1088833 - crash in mozilla::gl::ReadbackSharedSurface(mozilla::gl::SharedSurface*, mozilla::gfx::DrawTarget*) with HWA on and OMTC off

Status: VERIFIED FIXED

(Core :: Graphics, defect)

Description

[Pavel Cvrcek [:JasnaPaka]]

This bug was filed from the Socorro interface and is 
report bp-3fd3a380-eb9b-41b1-acc9-f54172141024.
=============================================================

How to reproduce:
1) Visit http://mapy.google.cz (Google Maps - new design).
2) Crash :(

OTMC disabled. HWA enabled.

Adapter Description	Intel(R) HD Graphics 3000
Adapter Drivers	igdumd64 igd10umd64 igd10umd64 igdumd32 igd10umd32 igd10umd32
Adapter RAM	Unknown
Device ID	0x0126
Direct2D Enabled	true
DirectWrite Enabled	true (6.2.9200.16571)
Driver Date	1-29-2014
Driver Version	9.17.10.3347
GPU #2 Active	false
GPU Accelerated Windows	1/1 Direct3D 11 (OMTC)
Subsys ID	04941028
Vendor ID	0x8086
WebGL Renderer	Google Inc. -- ANGLE (Intel(R) HD Graphics 3000 Direct3D9Ex vs_3_0 ps_3_0)
windowLayerManagerRemote	true
AzureCanvasBackend	direct2d
AzureContentBackend	direct2d 1.1
AzureFallbackCanvasBackend	cairo
AzureSkiaAccelerated	0

Comment 1

[Milan Sreckovic [:milan] (needinfo for best results)]

Can destTarget set in http://dxr.mozilla.org/mozilla-central/source/gfx/layers/d3d10/CanvasLayerD3D10.cpp#157 be nullptr?

Comment 2

[Loic]

STR:
1) Disable OMTC
2) Open http://www.goodboydigital.com/pixijs/examples/25/
NB: the rendering bug about this WebGL demo in FF35+ is bug 1089140.

Regression range:
good=2014-10-15
bad=2014-10-16
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=62f0b771583c&tochange=a280a03c9f3c

Comment 4

[Milan Sreckovic [:milan] (needinfo for best results)]

Attachment: Catch D3D11 canvas draw target failure. Speculative patch. r=bschouten

Comment 5

[Lawrence Mandel [:lmandel] (use needinfo)]

Given that this is a but with OMTC disabled, do we need to fix this? Are there still system configurations for which OMTC should be disabled?

Comment 6

[Aris]

Yes this should be fixed! OMTC causes issues on many systems.
Tab freeze and hang because of it for example. See here: http://forums.mozillazine.org/viewtopic.php?f=9&t=2880521

Comment 7

[Bas Schouten (:bas.schouten)]

Comment on attachment 8551901 [details] [diff] [review]
Catch D3D11 canvas draw target failure.  Speculative patch.  r=bschouten

Review of attachment 8551901 [details] [diff] [review]:
-----------------------------------------------------------------

As far as I can tell this contains purely improvements :-).

Comment 8

[Milan Sreckovic [:milan] (needinfo for best results)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=509511c1ecd4

Comment 9

[Milan Sreckovic [:milan] (needinfo for best results)]

The OS X try failure should be OK.

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/abb68e8a8831

Comment 11

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/abb68e8a8831

Comment 12

[blackwind]

mozilla38? This NEEDS to be pushed up to mozilla36, the branch where it first broke. Users unable to use OMTC due to the freezing issue won't be pleased when Google Maps crashes their browser for three months.

Comment 13

[Aris]

Thanks for the Fx38 fix.

Blackwind is right, this fix should be pushed to Fx36/37 asap and btw. not only 'Google Maps' is affected, Youtube and probably other websites crash Fx36 too.

Comment 14

[Milan Sreckovic [:milan] (needinfo for best results)]

So, Aris+blackwind, it sounds like this does deal with the problem on 38?  Just want to confirm so that we don't uplift something that doesn't actually help.

Comment 15

[Aris]

I can confirm Fx38 nighly builds don't crash anymore with HWA on and OMTC off.

Comment 16

[Milan Sreckovic [:milan] (needinfo for best results)]

Comment on attachment 8551901 [details] [diff] [review]
Catch D3D11 canvas draw target failure.  Speculative patch.  r=bschouten

Approval Request Comment
[Feature/regressing bug #]:
[User impact if declined]: The community is using HWA on/OMTC off to work around existing bugs, so the Genie is out of the bottle.
[Describe test coverage new/current, TreeHerder]:
[Risks and why]: Low risk.  This is for the most part a null pointer check with better reporting if something goes wrong.
[String/UUID change made/needed]: n/a

Comment 17

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/b314a91c5684
https://hg.mozilla.org/releases/mozilla-beta/rev/24a8f5ee0ad0

Comment 18

[Lawrence Mandel [:lmandel] (use needinfo)]

Marking as tracking- for 37. This bug has already been uplifted so it should ship in 36+.

Comment 19

[Aris]

Fixed in Fx 37 (2015-01-29).
Not fixed in Fx 36 beta 4 yet, probably in Fx 36 beta 5.

Comment 20

[Aris]

Despite of my yesterdays report where the crash was fixed for "maps.google.com" a crash can still be reproduced on Youtube using Fx 37 or Fx 36b5.

E.g. here: https://www.youtube.com/watch?v=upZAIN0dahU

- Fx 36b5 / 37
- new profile
- no add-ons installed
- all plugins disabled
- HWA on
- OMTC off

Crash reports
https://crash-stats.mozilla.com/report/index/5a80b497-a1f4-472f-8142-96bab2150130
https://crash-stats.mozilla.com/report/index/f2659070-e4d9-49db-a776-1cc6d2150130
https://crash-stats.mozilla.com/report/index/ba6af5e3-2b50-4286-90df-c14c42150130

Comment 21

[Milan Sreckovic [:milan] (needinfo for best results)]

Yeah, I think this is hitting bug 1099074 where we go into D2D1.1 and D3D10, which we do not want to.  That one's in review.

Comment 22

[[SV Manager] Florin Mezei, QA (:FlorinMezei)]

I reproduced the crash on Windows 7 x64, with Firefox 36 Beta 1, using scenarios from comment 0 and comment 2. 

The crash no longer reproduces on the same environment, with the same scenarios, when using:
- Firefox 36 Beta 7 - BuildID: 20150205114429
- latest Firefox 37 Aurora - BuildID: 20150205004014
- latest Firefox 38 Nightly - BuildID: 20150205030205

Note though that the behavior for Aurora 37 is very weird in these scenarios:
- http://www.goodboydigital.com/pixijs/examples/25/ - displays upside down
- http://mapy.google.cz/ - displays ok, until you zoom out 3-4 times, then zoom in 3-4 times, after which the whole map also displays upside down
The above behavior affects only 37 Aurora (no issue on Beta 36 and Nightly 38). Does this issue sound familiar to anyone? Otherwise I guess I should file a new issue.

I crashed with scenario from comment 20, but with signature from bug 1099074. I also got the signature from comment 20 on Aurora 37 after navigating on http://mapy.google.cz/ for a while. I cannot reproduce that consistently though.

Since Socorro [1] also no longer shows any crashes after this fix landed in any of the branches, I'm closing this now. I would like though some feedback on the Aurora 37 issues.

[1] - https://crash-stats.mozilla.com/report/list?product=Firefox&range_unit=days&range_value=28&signature=mozilla%3A%3Agl%3A%3AReadbackSharedSurface%28mozilla%3A%3Agl%3A%3ASharedSurface%2A%2C+mozilla%3A%3Agfx%3A%3ADrawTarget%2A%29#tab-reports