1174603 - cross_fuzz_v3 crash mozilla::layers::CompositorD3D11::HandleError

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect)

Description

[Brian Carpenter [:geeknik]]

Attachment: firefox-debug_1a58_2015-06-14_23-19-23-052.log

While fuzzing the 14 June 2015 build of Firefox Nightly w/ cross_fuzz_v3, I encountered a crash in mozilla::layers::CompositorD3D11::HandleError. I've attached the windbg log file. E10s is enabled, latest Nvidia WHQL drivers installed, etc.

FAULTING_IP: 
xul!mozilla::layers::CompositorD3D11::HandleError+85 [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\gfx\layers\d3d11\compositord3d11.cpp @ 1459]
00007ffb`a0eec00d cc              int     3

EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00007ffba0eec00d (xul!mozilla::layers::CompositorD3D11::HandleError+0x0000000000000085)
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 1
   Parameter[0]: 0000000000000000

FAULTING_THREAD:  00000000000911dc

PROCESS_NAME:  firefox.exe

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION}  Breakpoint  A breakpoint has been reached.

EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid

EXCEPTION_PARAMETER1:  0000000000000000

NTGLOBALFLAG:  70

APPLICATION_VERIFIER_FLAGS:  0

BUGCHECK_STR:  APPLICATION_FAULT_FILL_PATTERN_ffffffff

PRIMARY_PROBLEM_CLASS:  FILL_PATTERN_ffffffff

DEFAULT_BUCKET_ID:  FILL_PATTERN_ffffffff

LAST_CONTROL_TRANSFER:  from 00007ffba0eebe25 to 00007ffba0eec00d

STACK_TEXT:  
0000001a`3bd2f020 00007ffb`a0eebe25 : 00000000`887a0001 00000000`00000000 00000000`00000000 0000001a`3b562670 : xul!mozilla::layers::CompositorD3D11::HandleError+0x85 [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\gfx\layers\d3d11\compositord3d11.cpp @ 1459]
0000001a`3bd2f150 00007ffb`a0eec8bc : 00007ffb`c4e496b8 00000000`887a0001 0000001a`3bd2f440 00000000`00000000 : xul!mozilla::layers::CompositorD3D11::Failed+0xd [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\gfx\layers\d3d11\compositord3d11.cpp @ 1471]
0000001a`3bd2f180 00007ffb`a0ee9c35 : 0000fffd`00000130 00000000`00000000 00000000`00000000 0000001a`3bd2f440 : xul!mozilla::layers::CompositorD3D11::UpdateRenderTarget+0xf4 [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\gfx\layers\d3d11\compositord3d11.cpp @ 1246]
0000001a`3bd2f2d0 00007ffb`a03384a1 : 0000001a`39cf8720 0000001a`3bd2f4f0 0000001a`39cf8720 00007ffb`a240af80 : xul!mozilla::layers::CompositorD3D11::BeginFrame+0x81 [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\gfx\layers\d3d11\compositord3d11.cpp @ 1028]
0000001a`3bd2f3f0 00007ffb`a0338da4 : 0000001a`39cf85f0 0000001a`39cf85f0 0000001a`39cf8700 00000000`00000000 : xul!mozilla::layers::LayerManagerComposite::Render+0x2ad [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\gfx\layers\composite\layermanagercomposite.cpp @ 719]
0000001a`3bd2f760 00007ffb`a0338c21 : 00000000`00000000 0000001a`3cb1b800 00000000`00000000 00000000`00000000 : xul!mozilla::layers::LayerManagerComposite::EndTransaction+0x170 [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\gfx\layers\composite\layermanagercomposite.cpp @ 319]
0000001a`3bd2f810 00007ffb`a06e0656 : 0000001a`39f0a000 0000001a`3cb1b800 00000000`00000000 00000000`00000000 : xul!mozilla::layers::LayerManagerComposite::EndEmptyTransaction+0x19 [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\gfx\layers\composite\layermanagercomposite.cpp @ 262]
0000001a`3bd2f840 00007ffb`a04f6bb1 : 0000001a`39438b00 0000001a`439997d0 0000001a`3bd2fba0 0000001a`39f0a000 : xul!mozilla::layers::CompositorParent::CompositeToTarget+0x12e [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\gfx\layers\ipc\compositorparent.cpp @ 1153]
0000001a`3bd2f900 00007ffb`a04f6bfc : 0000001a`3c5328e0 00000000`00000000 0000001a`00000001 0000002f`00000058 : xul!mozilla::layers::CompositorVsyncScheduler::Composite+0x75 [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\gfx\layers\ipc\compositorparent.cpp @ 521]
0000001a`3bd2f930 00007ffb`a04f83bf : 0000001a`3bd2fb90 00007ffb`c1b71a80 00000000`001c1228 00000000`00000000 : xul!RunnableMethod<mozilla::layers::CompositorVsyncScheduler,void (__cdecl mozilla::layers::CompositorVsyncScheduler::*)(mozilla::TimeStamp) __ptr64,Tuple1<mozilla::TimeStamp> >::Run+0x2c [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\ipc\chromium\src\base\task.h @ 311]
0000001a`3bd2f980 00007ffb`a04f7155 : 0000001a`39dbbf10 0000001a`39dbbe70 00000000`00000000 0000001a`39dbbe98 : xul!MessageLoop::DoWork+0x21b [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\ipc\chromium\src\base\message_loop.cc @ 456]
0000001a`3bd2fa20 00007ffb`a04f6ffb : 0000001a`39dbbf10 00000000`00000000 0000001a`39dbbe70 00000000`00000000 : xul!base::MessagePumpForUI::DoRunLoop+0x7d [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\ipc\chromium\src\base\message_pump_win.cc @ 217]
0000001a`3bd2fa90 00007ffb`a04f7f3f : 0000001a`3bd2fb90 00000000`00000000 0000001a`3bd2fc40 00007ffb`a0664e80 : xul!base::MessagePumpWin::Run+0x3b [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\ipc\chromium\src\base\message_pump_win.h @ 78]
0000001a`3bd2fae0 00007ffb`a04f8182 : 00000000`00000010 0000001a`3bd2fc10 0000001a`39dbbe70 00007ffb`c73c155c : xul!MessageLoop::RunHandler+0x17 [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\ipc\chromium\src\base\message_loop.cc @ 227]
0000001a`3bd2fb10 00007ffb`a01b049d : 0000001a`39dbbe98 0000001a`39dbbe70 0000001a`39dbbe70 00000000`00000000 : xul!MessageLoop::Run+0x3e [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\ipc\chromium\src\base\message_loop.cc @ 201]
0000001a`3bd2fb60 00007ffb`a01b03ca : 00000000`00000000 00007ffb`a01b03c0 00000000`00000000 00000000`00000000 : xul!base::Thread::ThreadMain+0xc9 [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\ipc\chromium\src\base\thread.cc @ 173]
0000001a`3bd2fcf0 00007ffb`c80f13d2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : xul!`anonymous namespace'::ThreadFunc+0xa [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\ipc\chromium\src\base\platform_thread_win.cc @ 27]
0000001a`3bd2fd20 00007ffb`ca0d5444 : 00007ffb`c80f13b0 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x22
0000001a`3bd2fd50 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x34


FOLLOWUP_IP: 
xul!mozilla::layers::CompositorD3D11::HandleError+85 [c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\gfx\layers\d3d11\compositord3d11.cpp @ 1459]
00007ffb`a0eec00d cc              int     3

FAULTING_SOURCE_CODE:  
No source found for 'c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\src\gfx\layers\d3d11\compositord3d11.cpp'


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  xul!mozilla::layers::CompositorD3D11::HandleError+85

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: xul

IMAGE_NAME:  xul.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  557d8a0c

STACK_COMMAND:  ~31s ; kb

FAILURE_BUCKET_ID:  FILL_PATTERN_ffffffff_80000003_xul.dll!mozilla::layers::CompositorD3D11::HandleError

BUCKET_ID:  X64_APPLICATION_FAULT_FILL_PATTERN_ffffffff_xul!mozilla::layers::CompositorD3D11::HandleError+85

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/firefox_exe/41_0_0_5643/557d7317/xul_dll/41_0_0_5643/557d8a0c/80000003/00dcc00d.htm?Retriage=1

Followup: MachineOwner

Comment 1

[Edwin Flores [inactive from 2016-12-01] [:eflores] [:edwin]]

Mass resolving WFM: signature(s) hasn't(/haven't) reported in past 28 days.