report/list?product=Firefox&range_unit=days&range_value=28&signature=mozilla%3A%3Agl%3A%3AReadbackSharedSurface%28mozilla%3A%3Agl%3A%3ASharedSurface%2A%2C+mozilla%3A%3Agfx%3A%3ADrawTarget%2A%29#tab-reports
status-firefox36: fixed → verified
status-firefox37: fixed → verified
status-firefox38: fixed → verified
You need to log in before you can comment on or make changes to this bug.