Closed Bug 1175104 Opened 4 years ago Closed 4 years ago

crash in memcpy | DxxSwBlt::SrcCopy(DxxResFmt const*, DXGI_FORMAT, void*, D3D10_DDI_BOX const*, unsigned int, unsigned int, DXGI_FORMAT, void const*, D3D10_DDI_BOX const*, unsigned int, unsigned int, int)

Categories

(Core :: Graphics, defect, critical)

39 Branch
x86
Windows 8.1
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla42
Tracking Status
firefox39 + wontfix
firefox40 + verified
firefox41 + verified
firefox42 --- verified

People

(Reporter: vasilica.mihasca, Assigned: mattwoodrow)

References

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is 
report bp-64671278-855d-4223-8958-0a60c2150616.
=============================================================

- Ran into this on Windows 8.1 32-bit, using Firefox 39 Beta 6 (20150615125213)
- It happened during Share Tabs testing
- Another crash report: bp-50f54fef-1215-43c7-9c13-da19f2150616

STR: 
1.Start Firefox and Click on Hello icon.
2.Click on "Start a conversation" and send the link to another person.
3.Access "Share your screen" button and select "Share my tabs".
4.Switch between tabs during the sharing process. 

AR
The browser crashes after almost a minute.
Maire, I just came across this yesterday. We should investigate further. 

Vasilica, does this happen every time you try this? Thanks. 

Tracking for 39; if this happens consistently with Windows 8.1 it may block the release.
Flags: needinfo?(mreavy)
Flags: needinfo?(vasilica.mihasca)
Randell, do you have a clue here?
If we cannot fix it, we should consider disabling this feature in 39.
Flags: needinfo?(rjesup)
Ditto Mark
Flags: needinfo?(standard8)
This isn't a WebRTC bug (or even Media). The crash occurs deep inside of the graphics code when rendering a page into a canvas.  Moving the needinfo to Milan since this is being tracked as a possible Fx39 release blocker (per comment 1). 

Note for future bugs: WebRTC bugs should get filed under Core::WebRTC.  This was filed under Core::Video/Audio (which is media playback, e.g. YouTube).  If anyone sees a WebRTC bug filed under Core::Video/Audio, please move it over.  Thanks!
Component: Video/Audio → Graphics
Flags: needinfo?(rjesup)
Flags: needinfo?(mreavy)
Flags: needinfo?(milan)
Flags: needinfo?(standard8)
I was able to reproduce this issue on Firefox 39 RC (20150622181234) under Windows 8.1 32-bit: https://crash-stats.mozilla.com/report/index/16f986a9-84d0-481d-b7be-ad92f2150624

This time was a bit difficult to crash the browser. 2 simultaneous calls, with share tab option active were needed in order to reproduce it. I did not encountered this crash so often as in Firefox 39 Beta 6, I barely reproduced it once.
Flags: needinfo?(vasilica.mihasca)
Vasilica, could you try to find the regression range?
Flags: needinfo?(vasilica.mihasca)
I tried to reproduce this crash on Firefox 38.0.6 ( 20150605094246) and Firefox 39 Beta 1 until Firefox 39 Beta 5, but I did not encountered it. 

My testing was a bit messed up by Bug 1177348 that did not allowed me to reproduce this crash.
 
But, surprisingly, In my attempt to find the regression range, I hit on another crash, which apparently should be fixed - see https://bugzilla.mozilla.org/show_bug.cgi?id=1128170#c84
Flags: needinfo?(vasilica.mihasca)
The stack may look like it's deep inside d3d and the driver, but the buffer in question goes all the back to mozilla::gfx::CreatePartialBitmapForSurface. The srcBitmap parameter to ID2D1RenderTarget::CreateBitmap points to inaccessible memory.
Bas may be able to tell just looking at the code; bug 1176436 is stopping us from getting the graphics messages in the crash reports, once that is fixed it may be easier to trace this.
Depends on: 1176436
Flags: needinfo?(bas)
You can still pull out the field from the Metadata tab on individual reports. The lack of the search field just prevents you from seeing them en masse.

bp-64671278-855d-4223-8958-0a60c2150616 didn't have a Graphics Critical Error.
bp-16f986a9-84d0-481d-b7be-ad92f2150624 said:
|[0][GFX1]: [D3D11] 2 CreateTexture2D failure Size(64,653) Code: 0x887a0005|[21][GFX1]: Failed to create software bitmap: Size(70,84) Code: 0x8899000c|[22][GFX1]: Failed to create software bitmap: Size(14,14) Code: 0x8899000c|[23][GFX1]: Failed to create software bitmap: Size(14,14) Code: 0x8899000c|[24][GFX1]: Failed to create software bitmap: Size(48,48) Code: 0x8899000c|[25][GFX1]: Failed to create software bitmap: Size(1680,560) Code: 0x8899000c

FWIW there's only been 9 of these crashes this month, and only 4 of those are from remotely recent builds.
This is really bad, we're creating D3D11 texture clients off the main thread and asking us to give us D2D DrawTargets, this is untested functionality. This is also contending on locks inside the D2D factory, which I suppose would usually make it accidentally work but is definitely not what we want.

This is most definitely media related as this is occurring on the mediathread, however the basic culprit is that http://hg.mozilla.org/releases/mozilla-beta/annotate/d37292f9d637/gfx/layers/ImageContainer.cpp#l489 assumes it can just get a DrawTarget and execute a CopySurface on any thread, which evidently can also be the media thread.
Assignee: nobody → bas
Flags: needinfo?(bas)
What's going on here guys? We're calling CairoImage::GetTextureClient here, in a function that's clearly used off the main thread. But CairoImage::GetTextureClient is definitely not thread safe and should definitely not be called on the main thread, this is a serious problem.
Flags: needinfo?(nical.bugzilla)
Flags: needinfo?(matt.woodrow)
Bas, this looks very similar to bug 1145106, I put some suggestions in that bug.

GetTextureClient shouldn't ever be racy, but it is usually called from the ImageBridge thread so we need it to be safe for that.
Flags: needinfo?(matt.woodrow) → needinfo?(bas)
(In reply to Matt Woodrow (:mattwoodrow) from comment #13)
> Bas, this looks very similar to bug 1145106, I put some suggestions in that
> bug.
> 
> GetTextureClient shouldn't ever be racy, but it is usually called from the
> ImageBridge thread so we need it to be safe for that.

I think the problem here is the use of DrawTargets for creating the texture client, as far as I can tell we simply need to write an alternative GetTextureClient that, at least for the moment, does not rely on Moz2D until we can make sure everything in Moz2D is threadsafe. If setting out D3D11 content device multithread protected works though I can live with that if we don't have any other issues.
Flags: needinfo?(bas)
Vasilica, does it crash with this build: https://treeherder.mozilla.org/#/jobs?repo=try&revision=b1b6324cbf4a
Flags: needinfo?(nical.bugzilla) → needinfo?(vasilica.mihasca)
Reproduced on HD 3650

AdapterDeviceID: 0x9591
AdapterDriverVersion: 8.970.100.1100
AdapterSubsysID: 211717aa
AdapterVendorID: 0x1002
Add-ons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:42.0a1
AvailablePageFile: 5355134976
AvailablePhysicalMemory: 2118721536
AvailableVirtualMemory: 3427074048
BIOS_Manufacturer: LENOVO
BlockedDllList: 
BreakpadReserveAddress: 43057152
BreakpadReserveSize: 67108864
BuildID: 20150630030204
CrashTime: 1435693664
EMCheckCompatibility: true
FramePoisonBase: 00000000f0de0000
FramePoisonSize: 65536
InstallTime: 1435683584
Notes: AdapterVendorID: 0x1002, AdapterDeviceID: 0x9591, AdapterSubsysID: 211717aa, AdapterDriverVersion: 8.970.100.1100
D2D- D2D1.1- D2D1.1+ D2D+ DWrite- DWrite+ D3D11 Layers- D3D11 Layers+ 
ProductID: {ec8030f7-c20a-464f-9b0e-13a3a9e97384}
ProductName: Firefox
ReleaseChannel: nightly
SafeMode: 0
SecondsSinceLastCrash: 159
StartupTime: 1435693609
SystemMemoryUsePercentage: 49
TelemetryEnvironment: {"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86","buildId":"20150630030204","version":"42.0a1","vendor":"Mozilla","platformVersion":"42.0a1","xpcomAbi":"x86-msvc","hotfixVersion":null},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":4026,"isWow64":true,"cpu":{"count":2,"vendor":null,"family":null,"model":null,"stepping":null,"extensions":["hasMMX","hasSSE","hasSSE2","hasSSE3","hasSSSE3","hasSSE4_1"]},"os":{"name":"Windows_NT","version":"6.1","servicePackMajor":1,"servicePackMinor":0,"installYear":2013,"locale":"en-CA"},"hdd":{"profile":{"model":"HGST HTS725050A7E630","revision":"GH2Z"},"binary":{"model":"HGST HTS725050A7E630","revision":"GH2Z"},"system":{"model":"HGST HTS725050A7E630","revision":"GH2Z"}},"gfx":{"D2DEnabled":true,"DWriteEnabled":true,"adapters":[{"description":"ATI Mobility Radeon HD 3650","vendorID":"0x1002","deviceID":"0x9591","subsysID":"211717aa","RAM":256,"driver":"aticfx64 aticfx64 aticfx32 aticfx32 atiumd64 atidxx64 atiumdag atidxx32 atiumdva atiumd6a atitmm64","driverVersion":"8.970.100.1100","driverDate":"4-29-2013","GPUActive":true}],"monitors":[{"screenWidth":1680,"screenHeight":1050,"refreshRate":60,"pseudoDisplay":false}]}},"settings":{"blocklistEnabled":true,"isDefaultBrowser":false,"e10sEnabled":false,"telemetryEnabled":true,"locale":"en-US","update":{"channel":"nightly","enabled":true,"autoDownload":true},"userPrefs":{"browser.cache.disk.capacity":358400,"browser.newtabpage.enhanced":true}},"profile":{"creationDate":16616},"addons":{"activeAddons":{},"theme":{"id":"{972ce4c6-7e08-4474-a285-3208198ce6fd}","blocklisted":false,"description":"The default theme.","name":"Default","userDisabled":false,"appDisabled":false,"version":"42.0a1","scope":4,"foreignInstall":false,"hasBinaryComponents":false,"installDay":16616,"updateDay":16616},"activePlugins":[{"name":"Adobe Acrobat","version":"10.1.0.534","description":"Adobe PDF Plug-In For Firefox and Netscape 10.1.0","blocklisted":false,"disabled":false,"clicktoplay":true,"mimeTypes":["application/pdf","application/vnd.adobe.pdfxml","application/vnd.adobe.x-mars","application/vnd.fdf","application/vnd.adobe.xfdf","application/vnd.adobe.xdp+xml","application/vnd.adobe.xfd+xml"],"updateDay":15131},{"name":"Adobe Acrobat","version":"10.1.0.534","description":"Adobe PDF Plug-In For Firefox and Netscape 10.1.0","blocklisted":false,"disabled":false,"clicktoplay":true,"mimeTypes":["application/pdf","application/vnd.adobe.pdfxml","application/vnd.adobe.x-mars","application/vnd.fdf","application/vnd.adobe.xfdf","application/vnd.adobe.xdp+xml","application/vnd.adobe.xfd+xml"],"updateDay":15131},{"name":"Google Update","version":"1.3.27.5","description":"Google Update","blocklisted":false,"disabled":false,"clicktoplay":true,"mimeTypes":["application/x-vnd.google.update3webcontrol.3","application/x-vnd.google.oneclickctrl.9"],"updateDay":16591},{"name":"NVIDIA 3D Vision","version":"7.17.12.9688","description":"NVIDIA 3D Vision plugin for Mozilla browsers","blocklisted":false,"disabled":false,"clicktoplay":true,"mimeTypes":["image/jps","image/pns","image/mpo"],"updateDay":15491},{"name":"NVIDIA 3D VISION","version":"7.17.12.9688","description":"NVIDIA 3D Vision Streaming plugin for Mozilla browsers","blocklisted":false,"disabled":false,"clicktoplay":true,"mimeTypes":["application/mozilla-3dv-streaming-plugin"],"updateDay":15491},{"name":"Nitro PDF Plug-In","version":"7.4.1.4","description":"Nitro PDF Plug-in for Firefox and Chrome","blocklisted":false,"disabled":false,"clicktoplay":true,"mimeTypes":["application/pdf"],"updateDay":15484},{"name":"Windows Live™ Photo Gallery","version":"15.4.3555.308","description":"NPWLPG","blocklisted":false,"disabled":false,"clicktoplay":true,"mimeTypes":["application/x-wlpg3-detect","application/x-wlpg-detect"],"updateDay":15408},{"name":"Silverlight Plug-In","version":"5.1.30514.0","description":"5.1.30514.0","blocklisted":false,"disabled":false,"clicktoplay":true,"mimeTypes":["application/x-silverlight","application/x-silverlight-2"],"updateDay":16204},{"name":"Intel® Identity Protection Technology","version":"2.0.59.0","description":"Intel web components for Intel® Identity Protection Technology","blocklisted":false,"disabled":false,"clicktoplay":true,"mimeTypes":["application/x-vnd-intel-webapi-ipt-2.0.59"],"updateDay":15345},{"name":"Intel® Identity Protection Technology","version":"2.0.59.0","description":"Intel web components updater - Installs and updates the Intel web components","blocklisted":false,"disabled":false,"clicktoplay":true,"mimeTypes":["application/x-vnd-intel-webapi-updater"],"updateDay":15345}],"activeGMPlugins":{"gmp-gmpopenh264":{"version":"1.4","userDisabled":false,"applyBackgroundUpdates":1},"gmp-eme-adobe":{"version":"11","userDisabled":false,"applyBackgroundUpdates":1}},"activeExperiment":{},"persona":null}}
Theme: classic/1.0
Throttleable: 1
TotalPageFile: 8441286656
TotalPhysicalMemory: 4221591552
TotalVirtualMemory: 4294836224
URL: https://www.mozilla.org/en-US/firefox/42.0a1/hello/start/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=getting-started
User32BeforeBlocklist: 1
Vendor: Mozilla
Version: 42.0a1
Winsock_LSP: MSAFD Tcpip [TCP/IP] : 2 : 1 : %SystemRoot%\system32\mswsock.dll 
 MSAFD Tcpip [UDP/IP] : 2 : 2 :  
 MSAFD Tcpip [RAW/IP] : 2 : 3 : %SystemRoot%\system32\mswsock.dll 
 MSAFD Tcpip [TCP/IPv6] : 2 : 1 :  
 MSAFD Tcpip [UDP/IPv6] : 2 : 2 : %SystemRoot%\system32\mswsock.dll 
 MSAFD Tcpip [RAW/IPv6] : 2 : 3 :  
 RSVP TCPv6 Service Provider : 2 : 1 : %SystemRoot%\system32\mswsock.dll 
 RSVP TCP Service Provider : 2 : 1 :  
 RSVP UDPv6 Service Provider : 2 : 2 : %SystemRoot%\system32\mswsock.dll 
 RSVP UDP Service Provider : 2 : 2 :  
 MSAFD RfComm [Bluetooth] : 2 : 1 : %SystemRoot%\system32\mswsock.dll
useragent_locale: en-US

This report also contains technical information about the state of the application when it crashed.
(In reply to Milan Sreckovic [:milan] from comment #15)
> Vasilica, does it crash with this build:
> https://treeherder.mozilla.org/#/jobs?repo=try&revision=b1b6324cbf4a

I was unable to reproduce this crash with https://treeherder.mozilla.org/#/jobs?repo=try&revision=b1b6324cbf4a on Windows 8.1 32-bit.
Flags: needinfo?(vasilica.mihasca)
Bas, Matt, sounds like a patch from bug 1145106 did the part here - can we sort out which patch that was, attach it here, probably make bug 1177348 a duplicate of it, and see if we can land it on nightly and start working on uplifts?
Flags: needinfo?(milan)
Flags: needinfo?(matt.woodrow)
Flags: needinfo?(bas)
(In reply to Milan Sreckovic [:milan] from comment #18)
> Bas, Matt, sounds like a patch from bug 1145106 did the part here - can we
> sort out which patch that was, attach it here, probably make bug 1177348 a
> duplicate of it, and see if we can land it on nightly and start working on
> uplifts?

Matt's better able to answer that, but I'm not surprised, I'm actually surprised our using stuff that was never meant to from random threads isn't blowing up in our faces more violently, and I feel we're still at risk for that so we do need to fix the underlying issues.
Flags: needinfo?(bas)
I realize this probably isn't sufficient as the full fix, but it seems to work and should be safe to uplift.

I think we can start here, and then try fix it properly on Nightly.
Assignee: bas → matt.woodrow
Flags: needinfo?(matt.woodrow)
Attachment #8628806 - Flags: review?(bas)
Attachment #8628806 - Flags: review?(bas) → review+
Comment on attachment 8628806 [details] [diff] [review]
Set multithreaded

Approval Request Comment
[Feature/regressing bug #]: Unknown
[User impact if declined]: Crashes with Firefox Hello when sharing tabs.
[Describe test coverage new/current, TreeHerder]: Manually tested by QA.
[Risks and why]: Low risk, just enables internal multi-thread support within d3d.
[String/UUID change made/needed]: None
Attachment #8628806 - Flags: approval-mozilla-release?
Attachment #8628806 - Flags: approval-mozilla-beta?
Attachment #8628806 - Flags: approval-mozilla-aurora?
https://hg.mozilla.org/mozilla-central/rev/7832e96e963f
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla42
Comment on attachment 8628806 [details] [diff] [review]
Set multithreaded

QA has done some level of testing and the discussion makes the current behaviour sound pretty bad. Let's get this fix into 40 beta2. Beta+ Aurora+

I'm leaving release as a nom for now. AFAIK this has not blown up to the point where it is a driver for a point release.
Attachment #8628806 - Flags: approval-mozilla-beta?
Attachment #8628806 - Flags: approval-mozilla-beta+
Attachment #8628806 - Flags: approval-mozilla-aurora?
Attachment #8628806 - Flags: approval-mozilla-aurora+
Flags: qe-verify+
We had 5 crashes of this bug over the last 28 days. Not taking it in release.
Attachment #8628806 - Flags: approval-mozilla-release? → approval-mozilla-release-
Performed Exploratory testing on Tab Sharing and I confirm that this crash no longer reproduces on Firefox 42.0a1 (2015-07-17), Firefox 41.0a2 (2015-07-16) and Firefox 40 Beta 4 (20150713153304) under Windows 8.1 32-bit.

Based on my testing I am marking this bug as Verified.
You need to log in before you can comment on or make changes to this bug.