1121635 - Crashes [@ mozilla::gfx::PathD2D::GetBounds(const mozilla::gfx::Matrix & aTransform)] when arch:AVX is specified

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect)

Description

[Ryan VanderMeulen [:RyanVM]]

These are with my local Win64 builds on Win8.1. Both times I've hit this were tied to closing a tab IIRC.

Stack from the debugger:
xul.dll!mozilla::gfx::PathD2D::GetBounds(const mozilla::gfx::Matrix & aTransform) Line 417	C++
xul.dll!gfxContext::GetAzureDeviceSpaceClipBounds() Line 1260	C++
xul.dll!gfxContext::GetClipExtents() Line 649	C++
xul.dll!mozilla::layers::BasicLayerManager::EndTransactionInternal(void (mozilla::layers::PaintedLayer *, gfxContext *, const nsIntRegion &, mozilla::layers::DrawRegionClip, const nsIntRegion &, void *) * aCallback, void * aCallbackData, mozilla::layers::LayerManager::EndTransactionFlags aFlags) Line 517	C++
xul.dll!nsSVGIntegrationUtils::PaintFramesWithEffects(gfxContext & aContext, nsIFrame * aFrame, const nsRect & aDirtyRect, nsDisplayListBuilder * aBuilder, mozilla::layers::LayerManager * aLayerManager) Line 547	C++
xul.dll!mozilla::PaintInactiveLayer(nsDisplayListBuilder * aBuilder, mozilla::layers::LayerManager * aManager, nsDisplayItem * aItem, gfxContext * aContext, nsRenderingContext * aCtx) Line 2668	C++
xul.dll!mozilla::FrameLayerBuilder::PaintItems(nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem> & aItems, const nsIntRect & aRect, gfxContext * aContext, nsRenderingContext * aRC, nsDisplayListBuilder * aBuilder, nsPresContext * aPresContext, const nsIntPoint & aOffset, float aXScale, float aYScale, int aCommonClipCount) Line 4424	C++
xul.dll!mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer * aLayer, gfxContext * aContext, const nsIntRegion & aRegionToDraw, mozilla::layers::DrawRegionClip aClip, const nsIntRegion & aRegionToInvalidate, void * aCallbackData) Line 4622	C++
xul.dll!mozilla::layers::ClientPaintedLayer::PaintThebes() Line 83	C++
xul.dll!mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback(mozilla::layers::ReadbackProcessor * aReadback) Line 132	C++
xul.dll!mozilla::layers::ClientContainerLayer::RenderLayer() Line 71	C++
xul.dll!mozilla::layers::ClientLayerManager::EndTransactionInternal(void (mozilla::layers::PaintedLayer *, gfxContext *, const nsIntRegion &, mozilla::layers::DrawRegionClip, const nsIntRegion &, void *) * aCallback, void * aCallbackData, mozilla::layers::LayerManager::EndTransactionFlags __formal) Line 269	C++
xul.dll!mozilla::layers::ClientLayerManager::EndTransaction(void (mozilla::layers::PaintedLayer *, gfxContext *, const nsIntRegion &, mozilla::layers::DrawRegionClip, const nsIntRegion &, void *) * aCallback, void * aCallbackData, mozilla::layers::LayerManager::EndTransactionFlags aFlags) Line 304	C++
xul.dll!nsDisplayList::PaintRoot(nsDisplayListBuilder * aBuilder, nsRenderingContext * aCtx, unsigned int aFlags) Line 1647	C++
xul.dll!nsLayoutUtils::PaintFrame(nsRenderingContext * aRenderingContext, nsIFrame * aFrame, const nsRegion & aDirtyRegion, unsigned int aBackstop, unsigned int aFlags) Line 3191	C++
xul.dll!PresShell::Paint(nsView * aViewToPaint, const nsRegion & aDirtyRegion, unsigned int aFlags) Line 6337	C++
xul.dll!nsViewManager::ProcessPendingUpdatesPaint(nsIWidget * aWidget) Line 443	C++
xul.dll!nsViewManager::ProcessPendingUpdatesForView(nsView * aView, bool aFlushDirtyRegion) Line 380	C++
xul.dll!nsRefreshDriver::Tick(__int64 aNowEpoch, mozilla::TimeStamp aNowTime) Line 1396	C++
xul.dll!mozilla::RefreshDriverTimer::Tick() Line 153	C++
xul.dll!nsTimerImpl::Fire() Line 632	C++
xul.dll!nsTimerEvent::Run() Line 729	C++
xul.dll!nsThread::ProcessNextEvent(bool aMayWait, bool * aResult) Line 861	C++
xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate * aDelegate) Line 141	C++
xul.dll!MessageLoop::Run() Line 201	C++
xul.dll!nsBaseAppShell::Run() Line 166	C++
xul.dll!nsAppShell::Run() Line 178	C++
xul.dll!nsAppStartup::Run() Line 282	C++
xul.dll!XREMain::XRE_mainRun() Line 4142	C++
xul.dll!XREMain::XRE_main(int argc, char * * argv, const nsXREAppData * aAppData) Line 4217	C++
xul.dll!XRE_main(int argc, char * * argv, const nsXREAppData * aAppData, unsigned int aFlags) Line 4437	C++
firefox.exe!do_main(int argc, char * * argv, nsIFile * xreDirectory) Line 292	C++
firefox.exe!NS_internal_main(int argc, char * * argv) Line 663	C++
firefox.exe!wmain(int argc, wchar_t * * argv) Line 124	C++
[External Code]

Comment 1

[Kartikaya Gupta (email:[e-mail])]

If you caught it in a debugger, did you see if mGeometry was null at that line? I looked at all the places its initialized and I didn't see any that could possibly pass in a null, and it's a refptr so it seems unlikely that would be a problem.

Comment 2

[Ryan VanderMeulen [:RyanVM]]

I'll check next time I hit it, sorry.

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Attachment: debugger screenshot

Comment 4

[Kartikaya Gupta (email:[e-mail])]

From the screenshot it looks like the PathD2D itself is garbage but I'll leave this for Bas to look into when he gets back.

Comment 5

[Bas Schouten (:bas.schouten)]

(In reply to Kartikaya Gupta (email:[e-mail]) from comment #4)
> From the screenshot it looks like the PathD2D itself is garbage but I'll
> leave this for Bas to look into when he gets back.

Yup, that's what it looks like.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Bas, is there anything more I can do to help debug this? I'm still hitting these at least once a day. The common theme seems to be that they happen near to closing a tab.

Comment 7

[Milan Sreckovic [:milan] (needinfo for best results)]

What's your about:support look like for graphics?

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Attachment: about:support graphics section

See attached.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

I still hit this on a near-daily basis. What can I do to help move this along? I'm going to have to start using Chrome to sheriff because the cost of losing all my context is pretty killer.

Comment 10

[Milan Sreckovic [:milan] (needinfo for best results)]

IRC with Bas:
15:11 Bas: milan: Hrm, that inconsistency is a little odd.
15:12 Bas: milan: But it still seems unlikely it would cause that bug. I'll look some more.

Ryan, we may need to get you an "extra instrumented" build if we can't sort this out just by looking at stack and the code.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Happy to build with whatever patches you want me to :)

Comment 12

[Ryan VanderMeulen [:RyanVM]]

This is almost certainly caused by using the arch:AVX MSVC compiler option. No crashes since that was removed.