1170211 - FF41 startup crash in @0x0 | AllocateCB(void*, _D3DDDICB_ALLOCATE*)

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[(Away)]

This bug was filed from the Socorro interface and is 
report bp-e7995c0f-5e66-483a-820d-673a22150528.
=============================================================

0024ce84 6a15a739 0x0
0024cfbc 7363d3f7 d3d11!NDXGI::CDevice::AllocateCB+0x15b
0024cff0 70c01101 D3D10Level9!AllocateCB+0x39
0024d04c 70952060 nvd3dum+0x6c1101
0024d288 70950352 nvd3dum+0x412060
0024d2c0 7095076f nvd3dum+0x410352
0024d634 70a47d9a nvd3dum+0x41076f
0024d660 70a7f23c nvd3dum+0x507d9a
0024d6a0 70a7ec70 nvd3dum+0x53f23c
0024d6c4 70a963af nvd3dum+0x53ec70
0024d6f0 70a96772 nvd3dum+0x5563af
0024d7e8 70c111bd nvd3dum+0x556772
0024da00 70c1735a nvd3dum+0x6d11bd
0024df78 70bde308 nvd3dum+0x6d735a
0024dfa0 73650639 nvd3dum+0x69e308
0024dff8 7364fbfb D3D10Level9!LDDMUMResource::CreateUnderlying+0x326
0024e044 73650853 D3D10Level9!UMResource::CreateWorker+0x473
0024e138 73642d96 D3D10Level9!UMResource::Create+0x17e
0024e170 6a16281b D3D10Level9!UMDevice::CreateResource_Default+0x8a
0024e200 6a1628f9 d3d11!CResource<ID3D11Texture2D>::CLS::FinalConstruct+0x18e
0024e21c 6a162955 d3d11!CTexture2D::CLS::FinalConstruct+0x35
0024e22c 6a144c2a d3d11!TCLSWrappers<CTexture2D>::CLSFinalConstructFn+0x13
0024e270 6a1552c9 d3d11!CLayeredObjectWithCLS<CDepthStencilState>::FinalConstruct+0x61
0024e2a8 6a156333 d3d11!CLayeredObjectWithCLS<CTexture2D>::CreateInstance+0x68
0024e4d8 6a141afe d3d11!CDevice::CreateLayeredChild+0x135
0024e4f8 6a157a3a d3d11!CBridgeImpl<ID3D11LayeredDevice,ID3D11LayeredDevice,CLayeredObject<CDevice> >::CreateLayeredChild+0x22
0024e524 6a157e65 d3d11!CD3D11LayeredChild<ID3D11DeviceChild,NDXGI::CDevice,64>::FinalConstruct+0x2a
0024e540 6a1588b3 d3d11!NDXGI::CDeviceChild<IDXGIResource>::FinalConstruct+0x1b
0024e560 6a15a3c5 d3d11!NDXGI::CResource::FinalConstruct+0x23
0024e59c 6a15a592 d3d11!CLayeredObject<NDXGI::CResource>::CreateInstance+0x68
0024e61c 6a141bfa d3d11!NDXGI::CDevice::CreateLayeredChild+0x135
0024e63c 6a15c6c8 d3d11!CBridgeImpl<ID3D11LayeredDevice,ID3D11LayeredDevice,CLayeredObject<NDXGI::CDevice> >::CreateLayeredChild+0x22
0024e664 6a15c95d d3d11!NOutermost::CDeviceChild::FinalConstruct+0x29
0024e698 6a15ceae d3d11!CUseCountedObject<NOutermost::CDeviceChild>::CUseCountedObject<NOutermost::CDeviceChild>+0x48
0024e6e0 6a15d00a d3d11!CUseCountedObject<NOutermost::CDeviceChild>::CreateInstance+0x6e
0024e77c 6a1484ed d3d11!NOutermost::CDevice::CreateLayeredChild+0xd0
0024e884 6a149c80 d3d11!CDevice::CreateTexture2D_Worker+0x12b
0024e8a0 5f2610e9 d3d11!CDevice::CreateTexture2D+0x1a
0024e944 5ee7c27b xul!DoesD3D11TextureSharingWorkInternal+0x1ad
0024ea68 5eb5f693 xul!gfxWindowsPlatform::InitD3D11Devices+0x31d149
0024ea78 5e9f8078 xul!gfxWindowsPlatform::gfxWindowsPlatform+0xc5
0024eab8 5ec2bcdb xul!gfxPlatform::Init+0x10f
0024eac0 5e6e9d22 xul!CreateVsyncRefreshTimer+0x64
0024eae0 5e6e976d xul!nsRefreshDriver::ChooseTimer+0x6b
0024eb34 5e97a11e xul!nsRefreshDriver::EnsureTimerStarted+0x55
0024eb5c 5ea70e1a xul!nsPresContext::Init+0x19e
0024ebac 5ea719a6 xul!nsDocumentViewer::InitInternal+0xc5
0024ebcc 5e9b417d xul!nsDocumentViewer::Init+0x19
0024ecf0 5e9b147a xul!nsDocShell::SetupNewViewer+0x335
0024ed08 5e9b1dc2 xul!nsDocShell::Embed+0x20
0024ed5c 5e9b1101 xul!nsDocShell::CreateAboutBlankContentViewer+0x17a
0024ed70 5eaba2b9 xul!nsDocShell::CreateAboutBlankContentViewer+0x18
0024eed0 5eabaa29 xul!nsWebShellWindow::Initialize+0x2a9
0024efd4 5eabb144 xul!nsAppShellService::JustCreateTopWindow+0x1d1
0024f008 5e9ed6de xul!nsAppShellService::CreateTopLevelWindow+0x32
0024f048 5e92d0ca xul!nsAppStartup::CreateChromeWindow2+0x76
0024f258 5e92d477 xul!nsWindowWatcher::OpenWindowInternal+0xbb7
0024f2a4 5fd620b8 xul!nsWindowWatcher::OpenWindow+0x62
0024f384 5ee621d8 xul!ShowProfileManager+0x17d
0024f474 5eb1c564 xul!SelectProfile+0x346f09
0024f540 5eb1c94a xul!XREMain::XRE_mainStartup+0x204
0024f560 5ec89314 xul!XREMain::XRE_main+0x151
0024f6d8 01191699 xul!XRE_main+0x34
0024f874 011912ec firefox!do_main+0x159
0024f90c 011910de firefox!NS_internal_main+0xec
0024f920 01192534 firefox!wmain+0xbe
0024f968 76adee1c firefox!__tmainCRTStartup+0xfe
0024f974 76e037eb kernel32!BaseThreadInitThunk+0xe
0024f9b4 76e037be ntdll!__RtlUserThreadStart+0x70
0024f9cc 00000000 ntdll!_RtlUserThreadStart+0x1b

Comment 1

[(Away)]

[Tracking Requested - why for this release]: High volume startup crash in 41.0a1

Comment 2

[(Away)]

There was a large spike in build 20150528030206: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ff2e07228041&tochange=baa9c64fea6f

The numbers in later builds are a little lower but still present. Unclear whether something was fixed/backed out right away, or whether the affected users switched away.

Milan could you route this to an owner?

Comment 3

[Milan Sreckovic [:milan] (needinfo for best results)]

Thanks David.

This crashes in CreateTexture2D inside of DoesD3D11TextureSharingWorkInternal, which is supposed to save us from getting in trouble.

Matt, bug 1156535 is in the regression range, though I admit it doesn't look "guilty" at a first glance.
David, until Matt shows up - let's jump on this startup crash, and just drop in the bug anything you come up with.

Comment 4

[(Away)]

Nothing suspicious on App Notes (or maybe the crashes happen before that).

Adapter device id facet Rank 	Adapter device id 	Count 	%
1 	0x029d 	943 	60.03 %
2 	0x03d6 	266 	16.93 %
3 	0x03d0 	108 	6.87 %
4 	0x01d3 	91 	5.79 %
[plus a long tail]

Rank 	Adapter driver version 	Count 	%
1 	9.18.13.900 	943 	60.03 %
2 	8.17.11.9713 	243 	15.47 %
3 	9.18.13.783 	99 	6.30 %
4 	9.18.13.774 	98 	6.24 %
[plus a long tail]

Comment 5

[(Away)]

Only seen on Win7 and Win7SP1.

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

(In reply to Milan Sreckovic [:milan] from comment #3)
> Thanks David.
> 
> This crashes in CreateTexture2D inside of
> DoesD3D11TextureSharingWorkInternal, which is supposed to save us from
> getting in trouble.
> 
> Matt, bug 1156535 is in the regression range, though I admit it doesn't look
> "guilty" at a first glance.
> David, until Matt shows up - let's jump on this startup crash, and just drop
> in the bug anything you come up with.

bug 1156135 * isn't in the build for this crash report.

Comment 7

[Milan Sreckovic [:milan] (needinfo for best results)]

(In reply to David Anderson [:dvander] from comment #6)
> ...
> bug 1156135 * isn't in the build for this crash report.

I was just looking at the pushlog from comment 2.

Comment 8

[Milan Sreckovic [:milan] (needinfo for best results)]

Is this D3D10Level9.dll relevant?  Was there a driver update that happened?

Comment 9

[David Anderson [:dvander] - inactive, e-mail if emergency]

These look like older nVidia graphics cards (like Quadro FX 3500, Geforce 7025) on drivers released around late 2013. Nothing in the regression range really stands out though.

Comment 10

[David Anderson [:dvander] - inactive, e-mail if emergency]

(In reply to Milan Sreckovic [:milan] from comment #7)
> (In reply to David Anderson [:dvander] from comment #6)
> > ...
> > bug 1156135 * isn't in the build for this crash report.
> 
> I was just looking at the pushlog from comment 2.

Yeah I know - just clearing its blame for Matt :)

Comment 11

[Milan Sreckovic [:milan] (needinfo for best results)]

David, are we sure about the regression range from comment 2 as far as the spike goes?

Comment 12

[Milan Sreckovic [:milan] (needinfo for best results)]

We shouldn't be ending up in this code for D3D10 Level 9, only 10 and higher.

Comment 13

[David Anderson [:dvander] - inactive, e-mail if emergency]

It looks like this call is not wrapped in a MOZ_SEH_TRY block, and probably never was. But, we also introduced a new call to it in bug 1153123 (landed May 13 2015).

https://hg.mozilla.org/mozilla-central/rev/57acaa90d7c6

And in fact this is the callsite that is crashing in the report.

Comment 14

[(Away)]

(In reply to Milan Sreckovic [:milan] from comment #11)
> David, are we sure about the regression range from comment 2 as far as the spike goes?

After a closer look it seems the data are skewed by a couple of extremely persistent reporters.

5 	20150527030204 	52
4 	20150527135446 	54
1 	20150528030206 	1051  <-- but 938 of them were from one user
6 	20150529030205 	46
2 	20150530030205 	295   <-- but 238 of them were from one (different) user
3 	20150531030228 	75

Taking the 0527 build as the start date, the range would be https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=c6bbf8f1b02b&tochange=ff2e07228041

Comment 15

[(Away)]

It seems dvander and I came to the same conclusion. The patch is dated May 13 but it reached m-c in the 0527 nightly.

Comment 16

[Milan Sreckovic [:milan] (needinfo for best results)]

dvander is going to put a quick patch together and see if we can land it today, save us the time difference with Matt.

Comment 17

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: possible fix

Don't call CreateTexture2D on D3D_FEATURE_LEVEL_9.

Comment 18

[Milan Sreckovic [:milan] (needinfo for best results)]

Comment on attachment 8613698 [details] [diff] [review]
possible fix

Adding Jeff, in case he can get to it quicker.

Comment 19

[Jeff Muizelaar [:jrmuizel]]

Comment on attachment 8613698 [details] [diff] [review]
possible fix

Review of attachment 8613698 [details] [diff] [review]:
-----------------------------------------------------------------

Sure. Bas can do a post commit review. Maybe add a comment about why this check is moving...

Comment 20

[Pulsebot]

https://hg.mozilla.org/mozilla-central/rev/56241c1f8a3b

Comment 21

[Bas Schouten (:bas.schouten)]

Comment on attachment 8613698 [details] [diff] [review]
possible fix

Review of attachment 8613698 [details] [diff] [review]:
-----------------------------------------------------------------

Seems fine since we don't allow < 10.0 devices using D2D anyway.

Comment 22

[Milan Sreckovic [:milan] (needinfo for best results)]

With this patch in the latest nightly, are we seeing any improvement in the crash numbers?

Comment 23

[(Away)]

We don't have much data on the 0602 nightly yet. I'll be keeping an eye on this throughout the day.

Comment 24

[(Away)]

No hits so far but it's still early. I'll do one more check tomorrow morning.

Comment 25

[Kate Glazko]

Tracking because it affects Firefox 41, will stay posted for updated crash numbers.

Comment 26

[(Away)]

Looks good; no crashes on nightly 0602. Thanks all for the quick turnaround on this one.

Comment 27

[Matt Woodrow (:mattwoodrow)]

Comment on attachment 8613698 [details] [diff] [review]
possible fix

Approval Request Comment
[Feature/regressing bug #]: Bug 1153123
[User impact if declined]: Crashes if bug 1153123 is uplifted.
[Describe test coverage new/current, TreeHerder]: Verified using crashstats.
[Risks and why]: Low risk.
[String/UUID change made/needed]: None

Comment 28

[Liz Henry (:lizzard) (relman/hg->git project)]

Marking affected for 39 and 40 since we are uplifting bug 1153123.

Comment 29

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 8613698 [details] [diff] [review]
possible fix

Approved for uplift to aurora and beta, in hopes of avoiding a startup crash and black video screen crashes. This uplift may be a bit risky but we need to try it.

Comment 30

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/bb72b2539a59

Comment 31

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/ec9c793f24ad