1303117 - Crash in igd10umd64.dll | RtlAllocateMemoryBlockLookaside | RtlAllocateHeap | igd10umd64.dll | std::list<T>::_Buynode | igd10umd64.dll | stdext::_Hash<T>::insert

Status: RESOLVED WONTFIX

(Core :: Graphics, defect, P3)

Description

[u279076]

This bug was filed from the Socorro interface and is 
report bp-d06205b9-b250-4f6e-b8d6-ed6ea2160915.
=============================================================
Ø 0 	igd10umd64.dll 	igd10umd64.dll@0x5df3dc 	
Ø 1 	igd10umd64.dll 	igd10umd64.dll@0x17feea 	
Ø 2 	igd10umd64.dll 	igd10umd64.dll@0x55c613 	
Ø 3 	igd10umd64.dll 	igd10umd64.dll@0x5dfcbf 	
Ø 4 	igd10umd64.dll 	igd10umd64.dll@0x558c77 	
Ø 5 	igd10umd64.dll 	igd10umd64.dll@0x5dc2d4 	
Ø 6 	igd10umd64.dll 	igd10umd64.dll@0x67fda1 	
Ø 7 	igd10umd64.dll 	igd10umd64.dll@0x5dc57c 	
Ø 8 	igd10umd64.dll 	igd10umd64.dll@0x6a833e 	
Ø 9 	igd10umd64.dll 	igd10umd64.dll@0x6a88f3 	
Ø 10 	igd10umd64.dll 	igd10umd64.dll@0x66c570 	
Ø 11 	igd10umd64.dll 	igd10umd64.dll@0x69b50a 	
Ø 12 	igd10umd64.dll 	igd10umd64.dll@0x5dc6cd 	
Ø 13 	igd10umd64.dll 	igd10umd64.dll@0x69e2bb 	
Ø 14 	igd10umd64.dll 	igd10umd64.dll@0x667585 	
Ø 15 	igd10umd64.dll 	igd10umd64.dll@0x6ac221 	
16 	ntdll.dll 	RtlAllocateMemoryBlockLookaside 	
17 	ntdll.dll 	RtlAllocateHeap 	
18 		@0xd41046f 	
Ø 19 	igd10umd64.dll 	igd10umd64.dll@0x6877bb 	
Ø 20 	igd10umd64.dll 	igd10umd64.dll@0x662ccc 	
Ø 21 	igd10umd64.dll 	igd10umd64.dll@0x663aae 	
Ø 22 	igd10umd64.dll 	igd10umd64.dll@0x8039 	
Ø 23 	igd10umd64.dll 	igd10umd64.dll@0x6721 	
Ø 24 	igd10umd64.dll 	igd10umd64.dll@0x2ff1 	
25 	d3d11.dll 	std::list<std::pair<unsigned long const, SD3D11SharedResourceCreationArgs*>, std::allocator<std::pair<unsigned long const, SD3D11SharedResourceCreationArgs*> > >::_Buynode(std::_List_nod<std::pair<unsigned long const, SD3D11SharedResourceCreationArgs*>, std::allocator<std::pair<unsigned long const, SD3D11SharedResourceCreationArgs*> > >::_Node*, std::_List_nod<std::pair<unsigned long const, SD3D11SharedResourceCreationArgs*>, std::allocator<std::pair<unsigned long const, SD3D11SharedResourceCreationArgs*> > >::_Node*, std::pair<unsigned long const, SD3D11SharedResourceCreationArgs*> const&) 	
Ø 26 	igd10umd64.dll 	igd10umd64.dll@0x665f3c 	
27 	d3d11.dll 	stdext::_Hash<stdext::_Hmap_traits<unsigned long, SD3D11SharedResourceCreationArgs*, stdext::hash_compare<unsigned long, std::less<unsigned long> >, std::allocator<std::pair<unsigned long const, SD3D11SharedResourceCreationArgs*> >, 0> >::insert(std::pair<unsigned long const, SD3D11SharedResourceCreationArgs*> const&) 	
Ø 28 	igd10umd64.dll 	igd10umd64.dll@0x149bd 	
Ø 29 	igd10umd64.dll 	igd10umd64.dll@0x6b0876 	
30 	d3d11.dll 	CResource<ID3D11Texture3D>::CLS::FinalConstruct(CContext*, D3D11DDIARG_CREATERESOURCE const*, SD3D11SharedResourceCreationArgs*, SD3D11CrossLayerData*, D3D10DDI_HRTRESOURCE) 	
31 	d3d11.dll 	C10and11Resource<ID3D11Texture2D, ID3D10Texture2D>::C10and11Resource<ID3D11Texture2D, ID3D10Texture2D>(SD3D11LayeredDeviceChildCreationArgs const&, D3D11_USAGE, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, DXGI_FORMAT, DXGI_SAMPLE_DESC, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, SCLSInfo<CContext> const*, SD3D11SharedResourceCreationArgs const*, _GUID const&, D3D11_RESOURCE_DIMENSION) 	
32 	d3d11.dll 	TCLSWrappers<CTexture2D>::CLSFinalConstructFn(CTexture2D::CLS*, CContext*, CTexture2D::TConstructorArgs const*) 	
33 	d3d11.dll 	CLayeredObjectWithCLS<CTexture2D>::CreateInstance(CTexture2D::TConstructorArgs&, void*, void*, _GUID const&, void**, CLayeredObjectWithCLS<CTexture2D>::SInfo const*) 	
34 	ntdll.dll 	?? ?? ::FNODOBFM::`string' 	
35 		@0x3f1dab07 	
36 	xul.dll 	mozilla::BufferList<InfallibleAllocPolicy>::WriteBytes(char const*, unsigned __int64) 	obj-firefox/dist/include/mozilla/BufferList.h:318
37 		@0x25dcf11f 	
38 	d3d11.dll 	ATL::CComObjectRootBase::_Delegate(void*, _GUID const&, void**, unsigned __int64) 	
39 	d3d11.dll 	CBridgeImpl<ID3D11LayeredDevice, ID3D11LayeredDevice, CLayeredObject<NDXGI::CDevice> >::CreateLayeredChild(unsigned int, void const*, unsigned __int64, ID3D11LayeredUseCounted*, _GUID const&, void**) 	
40 	mozglue.dll 	free_impl 	memory/build/replace_malloc.c:201
41 	d3d11.dll 	NOutermost::CDeviceChild::FinalConstruct(NOutermost::CDeviceChild::TConstructorArgs const&) 	
42 	ntdll.dll 	RtlAllocateHeap 	
43 		@0x3f1daaaf 	
44 	d3d11.dll 	CBridgeImpl<ID3D11LayeredDevice, ID3D11LayeredDevice, CLayeredObject<NDXGI::CDevice> >::GetLayeredChildSize(unsigned int, void const*, unsigned __int64) 	
45 	d3d11.dll 	CDevice::CreateTexture2D_Worker(D3D11_TEXTURE2D_DESC const*, D3D11_SUBRESOURCE_DATA const*, int, ID3D11Texture2D**, SD3D11SharedResourceCreationArgs*, bool) 	
46 	KERNELBASE.dll 	VirtualFree 	
47 		@0x29015b2f0588f 	
=============================================================
More reports: https://crash-stats.mozilla.com/signature/?product=Firefox&signature=igd10umd64.dll%20%7C%20RtlAllocateMemoryBlockLookaside%20%7C%20RtlAllocateHeap%20%7C%20igd10umd64.dll%20%7C%20std%3A%3Alist%3CT%3E%3A%3A_Buynode%20%7C%20igd10umd64.dll%20%7C%20stdext%3A%3A_Hash%3CT%3E%3A%3Ainsert

Comment 1

[u279076]

These crashes only affect Firefox 51 on Windows 7, seemingly beginning with build 20160813030202.

These crashes affect 2nd and 3rd Gen Intel Core GPUs only:
> 1 	0x0166 	149 	65.35 % (Ivybridge)
> 2 	0x0152 	31 	13.60 % (Ivybridge)
> 3 	0x0102 	18 	7.89 % (Sandybridge)
> 4 	0x0116 	9 	3.95 % (Sandybridge)
> 5 	0x0162 	9 	3.95 % (Ivybridge)
> 6 	0x0106 	6 	2.63 % (Sandybridge)
> 7 	0x0126 	4 	1.75 % (Sandybridge)
> 8 	0x0156 	2 	0.88 % (Ivybridge)

Driver Correlations:
> 1 	8.15.10.2712 	54 	23.68 %
> 2 	8.15.10.2752 	38 	16.67 %
> 3 	8.15.10.2696 	34 	14.91 %
> 4 	8.15.10.2778 	31 	13.60 %
> 5 	8.15.10.2653 	25 	10.96 %
> 6 	8.15.10.2639 	23 	10.09 %
> 7 	8.15.10.2626 	11 	4.82 %
> 8 	8.15.10.2761 	4 	1.75 %
> 9 	8.15.10.2669 	3 	1.32 %
> 10 	8.15.10.2618 	2 	0.88 %
> 11 	8.15.10.2725 	2 	0.88 %
> 12 	8.15.10.2656 	1 	0.44%

Comment 2

[u279076]

Here is the pushlog for the suspected regression window:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=233ab21b64b5d5e9f2f16ea2d4cfb4c8b293c5c4&tochange=2ed7e61b988d2466a61528f66050596ef272ebda

Note, at present volume this is the #16 crash in Nightly.

Comment 3

[Kan-Ru Chen [:kanru] (UTC+9)]

I suspect this is related to bug 1295075. There is one frame with signature `mozilla::BufferList<InfallibleAllocPolicy>::WriteBytes(char const*, unsigned __int64)` in xul.dll and one with `free_impl` in mozglue.dll

The stack trace looks corrupted.

Comment 4

[alex_mayorga]

¡Hola!

FWIW, this is also a thing on 52.

Recently crashed like bp-f3f6c575-7d85-4325-b719-7daf62161004

¡Gracias!
Alex

Comment 5

[Julien Cristau [:jcristau] (back April 22)]

Too late for firefox 52, mass-wontfix.

Comment 6

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 7

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.