FF41 startup crash in @0x0 | AllocateCB(void*, _D3DDDICB_ALLOCATE*)

RESOLVED FIXED in Firefox 39

Status

()

defect
--
critical
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: dmajor, Assigned: dvander)

Tracking

({crash})

unspecified
mozilla41
x86
Windows NT
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox39+ fixed, firefox40+ fixed, firefox41+ fixed)

Details

(crash signature)

Attachments

(1 attachment)

Reporter

Description

4 years ago
This bug was filed from the Socorro interface and is 
report bp-e7995c0f-5e66-483a-820d-673a22150528.
=============================================================

0024ce84 6a15a739 0x0
0024cfbc 7363d3f7 d3d11!NDXGI::CDevice::AllocateCB+0x15b
0024cff0 70c01101 D3D10Level9!AllocateCB+0x39
0024d04c 70952060 nvd3dum+0x6c1101
0024d288 70950352 nvd3dum+0x412060
0024d2c0 7095076f nvd3dum+0x410352
0024d634 70a47d9a nvd3dum+0x41076f
0024d660 70a7f23c nvd3dum+0x507d9a
0024d6a0 70a7ec70 nvd3dum+0x53f23c
0024d6c4 70a963af nvd3dum+0x53ec70
0024d6f0 70a96772 nvd3dum+0x5563af
0024d7e8 70c111bd nvd3dum+0x556772
0024da00 70c1735a nvd3dum+0x6d11bd
0024df78 70bde308 nvd3dum+0x6d735a
0024dfa0 73650639 nvd3dum+0x69e308
0024dff8 7364fbfb D3D10Level9!LDDMUMResource::CreateUnderlying+0x326
0024e044 73650853 D3D10Level9!UMResource::CreateWorker+0x473
0024e138 73642d96 D3D10Level9!UMResource::Create+0x17e
0024e170 6a16281b D3D10Level9!UMDevice::CreateResource_Default+0x8a
0024e200 6a1628f9 d3d11!CResource<ID3D11Texture2D>::CLS::FinalConstruct+0x18e
0024e21c 6a162955 d3d11!CTexture2D::CLS::FinalConstruct+0x35
0024e22c 6a144c2a d3d11!TCLSWrappers<CTexture2D>::CLSFinalConstructFn+0x13
0024e270 6a1552c9 d3d11!CLayeredObjectWithCLS<CDepthStencilState>::FinalConstruct+0x61
0024e2a8 6a156333 d3d11!CLayeredObjectWithCLS<CTexture2D>::CreateInstance+0x68
0024e4d8 6a141afe d3d11!CDevice::CreateLayeredChild+0x135
0024e4f8 6a157a3a d3d11!CBridgeImpl<ID3D11LayeredDevice,ID3D11LayeredDevice,CLayeredObject<CDevice> >::CreateLayeredChild+0x22
0024e524 6a157e65 d3d11!CD3D11LayeredChild<ID3D11DeviceChild,NDXGI::CDevice,64>::FinalConstruct+0x2a
0024e540 6a1588b3 d3d11!NDXGI::CDeviceChild<IDXGIResource>::FinalConstruct+0x1b
0024e560 6a15a3c5 d3d11!NDXGI::CResource::FinalConstruct+0x23
0024e59c 6a15a592 d3d11!CLayeredObject<NDXGI::CResource>::CreateInstance+0x68
0024e61c 6a141bfa d3d11!NDXGI::CDevice::CreateLayeredChild+0x135
0024e63c 6a15c6c8 d3d11!CBridgeImpl<ID3D11LayeredDevice,ID3D11LayeredDevice,CLayeredObject<NDXGI::CDevice> >::CreateLayeredChild+0x22
0024e664 6a15c95d d3d11!NOutermost::CDeviceChild::FinalConstruct+0x29
0024e698 6a15ceae d3d11!CUseCountedObject<NOutermost::CDeviceChild>::CUseCountedObject<NOutermost::CDeviceChild>+0x48
0024e6e0 6a15d00a d3d11!CUseCountedObject<NOutermost::CDeviceChild>::CreateInstance+0x6e
0024e77c 6a1484ed d3d11!NOutermost::CDevice::CreateLayeredChild+0xd0
0024e884 6a149c80 d3d11!CDevice::CreateTexture2D_Worker+0x12b
0024e8a0 5f2610e9 d3d11!CDevice::CreateTexture2D+0x1a
0024e944 5ee7c27b xul!DoesD3D11TextureSharingWorkInternal+0x1ad
0024ea68 5eb5f693 xul!gfxWindowsPlatform::InitD3D11Devices+0x31d149
0024ea78 5e9f8078 xul!gfxWindowsPlatform::gfxWindowsPlatform+0xc5
0024eab8 5ec2bcdb xul!gfxPlatform::Init+0x10f
0024eac0 5e6e9d22 xul!CreateVsyncRefreshTimer+0x64
0024eae0 5e6e976d xul!nsRefreshDriver::ChooseTimer+0x6b
0024eb34 5e97a11e xul!nsRefreshDriver::EnsureTimerStarted+0x55
0024eb5c 5ea70e1a xul!nsPresContext::Init+0x19e
0024ebac 5ea719a6 xul!nsDocumentViewer::InitInternal+0xc5
0024ebcc 5e9b417d xul!nsDocumentViewer::Init+0x19
0024ecf0 5e9b147a xul!nsDocShell::SetupNewViewer+0x335
0024ed08 5e9b1dc2 xul!nsDocShell::Embed+0x20
0024ed5c 5e9b1101 xul!nsDocShell::CreateAboutBlankContentViewer+0x17a
0024ed70 5eaba2b9 xul!nsDocShell::CreateAboutBlankContentViewer+0x18
0024eed0 5eabaa29 xul!nsWebShellWindow::Initialize+0x2a9
0024efd4 5eabb144 xul!nsAppShellService::JustCreateTopWindow+0x1d1
0024f008 5e9ed6de xul!nsAppShellService::CreateTopLevelWindow+0x32
0024f048 5e92d0ca xul!nsAppStartup::CreateChromeWindow2+0x76
0024f258 5e92d477 xul!nsWindowWatcher::OpenWindowInternal+0xbb7
0024f2a4 5fd620b8 xul!nsWindowWatcher::OpenWindow+0x62
0024f384 5ee621d8 xul!ShowProfileManager+0x17d
0024f474 5eb1c564 xul!SelectProfile+0x346f09
0024f540 5eb1c94a xul!XREMain::XRE_mainStartup+0x204
0024f560 5ec89314 xul!XREMain::XRE_main+0x151
0024f6d8 01191699 xul!XRE_main+0x34
0024f874 011912ec firefox!do_main+0x159
0024f90c 011910de firefox!NS_internal_main+0xec
0024f920 01192534 firefox!wmain+0xbe
0024f968 76adee1c firefox!__tmainCRTStartup+0xfe
0024f974 76e037eb kernel32!BaseThreadInitThunk+0xe
0024f9b4 76e037be ntdll!__RtlUserThreadStart+0x70
0024f9cc 00000000 ntdll!_RtlUserThreadStart+0x1b
Reporter

Comment 1

4 years ago
[Tracking Requested - why for this release]: High volume startup crash in 41.0a1
Reporter

Comment 2

4 years ago
There was a large spike in build 20150528030206: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ff2e07228041&tochange=baa9c64fea6f

The numbers in later builds are a little lower but still present. Unclear whether something was fixed/backed out right away, or whether the affected users switched away.

Milan could you route this to an owner?
Flags: needinfo?(milan)
Thanks David.

This crashes in CreateTexture2D inside of DoesD3D11TextureSharingWorkInternal, which is supposed to save us from getting in trouble.

Matt, bug 1156535 is in the regression range, though I admit it doesn't look "guilty" at a first glance.
David, until Matt shows up - let's jump on this startup crash, and just drop in the bug anything you come up with.
Flags: needinfo?(milan)
Flags: needinfo?(matt.woodrow)
Flags: needinfo?(dvander)
Flags: needinfo?(bas)
Reporter

Comment 4

4 years ago
Nothing suspicious on App Notes (or maybe the crashes happen before that).

Adapter device id facet Rank 	Adapter device id 	Count 	%
1 	0x029d 	943 	60.03 %
2 	0x03d6 	266 	16.93 %
3 	0x03d0 	108 	6.87 %
4 	0x01d3 	91 	5.79 %
[plus a long tail]

Rank 	Adapter driver version 	Count 	%
1 	9.18.13.900 	943 	60.03 %
2 	8.17.11.9713 	243 	15.47 %
3 	9.18.13.783 	99 	6.30 %
4 	9.18.13.774 	98 	6.24 %
[plus a long tail]
Reporter

Comment 5

4 years ago
Only seen on Win7 and Win7SP1.
(In reply to Milan Sreckovic [:milan] from comment #3)
> Thanks David.
> 
> This crashes in CreateTexture2D inside of
> DoesD3D11TextureSharingWorkInternal, which is supposed to save us from
> getting in trouble.
> 
> Matt, bug 1156535 is in the regression range, though I admit it doesn't look
> "guilty" at a first glance.
> David, until Matt shows up - let's jump on this startup crash, and just drop
> in the bug anything you come up with.

bug 1156135 * isn't in the build for this crash report.
(In reply to David Anderson [:dvander] from comment #6)
> ...
> bug 1156135 * isn't in the build for this crash report.

I was just looking at the pushlog from comment 2.
Is this D3D10Level9.dll relevant?  Was there a driver update that happened?
These look like older nVidia graphics cards (like Quadro FX 3500, Geforce 7025) on drivers released around late 2013. Nothing in the regression range really stands out though.
(In reply to Milan Sreckovic [:milan] from comment #7)
> (In reply to David Anderson [:dvander] from comment #6)
> > ...
> > bug 1156135 * isn't in the build for this crash report.
> 
> I was just looking at the pushlog from comment 2.

Yeah I know - just clearing its blame for Matt :)
Flags: needinfo?(dvander)
Flags: needinfo?(jmuizelaar)
David, are we sure about the regression range from comment 2 as far as the spike goes?
Flags: needinfo?(dmajor)
We shouldn't be ending up in this code for D3D10 Level 9, only 10 and higher.
It looks like this call is not wrapped in a MOZ_SEH_TRY block, and probably never was. But, we also introduced a new call to it in bug 1153123 (landed May 13 2015).

https://hg.mozilla.org/mozilla-central/rev/57acaa90d7c6

And in fact this is the callsite that is crashing in the report.
Reporter

Comment 14

4 years ago
(In reply to Milan Sreckovic [:milan] from comment #11)
> David, are we sure about the regression range from comment 2 as far as the spike goes?

After a closer look it seems the data are skewed by a couple of extremely persistent reporters.

5 	20150527030204 	52
4 	20150527135446 	54
1 	20150528030206 	1051  <-- but 938 of them were from one user
6 	20150529030205 	46
2 	20150530030205 	295   <-- but 238 of them were from one (different) user
3 	20150531030228 	75

Taking the 0527 build as the start date, the range would be https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=c6bbf8f1b02b&tochange=ff2e07228041
Flags: needinfo?(dmajor)
Reporter

Comment 15

4 years ago
It seems dvander and I came to the same conclusion. The patch is dated May 13 but it reached m-c in the 0527 nightly.
Blocks: 1153123
dvander is going to put a quick patch together and see if we can land it today, save us the time difference with Matt.
Posted patch possible fixSplinter Review
Don't call CreateTexture2D on D3D_FEATURE_LEVEL_9.
Attachment #8613698 - Flags: review?(matt.woodrow)
Assignee: nobody → dvander
Comment on attachment 8613698 [details] [diff] [review]
possible fix

Adding Jeff, in case he can get to it quicker.
Attachment #8613698 - Flags: review?(jmuizelaar)
Comment on attachment 8613698 [details] [diff] [review]
possible fix

Review of attachment 8613698 [details] [diff] [review]:
-----------------------------------------------------------------

Sure. Bas can do a post commit review. Maybe add a comment about why this check is moving...
Attachment #8613698 - Flags: review?(jmuizelaar) → review+
Status: NEW → ASSIGNED
Comment on attachment 8613698 [details] [diff] [review]
possible fix

Review of attachment 8613698 [details] [diff] [review]:
-----------------------------------------------------------------

Seems fine since we don't allow < 10.0 devices using D2D anyway.
Attachment #8613698 - Flags: review?(matt.woodrow) → review+
With this patch in the latest nightly, are we seeing any improvement in the crash numbers?
Flags: needinfo?(matt.woodrow)
Flags: needinfo?(jmuizelaar)
Flags: needinfo?(dmajor)
Flags: needinfo?(bas)
Reporter

Comment 23

4 years ago
We don't have much data on the 0602 nightly yet. I'll be keeping an eye on this throughout the day.
Reporter

Comment 24

4 years ago
No hits so far but it's still early. I'll do one more check tomorrow morning.

Comment 25

4 years ago
Tracking because it affects Firefox 41, will stay posted for updated crash numbers.
Reporter

Comment 26

4 years ago
Looks good; no crashes on nightly 0602. Thanks all for the quick turnaround on this one.
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
Flags: needinfo?(dmajor)
Resolution: --- → FIXED
Target Milestone: --- → mozilla41
Comment on attachment 8613698 [details] [diff] [review]
possible fix

Approval Request Comment
[Feature/regressing bug #]: Bug 1153123
[User impact if declined]: Crashes if bug 1153123 is uplifted.
[Describe test coverage new/current, TreeHerder]: Verified using crashstats.
[Risks and why]: Low risk.
[String/UUID change made/needed]: None
Attachment #8613698 - Flags: approval-mozilla-beta?
Attachment #8613698 - Flags: approval-mozilla-aurora?
Marking affected for 39 and 40 since we are uplifting bug 1153123.
Comment on attachment 8613698 [details] [diff] [review]
possible fix

Approved for uplift to aurora and beta, in hopes of avoiding a startup crash and black video screen crashes. This uplift may be a bit risky but we need to try it.
Attachment #8613698 - Flags: approval-mozilla-beta?
Attachment #8613698 - Flags: approval-mozilla-beta+
Attachment #8613698 - Flags: approval-mozilla-aurora?
Attachment #8613698 - Flags: approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.