Closed Bug 1088833 Opened 5 years ago Closed 5 years ago

crash in mozilla::gl::ReadbackSharedSurface(mozilla::gl::SharedSurface*, mozilla::gfx::DrawTarget*) with HWA on and OMTC off

Categories

(Core :: Graphics, defect, critical)

36 Branch
x86
Windows NT
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla38
Tracking Status
firefox35 --- unaffected
firefox36 --- verified
firefox37 - verified
firefox38 + verified

People

(Reporter: JasnaPaka, Assigned: milan)

References

Details

(Keywords: crash, regression, reproducible)

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is 
report bp-3fd3a380-eb9b-41b1-acc9-f54172141024.
=============================================================

How to reproduce:
1) Visit http://mapy.google.cz (Google Maps - new design).
2) Crash :(

OTMC disabled. HWA enabled.

Adapter Description	Intel(R) HD Graphics 3000
Adapter Drivers	igdumd64 igd10umd64 igd10umd64 igdumd32 igd10umd32 igd10umd32
Adapter RAM	Unknown
Device ID	0x0126
Direct2D Enabled	true
DirectWrite Enabled	true (6.2.9200.16571)
Driver Date	1-29-2014
Driver Version	9.17.10.3347
GPU #2 Active	false
GPU Accelerated Windows	1/1 Direct3D 11 (OMTC)
Subsys ID	04941028
Vendor ID	0x8086
WebGL Renderer	Google Inc. -- ANGLE (Intel(R) HD Graphics 3000 Direct3D9Ex vs_3_0 ps_3_0)
windowLayerManagerRemote	true
AzureCanvasBackend	direct2d
AzureContentBackend	direct2d 1.1
AzureFallbackCanvasBackend	cairo
AzureSkiaAccelerated	0
STR:
1) Disable OMTC
2) Open http://www.goodboydigital.com/pixijs/examples/25/
NB: the rendering bug about this WebGL demo in FF35+ is bug 1089140.

Regression range:
good=2014-10-15
bad=2014-10-16
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=62f0b771583c&tochange=a280a03c9f3c
Duplicate of this bug: 1122285
Summary: crash in mozilla::gl::ReadbackSharedSurface(mozilla::gl::SharedSurface*, mozilla::gfx::DrawTarget*) → crash in mozilla::gl::ReadbackSharedSurface(mozilla::gl::SharedSurface*, mozilla::gfx::DrawTarget*) with HWA on and OMTC off
Version: unspecified → 36 Branch
Given that this is a but with OMTC disabled, do we need to fix this? Are there still system configurations for which OMTC should be disabled?
Flags: needinfo?(milan)
Yes this should be fixed! OMTC causes issues on many systems.
Tab freeze and hang because of it for example. See here: http://forums.mozillazine.org/viewtopic.php?f=9&t=2880521
Comment on attachment 8551901 [details] [diff] [review]
Catch D3D11 canvas draw target failure.  Speculative patch.  r=bschouten

Review of attachment 8551901 [details] [diff] [review]:
-----------------------------------------------------------------

As far as I can tell this contains purely improvements :-).
Attachment #8551901 - Flags: review?(bas) → review+
Assignee: nobody → milan
The OS X try failure should be OK.
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/abb68e8a8831
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla38
mozilla38? This NEEDS to be pushed up to mozilla36, the branch where it first broke. Users unable to use OMTC due to the freezing issue won't be pleased when Google Maps crashes their browser for three months.
Thanks for the Fx38 fix.

Blackwind is right, this fix should be pushed to Fx36/37 asap and btw. not only 'Google Maps' is affected, Youtube and probably other websites crash Fx36 too.
So, Aris+blackwind, it sounds like this does deal with the problem on 38?  Just want to confirm so that we don't uplift something that doesn't actually help.
Flags: needinfo?(bugzilla)
Flags: needinfo?(aris-t2)
I can confirm Fx38 nighly builds don't crash anymore with HWA on and OMTC off.
Flags: needinfo?(aris-t2)
Comment on attachment 8551901 [details] [diff] [review]
Catch D3D11 canvas draw target failure.  Speculative patch.  r=bschouten

Approval Request Comment
[Feature/regressing bug #]:
[User impact if declined]: The community is using HWA on/OMTC off to work around existing bugs, so the Genie is out of the bottle.
[Describe test coverage new/current, TreeHerder]:
[Risks and why]: Low risk.  This is for the most part a null pointer check with better reporting if something goes wrong.
[String/UUID change made/needed]: n/a
Flags: needinfo?(bugzilla)
Attachment #8551901 - Flags: approval-mozilla-beta?
Attachment #8551901 - Flags: approval-mozilla-aurora?
Attachment #8551901 - Flags: approval-mozilla-beta?
Attachment #8551901 - Flags: approval-mozilla-beta+
Attachment #8551901 - Flags: approval-mozilla-aurora?
Attachment #8551901 - Flags: approval-mozilla-aurora+
Marking as tracking- for 37. This bug has already been uplifted so it should ship in 36+.
Fixed in Fx 37 (2015-01-29).
Not fixed in Fx 36 beta 4 yet, probably in Fx 36 beta 5.
Despite of my yesterdays report where the crash was fixed for "maps.google.com" a crash can still be reproduced on Youtube using Fx 37 or Fx 36b5.

E.g. here: https://www.youtube.com/watch?v=upZAIN0dahU

- Fx 36b5 / 37
- new profile
- no add-ons installed
- all plugins disabled
- HWA on
- OMTC off

Crash reports
https://crash-stats.mozilla.com/report/index/5a80b497-a1f4-472f-8142-96bab2150130
https://crash-stats.mozilla.com/report/index/f2659070-e4d9-49db-a776-1cc6d2150130
https://crash-stats.mozilla.com/report/index/ba6af5e3-2b50-4286-90df-c14c42150130
Yeah, I think this is hitting bug 1099074 where we go into D2D1.1 and D3D10, which we do not want to.  That one's in review.
I reproduced the crash on Windows 7 x64, with Firefox 36 Beta 1, using scenarios from comment 0 and comment 2. 

The crash no longer reproduces on the same environment, with the same scenarios, when using:
- Firefox 36 Beta 7 - BuildID: 20150205114429
- latest Firefox 37 Aurora - BuildID: 20150205004014
- latest Firefox 38 Nightly - BuildID: 20150205030205

Note though that the behavior for Aurora 37 is very weird in these scenarios:
- http://www.goodboydigital.com/pixijs/examples/25/ - displays upside down
- http://mapy.google.cz/ - displays ok, until you zoom out 3-4 times, then zoom in 3-4 times, after which the whole map also displays upside down
The above behavior affects only 37 Aurora (no issue on Beta 36 and Nightly 38). Does this issue sound familiar to anyone? Otherwise I guess I should file a new issue.

I crashed with scenario from comment 20, but with signature from bug 1099074. I also got the signature from comment 20 on Aurora 37 after navigating on http://mapy.google.cz/ for a while. I cannot reproduce that consistently though.

Since Socorro [1] also no longer shows any crashes after this fix landed in any of the branches, I'm closing this now. I would like though some feedback on the Aurora 37 issues.

[1] - https://crash-stats.mozilla.com/report/list?product=Firefox&range_unit=days&range_value=28&signature=mozilla%3A%3Agl%3A%3AReadbackSharedSurface%28mozilla%3A%3Agl%3A%3ASharedSurface%2A%2C+mozilla%3A%3Agfx%3A%3ADrawTarget%2A%29#tab-reports
You need to log in before you can comment on or make changes to this bug.