1316533 - Crash in _allrem

Status: RESOLVED WORKSFORME

(Core :: Graphics: CanvasWebGL, defect, P1)

Description

[Bogdan Maris, Desktop QA]

This bug was filed from the Socorro interface and is 
report bp-9f6b40f1-5b4a-4371-ab29-f79902161110.
=============================================================

STR:
1. Start Firefox
2. Visit https://floooh.github.io/oryol-webgl2/asmjs/PrimitiveTypes.html
3. Interact with the demo if it does not crash right away

Expected results:
- Demo is played successfully.

Actual results:
- Firefox and graphic driver crashes.

Regression:
- This crash reproduces on old Nightly from 2016-04-26 as well (where webGL2 was enabled by default), but not with the same signature:

bp-00ed5daa-1e7e-45c2-b875-6c9e72161109
bp-afadfd26-d4d8-462b-ba49-15c342161109

Additional notes:
- latest Nightly 52.0a1 does not crash, it just does not display the demo.
- the crashes from above are on Windows 7 32bit.
- I also test the same thing on Windows 10 64bit and there I got different results:
 - Developer Edition does not crash, only graphic driver crashes (6/6 tries)
 - Latest Nightly does crash with the following signature:
  - bp-527f0dbf-dd68-4079-9f4b-c8e242161110
  - bp-f4879d26-1188-48a5-a371-fde202161110
  - bp-a84edb3c-acb6-42b9-a83b-aa5712161109
  - bp-3994f9c6-838a-4637-be28-890d82161103


Graphics output from about:support on Windows 7 32bit:

Graphics
--------

Features
Compositing: Direct3D 11
Asynchronous Pan/Zoom: wheel input enabled
WebGL Renderer: Google Inc. -- ANGLE (AMD Radeon HD 6450 Direct3D11 vs_5_0 ps_5_0)
WebGL2 Renderer: Google Inc. -- ANGLE (AMD Radeon HD 6450 Direct3D11 vs_5_0 ps_5_0)
Hardware H264 Decoding: No; Hardware video decoding disabled or blacklisted
Audio Backend: wasapi
Direct2D: true
DirectWrite: true (6.2.9200.21976)
GPU #1
Active: Yes
Description: AMD Radeon HD 6450
Vendor ID: 0x1002
Device ID: 0x6779
Driver Version: 15.200.1062.1004
Driver Date: 8-3-2015
Drivers: aticfx32 aticfx32 aticfx32 atiumdag atidxx32 atiumdva
Subsys ID: 21251462
RAM: 1024

Diagnostics
AzureCanvasAccelerated: 0
AzureCanvasBackend: direct2d 1.1
AzureContentBackend: direct2d 1.1
AzureFallbackCanvasBackend: cairo
failures: [GFX1-]: (gfxWindowsPlatform) Detected device reset: 1
Decision Log
D3D9_COMPOSITING:
disabled by default: Disabled by default


Failure Log
(#0) Error: (gfxWindowsPlatform) Detected device reset: 1
(#20) Error: (nsWindow) Detected device reset: 3
(#21) Error: (nsWindow) Finished device reset.
(#22) Error: (nsWindow) Detected device reset: 3
(#23) Error: (nsWindow) Finished device reset.
(#24) Error: (nsWindow) Detected device reset: 3
(#25) Error: (nsWindow) Finished device reset.
(#26) Error: (nsWindow) Detected device reset: 3
(#27) Error: (nsWindow) Finished device reset.
(#28) Error: GFX: D3D11 abandoned sync
(#29) Error: (nsWindow) Detected device reset: 3
(#30) Error: GFX: D3D11 skip EndFrame with device-removed.
(#31) Error: GFX: D3D11 skip BeginFrame with device-removed.
(#32) Error: (nsWindow) Finished device reset.
(#33): CP+[GFX1-]: (gfxWindowsPlatform) Detected device reset: 3
(#34): CP+[GFX1-]: (gfxWindowsPlatform) Finished device reset.

Graphics output from about:support on Windows 10 64bit:

Graphics
--------

Features
Compositing: Direct3D 11
Asynchronous Pan/Zoom: wheel input enabled; touch input enabled
WebGL Renderer: Google Inc. -- ANGLE (Intel(R) HD Graphics 520 Direct3D11 vs_5_0 ps_5_0)
WebGL2 Renderer: Google Inc. -- ANGLE (Intel(R) HD Graphics 520 Direct3D11 vs_5_0 ps_5_0)
Hardware H264 Decoding: No; D3D11 blacklisted with DLL atidxx64.dll (8.17.10.625); D3D9 blacklisted with DLL atiumd64.dll (9.14.10.1128)
Audio Backend: wasapi
Direct2D: true
DirectWrite: true (10.0.10586.633)
GPU #1
Active: Yes
Description: Intel(R) HD Graphics 520
Vendor ID: 0x8086
Device ID: 0x1916
Driver Version: 20.19.15.4404
Driver Date: 3-3-2016
Drivers: igdumdim64 igd10iumd64 igd10iumd64 igd12umd64 igdumdim32 igd10iumd32 igd10iumd32 igd12umd32
Subsys ID: 00000000
RAM: Unknown
GPU #2
Active: No
Description: AMD Radeon R7 M340
Vendor ID: 0x1002
Device ID: 0x6900
Driver Version: 15.201.1701.1005
Driver Date: 11-6-2015
Drivers: aticfx64 aticfx64 aticfx64 amdxc64 aticfx32 aticfx32 aticfx32 amdxc32 atiumd64 atidxx64 atidxx64 atiumdag atidxx32 atidxx32 atiumdva atiumd6a atitmm64
Subsys ID: 00000000
RAM: 2048
Diagnostics
AzureCanvasAccelerated: 0
AzureCanvasBackend: skia
AzureContentBackend: skia
AzureFallbackCanvasBackend: cairo
GPUProcessPid: 3456
GPUProcess: Terminate GPU Process
Decision Log
D3D9_COMPOSITING:
disabled by default: Disabled by default

I'm going to set affected on both 51 and 52 because of the two different results on both W7 and W10 platforms.

Comment 1

[Milan Sreckovic [:milan] (needinfo for best results)]

Jukka, can you tell if the demo is "doing the right thing"?

The crashes that follow a driver reset - that's on the driver reset handling; it'd be interesting to know if we can avoid the driver reset if the demo is doing something wrong, or if it's just a bug in our code and the demo is doing the correct/supported thing.

Comment 2

[Vincent Liu[:vliu]]

In my local Nightly build, I can reproduce the similar stack dump with one of signature. Please see the attached dump file.

  - https://crash-stats.mozilla.com/report/index/a84edb3c-acb6-42b9-a83b-aa5712161109

I looked into it and found the crash happens when calling [1] with large srcBox.right(0x400000). I can't look into more because CopySubresourceRegion calls into driver. [2] doesn't have clear view to know more about the limitation, either. 

[1]: https://dxr.mozilla.org/mozilla-central/source/gfx/angle/src/libANGLE/renderer/d3d/d3d11/Buffer11.cpp#959
[2]: https://msdn.microsoft.com/zh-tw/library/windows/desktop/bb173542(v=vs.85).aspx

Comment 3

[Kelsey Gilbert [:jgilbert]]

In at least my repo, Buffer11::NativeStorage::fillBufferDesc is insane:
"For our purposes we ignore any buffer data past the maximum constant buffer size"
So when we try to resize a buffer to 0x400000 bytes, this func caps the resize size to 0x10000, but still tries to write 0x400000 to it.

Comment 4

[Kelsey Gilbert [:jgilbert]]

Here's the upstream fix:
https://github.com/google/angle/commit/5677e4d136883f681b491daa492366db29fa3a78

Peter: Can we get another ANGLE update?

This should be the last one for 51.

Comment 5

[Peter Chang[:pchang]]

Ethan, please confirm this issue is fixed with fixes in comment 4.

Comment 6

[Milan Sreckovic [:milan] (needinfo for best results)]

We won't ask for a new ANGLE uplift straight to Beta:), so just picking the change from comment 4 would be something that we could uplift.

Comment 7

[Kelsey Gilbert [:jgilbert]]

(In reply to Milan Sreckovic [:milan] from comment #6)
> We won't ask for a new ANGLE uplift straight to Beta:), so just picking the
> change from comment 4 would be something that we could uplift.

That change alone isn't sufficient. There's at least one other changeset that we need.
I think we should seriously look at taking the ANGLE update, because that's what Chrome is going to be shipping.

I have a feeling trying to cherry-pick fixes will leave us more fragile than just shipping what they're shipping.

Comment 8

[Ethan Lin[:ethlin]]

(In reply to Peter Chang[:pchang] from comment #5)
> Ethan, please confirm this issue is fixed with fixes in comment 4.

I merged the ANGLE commit, and I tested two devices. One device crashed at another point with the commit. The other one didn't crash but the display of the page was wrong.
If I update ANGLE to latest branch 2920, the display of the page is correct. Some conformance tests are also fixed with ANGLE/2920, like read-pixels-pack-parameters.html. I think we should have another ANGLE update for mozilla central. For Beta, we may need to cherry-pick at least two or more commits from ANGLE.

Comment 9

[Ethan Lin[:ethlin]]

The fix commit is available after ANGLE/2906 and the latest ANGLE version is 2924. :jrmuizel, do you any concern on updating ANGLE to 2924 for m-c?

Comment 10

[Jeff Muizelaar [:jrmuizel]]

(In reply to Ethan Lin[:ethlin] from comment #9)
> The fix commit is available after ANGLE/2906 and the latest ANGLE version is
> 2924. :jrmuizel, do you any concern on updating ANGLE to 2924 for m-c?

Nope.

Comment 11

[Ethan Lin[:ethlin]]

Bug 1319004 is fixed. I tested with the latest Nightly (2016-11-17) on windows and the crash didn't happen.