crash in mozilla::layers::CanvasLayerD3D10::UpdateSurface() in HTML5 Blizzard Demo with OMTC disabled

VERIFIED FIXED in Firefox 36

Status

()

defect
--
critical
VERIFIED FIXED
5 years ago
5 years ago

People

(Reporter: epinal99-bugzilla2, Assigned: jrmuizel)

Tracking

({crash, regression})

36 Branch
mozilla36
x86
Windows NT
Points:
---

Firefox Tracking Flags

(firefox35 unaffected, firefox36+ verified, firefox37 verified, firefox38 unaffected)

Details

(crash signature)

Attachments

(1 attachment, 1 obsolete attachment)

This bug was filed from the Socorro interface and is 
report bp-de3cba11-95bb-433e-b4f6-5c9e62141114.
=============================================================

STR:
1) disable OMTC (layers.offmainthreadcomposition.enabled=false) and restart FF
2) open http://ie.microsoft.com/testdrive/HTML5/Blizzard/Default.html

Result: instant crash.

Adapter Description	Intel(R) HD Graphics 3000
Adapter Description (GPU #2)	NVIDIA GeForce GT 550M
Adapter Drivers	igdumd64 igd10umd64 igd10umd64 igdumd32 igd10umd32 igd10umd32
Adapter Drivers (GPU #2)	nvd3dumx,nvwgf2umx,nvwgf2umx nvd3dum,nvwgf2um,nvwgf2um
Adapter RAM	Unknown
Adapter RAM (GPU #2)	2048
ClearType Parameters	Gamma: 2200 Pixel Structure: R ClearType Level: 100 Enhanced Contrast: 50
Device ID	0x0116
Device ID (GPU #2)	0x0df6
Direct2D Enabled	true
DirectWrite Enabled	true (6.2.9200.16571)
Driver Date	1-29-2014
Driver Date (GPU #2)	9-13-2014
Driver Version	9.17.10.3347
Driver Version (GPU #2)	9.18.13.4411
GPU #2 Active	false
GPU Accelerated Windows	1/1 Direct3D 10
Subsys ID	17121043
Subsys ID (GPU #2)	17121043
Vendor ID	0x8086
Vendor ID (GPU #2)	0x10de
WebGL Renderer	Google Inc. -- ANGLE (Intel(R) HD Graphics 3000 Direct3D9Ex vs_3_0 ps_3_0)
windowLayerManagerRemote	false
AzureCanvasBackend	direct2d 1.1
AzureContentBackend	direct2d 1.1
AzureFallbackCanvasBackend	cairo
AzureSkiaAccelerated	0
It's a fresh regression:

good=2014-11-12
bad=2014-11-13
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=688f821edcd4&tochange=ab137ddd3746

Suspected bugs:
Michael Wu — Bug 1082827: Allow D2D 1.1 to be selected for the canvas backend. r=bas
Bas Schouten — Bug 1097293: Do not draw radial gradients when centers and radii are identical. r=jrmuizel When Cinner and Couter are equal, as well as Rinner and Router, the algorithm described in the canvas specification will hit a division by 0. As described in section 7 of the Canvas2D specification nothing should be drawn in this situation.
Note we're turning off D2D 1.1 in Aurora, so this would only continue being an issue in the nightly until we sort it out.
See Also: → 1095608
Tracking to make sure we are disabling D2D 1.1 in aurora.
Confirmed for me as well - crashes every time with OMTC off on a simple canvas test, e.g. http://html5demos.com/canvas

Crash reports:
bp-e63432a7-e449-429b-88ee-c1bf12141130
bp-2b8a254f-e1ca-433f-a3e4-d691a2141130
bp-f939e60b-56d5-44a4-9ac3-dc20b2141130
That's on an ATI card, on 37.0a1 nightly, by the way.

GPU details:

Adapter Description	AMD Radeon HD 6800 Series
Adapter Drivers	aticfx64 aticfx64 aticfx64 aticfx32 aticfx32 aticfx32 atiumd64 atidxx64 atidxx64 atiumdag atidxx32 atidxx32 atiumdva atiumd6a atitmm64
Adapter RAM	1024
ClearType Parameters	Gamma: 2200 Pixel Structure: R ClearType Level: 0 Enhanced Contrast: 200
Device ID	0x6738
Direct2D Enabled	true
DirectWrite Enabled	true (6.2.9200.16492)
Driver Date	12-6-2013
Driver Version	13.251.0.0
GPU #2 Active	false
GPU Accelerated Windows	1/1 Direct3D 10
Subsys ID	174b174b
Vendor ID	0x1002
WebGL Renderer	Google Inc. -- ANGLE (AMD Radeon HD 6800 Series Direct3D9Ex vs_3_0 ps_3_0)
windowLayerManagerRemote	false
AzureCanvasBackend	direct2d 1.1
AzureContentBackend	direct2d 1.1
AzureFallbackCanvasBackend	cairo
AzureSkiaAccelerated	0
Thanks for the info Mark; this should work on Aurora, where D2D1.1 is disabled.  Bas do we have a bug open for "re-enable D2D1.1 by default"?  This one should block it.
Flags: needinfo?(bas)
(In reply to Milan Sreckovic [:milan] from comment #6)
> Thanks for the info Mark; this should work on Aurora, where D2D1.1 is
> disabled.  Bas do we have a bug open for "re-enable D2D1.1 by default"? 
> This one should block it.

Do we -need- this to work. I still have patches to remove all this on-main-thread code from the tree and I'd like to do that anyway. OMTC off is broken in different ways these days since we're no longer testing it.
Flags: needinfo?(bas)
Didn't notice this was OMTC off only issue despite it being in the summary :)
Is D2D1.1 enabled in 36 beta?
(In reply to Milan Sreckovic [:milan] from comment #10)
> Is D2D1.1 enabled in 36 beta?

Yes
Comment on attachment 8551975 [details] [diff] [review]
Disable non-OMTC / D2D1.1 combination. r=bschouten

Review of attachment 8551975 [details] [diff] [review]:
-----------------------------------------------------------------

We're disabling non-OMTC in the coming days, is this patch still useful?
If we're disabling non-OMTC all the way up to beta, then, no, we don't need this patch.
Assuming disabling non-OMTC (bug 1097699) would ride the train, do we want this on aurora+beta?
Flags: needinfo?(bas)
(In reply to Milan Sreckovic [:milan] from comment #13)
> If we're disabling non-OMTC all the way up to beta, then, no, we don't need
> this patch.

D2D 1.1 shouldn't be enabled on Beta I believe.
Flags: needinfo?(bas)
(In reply to Bas Schouten (:bas.schouten) from comment #15)
> D2D 1.1 shouldn't be enabled on Beta I believe.

I thought it is on in 36 (which is beta now)? If it is and should not be, we ought to correct that soon so we don't release it...
Comment 11 and comment 15 disagree, but comment 0 wins suggesting we do have D2D1.1 on 36/beta :)  Let's just get this reviewed as if we needed it, to make sure the patch is a correct one, and we can have a bit more conversation on whether we want it.
Assignee: nobody → milan
Flags: needinfo?(bas)
Comment on attachment 8551975 [details] [diff] [review]
Disable non-OMTC / D2D1.1 combination. r=bschouten

Review of attachment 8551975 [details] [diff] [review]:
-----------------------------------------------------------------

It should be easier and better to not separate the choice between content and canvas
Attachment #8551975 - Flags: review?(bas) → review-
Attachment #8551975 - Attachment is obsolete: true
Attachment #8557256 - Flags: review?(bgirard)
Attachment #8557256 - Flags: review?(bas)
Comment on attachment 8557256 [details] [diff] [review]
Don't enable D2D1.1 with non-OMTC

Review of attachment 8557256 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/thebes/gfxWindowsPlatform.cpp
@@ +524,5 @@
>        if (gfxPrefs::Direct2DUse1_1() && Factory::SupportsD2D1() &&
> +          GetD3D11ContentDevice() &&
> +          // Bug 1099074 suggests that we don't handle D2D1.1 and non-OMTC D3D10
> +          // very well so only enable D2D1.1 if we have OMTC
> +          OffMainThreadCompositingEnabled()) {

Can you verify the following. Looks like we're conflating d2d, d2d 1.0 and d2d 1.1.:

http://mxr.mozilla.org/mozilla-central/source/gfx/layers/d3d11/TextureD3D11.cpp#428
http://mxr.mozilla.org/mozilla-central/source/gfx/thebes/gfxWindowsPlatform.cpp#367
Comment on attachment 8557256 [details] [diff] [review]
Don't enable D2D1.1 with non-OMTC

Looks good, we discussed the problematic cases in person. Turns out its ok because we have a different device for rendering and rasterization.
Attachment #8557256 - Flags: review?(bgirard)
Attachment #8557256 - Flags: review?(bas)
Attachment #8557256 - Flags: review+
Comment on attachment 8557256 [details] [diff] [review]
Don't enable D2D1.1 with non-OMTC

Approval Request Comment
[Feature/regressing bug #]: Enabling D2D1.1
[User impact if declined]: Crashes if the users have explicitly disabled omtc (which it seems was pretty common)
[Describe test coverage new/current, TreeHerder]: Not very much
[Risks and why]: Limited risk, this shouldn't add any new configurations.
Attachment #8557256 - Flags: approval-mozilla-beta?
Attachment #8557256 - Flags: approval-mozilla-aurora?
For the sheriffs - we only need this patch on 36/37, we don't need it on 38 where non-OMTC is disabled.  Unless, Jeff, we want it on central "just in case"?
Assignee: milan → jmuizelaar
Attachment #8557256 - Flags: approval-mozilla-beta?
Attachment #8557256 - Flags: approval-mozilla-beta+
Attachment #8557256 - Flags: approval-mozilla-aurora?
Attachment #8557256 - Flags: approval-mozilla-aurora+
Jeff, thanks for getting to this on a Saturday.  It'll let us catch the next beta build.
Flags: needinfo?(bas)
Target Milestone: --- → mozilla36
I reproduced the crash with steps from comment 0, on Windows 7 x64, with Firefox 36 Beta 1. The crash no longer occurs on the same environment and with the same steps on:
- Firefox 36 Beta 8 - BuildID=20150209164123
- latest Firefox 37 Aurora - BuildID=20150210004330

Also, Socorro [1] shows no more crashes after 36 Beta 5, and Aurora 37 builds after January 27th.

[1] - https://crash-stats.mozilla.com/report/list?product=Firefox&range_unit=days&range_value=28&signature=mozilla%3A%3Alayers%3A%3ACanvasLayerD3D10%3A%3AUpdateSurface%28%29#tab-reports
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.