1253666 - Nightly crashes after opening youtube video

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[randomreporter]

User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Build ID: 20160304030206

Steps to reproduce:

STR:
Open https://www.youtube.com/watch?v=hUIYpbJeWJM
Crash reports:
https://crash-stats.mozilla.com/report/index/bcaf999e-f21d-4f5a-bac4-86b8b2160304
https://crash-stats.mozilla.com/report/index/7e1a0cb6-fff0-4b00-91f2-c17a82160304


Actual results:

Plugin-container crashed (e10 enabled)
Firefox.exe crashed (e10s disabled)


Expected results:

Nightly shouldn't crash

Comment 1

[randomreporter]

I forgot you have to select 1080p in video settings, correct STR:
Create new profile, launch it
Open https://www.youtube.com/watch?v=hUIYpbJeWJM
Switch to 1080p
Crash.

Also, I got reports from other users that they can't reproduce this bug. So it can have something to do with my config.

Comment 2

[randomreporter]

One more youtube video that crashes the browser, same reproduce steps:
https://www.youtube.com/watch?v=Y4C_msQ8yZU&feature=youtu.be
Crash report:
https://crash-stats.mozilla.com/report/index/b533d5fe-50fb-4bdc-8698-9c9b92160307

Comment 3

[Loic]

It looks like it crashes in the graphics component. Could you type about:support and paste the section graphics, please.

Comment 4

[randomreporter]

about:support Graphics

Graphics
Adapter Description	Intel(R) HD Graphics
Adapter Drivers	igdumd64 igd10umd64 igd10umd64 igdumd32 igd10umd32 igd10umd32
Adapter RAM	Unknown
Asynchronous Pan/Zoom	wheel input enabled; touch input enabled
Device ID	0x0102
Direct2D Enabled	true
DirectWrite Enabled	true (6.3.9600.18123)
Driver Date	1-29-2014
Driver Version	9.17.10.3347
GPU #2 Active	false
GPU Accelerated Windows	1/1 Direct3D 11 (OMTC)
Subsys ID	00000000
Supports Hardware H264 Decoding	Yes
Vendor ID	0x8086
WebGL Renderer	Google Inc. -- ANGLE (Intel(R) HD Graphics Direct3D11 vs_4_1 ps_4_1)
windowLayerManagerRemote	true
AzureCanvasAccelerated	0
AzureCanvasBackend	direct2d 1.1
AzureContentBackend	direct2d 1.1
AzureFallbackCanvasBackend	cairo

Comment 5

[Loic]

What's the model name of your Intel CPU? Do you have more recent drivers?

Comment 6

[randomreporter]

Intel i5 2300
http://ark.intel.com/ru/products/52206/Intel-Core-i5-2300-Processor-6M-Cache-up-to-3_10-GHz
I'll try to install the latest available drivers and will post the results.

Comment 7

[Loic]

Yes, it could be an issue with old drivers, the latest ones are:
https://downloadcenter.intel.com/ru/download/24971/-HD-Intel-64-Windows-7-8-8 (15.28.24.64.4229)

Comment 8

[Milan Sreckovic [:milan] (needinfo for best results)]

Matt, is this on the video side?

Comment 9

[Matt Woodrow (:mattwoodrow)]

It's hard to tell since the stack is broken.

If we trust the top symbol (CDecodeContext::CLS::FinalConstruct), then yes, it's crashing while initializing the decoder.

I'd have expected us to catch this and not crash more than once.

I'll need to have a look at the minidump to see if I can get a better stack, leaving ni?

Comment 10

[Milan Sreckovic [:milan] (needinfo for best results)]

If it turns out the updated driver takes care of it, the old driver may be a good candidate for blocking.

Comment 11

[Matt Woodrow (:mattwoodrow)]

Unfortunately I can't seem to get symbols for msmpeg2vdec.dll, so I don't have the full stack trace.

This is definitely a crash in ID3D11VideoDevice::CreateVideoDecoder though, coming from MediaFoundation.

We don't have a crash guard for d3d11 video, that would likely help here.

We may also want to guard the decode steps, as well as the initialization, since I think MediaFoundation does a lot of things lazily.


Dan, this crash is an example of MediaFoundation making it hard to know what is going on.

We call CreateVideoDecoder ourselves (as part of D3D11DXVA2Manager::SupportsConfig), which isn't crashing, so the MF transform must be doing something else weird to trigger a crash.

It'd be a lot easier to diagnose if it was within code we controlled.

Comment 12

[David Anderson [:dvander] - inactive, e-mail if emergency]

The crash guard would help here, and we do have it for the D3D9 path, but keep in mind two things:

(1) It would disable D3D11 decoding until Firefox is updated or drivers change. So we'd probably want to fallback to D3D9 to avoid losing accelerated video.

(2) In the parent process it writes a file, and in the child process it sends a sync message. So it should really only be on super cold paths. For example if we think only the first instance of a decoder is likely to crash, and instantiating it is on the critical path, we might want to only activate the crash guard the first time.

Anyway, I can do the patch if anyone has comments on that.

Comment 13

[randomreporter]

Ok, guys. I am very sorry I made you wait so long so please excuse me. Unfortunately, I have problems so I updated the driver as soon as I could. I removed the current driver then updated the driver to 9.17.10.4229 using Windows Update and Nightly still crashes!

New crash report with latest drivers: https://crash-stats.mozilla.com/report/index/0153743f-364a-4ed5-b663-216e42160317

P.S.
Download speed from the Intel website was too low so I decided to install the driver from the Windows Update. Here is the screenshot of my Control Panel with new driver version: http://i.imgur.com/1nFGpBb.png
As you can see, driver version is 9.17.10.4229
If go to the latest available driver webpage for my OS and CPU (Win8.1x64 i5 2300) https://downloadcenter.intel.com/download/24971/Intel-HD-Graphics-Driver-for-Windows-7-8-64-bit?product=81502
and open ReadMe under Release Notes it says:
Intel(R) Graphics Driver: 9.17.10.4229
Intel(R) Display Audio Driver: 6.14.0.3097
So, I guess, the driver I installed is indeed the latest. If I need to install a driver from the Intel website, let me know.

Comment 14

[randomreporter]

about:support with new drivers. Just to clarify: not all youtube videos crash, only the video from the original post and comment2!

Adapter Description	Intel(R) HD Graphics
Adapter Drivers	igdumd64 igd10umd64 igd10umd64 igdumd32 igd10umd32 igd10umd32
Adapter RAM	Unknown
Asynchronous Pan/Zoom	wheel input enabled; touch input enabled
Device ID	0x0102
Direct2D Enabled	true
DirectWrite Enabled	true (6.3.9600.18123)
Driver Date	5-28-2015
Driver Version	9.17.10.4229
GPU #2 Active	false
GPU Accelerated Windows	1/1 Direct3D 11 (OMTC)
Subsys ID	00000000
Supports Hardware H264 Decoding	Yes
Vendor ID	0x8086
WebGL Renderer	Google Inc. -- ANGLE (Intel(R) HD Graphics Direct3D11 vs_4_1 ps_4_1)
windowLayerManagerRemote	true
AzureCanvasAccelerated	0
AzureCanvasBackend	direct2d 1.1
AzureContentBackend	direct2d 1.1
AzureFallbackCanvasBackend	cairo

Comment 15

[Matt Woodrow (:mattwoodrow)]

(In reply to David Anderson [:dvander] from comment #12)
> The crash guard would help here, and we do have it for the D3D9 path, but
> keep in mind two things:
> 
> (1) It would disable D3D11 decoding until Firefox is updated or drivers
> change. So we'd probably want to fallback to D3D9 to avoid losing
> accelerated video.

We have support for falling back to d3d9 if d3d11 fails (though it's broken right, will land the fix patch today).

> 
> (2) In the parent process it writes a file, and in the child process it
> sends a sync message. So it should really only be on super cold paths. For
> example if we think only the first instance of a decoder is likely to crash,
> and instantiating it is on the critical path, we might want to only activate
> the crash guard the first time.

The STR for this bug suggest that catching only the first initialization should be enough, so we can start with that.

Comment 16

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: patch

This patch adds a crash guard for D3D11 DXVA. Note that if we crash in a content process, this will also disable DXVA in future content processes. If we want the guard to be parent-process only, let me know and I'll put up a new patch.

(landing this should be blocked on making sure the d3d9 fallback works, too)

Comment 17

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b5a0c2bf1bca

Comment 18

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/b5a0c2bf1bca