Crash in mozalloc_abort | NS_DebugBreak | gfxFontGroup::GetDefaultFont

NEW
Unassigned

Status

()

Core
Graphics
P3
critical
2 years ago
5 months ago

People

(Reporter: philipp, Unassigned)

Tracking

({crash})

51 Branch
x86
Windows
crash
Points:
---

Firefox Tracking Flags

(firefox-esr45 affected, firefox50 affected, firefox51+ wontfix, firefox52- fix-optional, firefox53 affected)

Details

(Whiteboard: [gfx-noted], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

2 years ago
This bug was filed from the Socorro interface and is 
report bp-a965fc8f-7074-47cf-b8e2-035ee2161207.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	mozglue.dll 	mozalloc_abort(char const* const) 	memory/mozalloc/mozalloc_abort.cpp:33
1 	xul.dll 	NS_DebugBreak 	xpcom/base/nsDebugImpl.cpp:436
2 	xul.dll 	gfxFontGroup::GetDefaultFont() 	gfx/thebes/gfxTextRun.cpp:1842
3 	xul.dll 	gfxFontGroup::GetFirstValidFont(unsigned int) 	gfx/thebes/gfxTextRun.cpp:1887
4 	xul.dll 	nsFontMetrics::GetMetrics(gfxFont::Orientation) 	gfx/src/nsFontMetrics.cpp:166
5 	xul.dll 	GetNormalLineHeight 	layout/generic/ReflowInput.cpp:2687
6 	xul.dll 	ComputeLineHeight 	layout/generic/ReflowInput.cpp:2743
7 	xul.dll 	mozilla::ReflowInput::CalcLineHeight(nsIContent*, nsStyleContext*, int, float) 	layout/generic/ReflowInput.cpp:2766
8 	xul.dll 	mozilla::ReflowInput::CalcLineHeight() 	layout/generic/ReflowInput.cpp:2753
9 	xul.dll 	mozilla::BlockReflowInput::BlockReflowInput(mozilla::ReflowInput const&, nsPresContext*, nsBlockFrame*, bool, bool, bool, int) 	layout/generic/BlockReflowInput.cpp:145
10 	xul.dll 	nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, unsigned int&) 	layout/generic/nsBlockFrame.cpp:1118
11 		@0x21e833 	
12 		@0x21e833

there is a spike of this crash signature in the content crash spiking up on 51.0b6 since yesterday. it is mostly affecting users on win x86 with an intel gpus - these are the top device ids:

Rank 	Adapter device id 	Count 	%
1 	0x1616 	406 	78.23 %
2 	0x0412 	52 	10.02 %
3 	0x1912 	17 	3.28 %
There seems to be enough fonts to choose from, but we still can't get the default font and crash.  Jonathan, thoughts?

Also, there could be a correlation with an add-on, Anthony, can you check?

[Tracking Requested - why for this release]: I don't like surprise spikes in late betas :)
tracking-firefox51: --- → ?
Flags: needinfo?(jfkthame)
Flags: needinfo?(anthony.s.hughes)
Whiteboard: [gfx-noted]
The crash linked from comment 0 shows

GraphicsCriticalError 	

|[C0][GFX1]: no fonts - init: 1 fonts: 420 loader: 1 backend: directwrite system-uptime: 47693.484 sec (t=8.58496) 

So yes, there appear to be plenty of fonts on the system, but I notice the "loader: 1" in this message... that appears to indicate that the async font info loader hasn't yet run (it's still in its initial "delay" state.[1]

If the browser initially opens to a page that causes us to hit this GetDefaultFont() code path -- because it has some CSS that specifies _only_ font names that are not known on the system -- and this happens _before_ we've explicitly loaded any known fonts, then maybe we fail to handle this case properly? I'll see if I can reproduce a failure by triggering something along these lines....

[1] https://dxr.mozilla.org/mozilla-central/rev/8103c612b79c2587ea4ca1b0a9f9f82db4b185b8/gfx/thebes/gfxFontInfoLoader.h#168
Flags: needinfo?(jfkthame)
Here are the correlations for Beta:

Addons:
(66.34% in signature vs 10.68% overall) Addon "Adblock Plus" = true
(66.18% in signature vs 00.57% overall) Addon "Flagfox" = true
(33.82% in signature vs 97.75% overall) Addon "aushelper@mozilla.org" = true
(33.82% in signature vs 97.49% overall) Addon "webcompat@mozilla.org" = true
(33.82% in signature vs 97.33% overall) Addon "Multi-process staged rollout" = true
(33.82% in signature vs 97.17% overall) Addon "Pocket" = true
(16.50% in signature vs 00.04% overall) Addon "YouTube MP4 Downloader" = true
(16.50% in signature vs 00.18% overall) Addon "Simple YouTube to MP3/MP4 Converter and Downloader" = true
(16.50% in signature vs 00.26% overall) Addon "web2pdfextension.15@web2pdf.adobedotcom" = true

Modules:
(100.0% in signature vs 52.17% overall) Module "dnsapi.dll" = true
(100.0% in signature vs 48.78% overall) Module "browsercomps.dll" = true
(100.0% in signature vs 49.40% overall) Module "winrnr.dll" = true
(100.0% in signature vs 49.71% overall) Module "firefox.exe" = true
(98.54% in signature vs 66.08% overall) Module "sspicli.dll" = true
(98.54% in signature vs 41.02% overall) Module "pnrpnsp.dll" = true
(98.54% in signature vs 41.09% overall) Module "NapiNSP.dll" = true
(98.54% in signature vs 41.11% overall) Module "nlaapi.dll" = true
(97.57% in signature vs 28.13% overall) Module "d3d11.dll" = true
(97.57% in signature vs 29.07% overall) Module "dxgi.dll" = true
(97.09% in signature vs 43.30% overall) Module "cryptsp.dll" = true
(97.09% in signature vs 45.69% overall) Module "rsaenh.dll" = true
(95.47% in signature vs 18.40% overall) Module "xmllite.dll" = true
(95.47% in signature vs 19.21% overall) Module "d2d1.dll" = true
(95.47% in signature vs 24.82% overall) Module "DWrite.dll" = true
(93.69% in signature vs 39.96% overall) Module "bcrypt.dll" = true
(90.13% in signature vs 08.56% overall) Module "igd10iumd32.dll" = true
(90.13% in signature vs 09.51% overall) Module "ncrypt.dll" = true
(84.47% in signature vs 08.15% overall) Module "igdusc32.dll" = true
(81.07% in signature vs 32.29% overall) Module "dhcpcsvc.dll" = true
(80.91% in signature vs 28.27% overall) Module "RpcRtRemote.dll" = true
(80.91% in signature vs 45.22% overall) Module "comctl32.dll" = true ∧ platform_pretty_version = Windows 7
(31.39% in signature vs 86.63% overall) Module "psapi.dll" = true

Other:
(100.0% in signature vs 65.87% overall) plugin = false
(95.31% in signature vs 35.32% overall) "D2D1.1+" in app_notes = true
(95.31% in signature vs 35.33% overall) "DWrite+" in app_notes = true
(95.31% in signature vs 35.33% overall) "DWrite?" in app_notes = true
(92.72% in signature vs 12.08% overall) os_arch = amd64
(86.08% in signature vs 12.95% overall) bios_manufacturer = Dell Inc.
(79.94% in signature vs 20.98% overall) ipc_system_error = null
(79.94% in signature vs 31.68% overall) platform_version = 6.1.7601 Service Pack 1 ∧ Module "comctl32.dll" = true
(79.94% in signature vs 38.32% overall) platform_version = 6.1.7601 Service Pack 1 ∧ Module "api-ms-win-core-synch-l1-2-0.dll" = true
(79.94% in signature vs 38.39% overall) platform_version = 6.1.7601 Service Pack 1 ∧ Module "api-ms-win-core-timezone-l1-1-0.dll" = true
(79.94% in signature vs 38.39% overall) platform_version = 6.1.7601 Service Pack 1 ∧ Module "api-ms-win-core-file-l1-2-0.dll" = true
(79.94% in signature vs 38.39% overall) platform_version = 6.1.7601 Service Pack 1 ∧ Module "api-ms-win-core-file-l2-1-0.dll" = true
(79.94% in signature vs 38.39% overall) platform_version = 6.1.7601 Service Pack 1 ∧ Module "api-ms-win-core-localization-l1-2-0.dll" = true
(79.94% in signature vs 38.39% overall) platform_version = 6.1.7601 Service Pack 1 ∧ Module "api-ms-win-core-processthreads-l1-1-1.dll" = true
(79.94% in signature vs 38.44% overall) platform_version = 6.1.7601 Service Pack 1 ∧ Module "Wldap32.dll" = true
(79.94% in signature vs 39.70% overall) platform_version = 6.1.7601 Service Pack 1 ∧ Module "CRYPTBASE.dll" = true
(79.94% in signature vs 39.72% overall) platform_version = 6.1.7601 Service Pack 1 ∧ Module "lpk.dll" = true
(79.61% in signature vs 39.61% overall) platform_version = 6.1.7601 Service Pack 1
(74.43% in signature vs 36.22% overall) Module "icm32.dll" = true
(66.34% in signature vs 00.84% overall) cpu_microcode_version = 0x23
(66.18% in signature vs 00.15% overall) adapter_subsys_id = 062e1028
(66.18% in signature vs 01.32% overall) adapter_driver_version_clean = 4531
(66.18% in signature vs 01.32% overall) adapter_driver_version = 20.19.15.4531
(66.18% in signature vs 02.37% overall) adapter_device_id = 0x1616
(66.18% in signature vs 02.56% overall) CPU Info = GenuineIntel family 6 model 61 stepping 4
(63.43% in signature vs 13.56% overall) plugin_version = null
(53.88% in signature vs 19.17% overall) accessibility = null
(17.80% in signature vs 00.04% overall) address = 0x65e9f178
(16.83% in signature vs 00.83% overall) adapter_subsys_id = 06121028
(16.67% in signature vs 01.57% overall) adapter_device_id = 0x0412
(16.50% in signature vs 00.07% overall) adapter_driver_version_clean = 4432
(16.50% in signature vs 00.07% overall) adapter_driver_version = 10.18.14.4432
(06.96% in signature vs 55.25% overall) dom_ipc_enabled = 1
(04.69% in signature vs 59.60% overall) "D2D1.1-" in app_notes = true
Flags: needinfo?(anthony.s.hughes)
Created attachment 8817683 [details]
Untitled.png

Based on the attached graphs there seems to be a strong correlation of the spike in Beta to Intel HD 5500 GPUs on the 20.19.15.4531 driver.
Track 51+ as crashes in Beta51.
tracking-firefox51: ? → +
Crash volume for signature 'mozalloc_abort | NS_DebugBreak | gfxFontGroup::GetDefaultFont':
 - nightly (version 53): 11 crashes from 2016-11-14.
 - aurora  (version 52): 887 crashes from 2016-11-14.
 - beta    (version 51): 2141 crashes from 2016-11-14.
 - release (version 50): 606 crashes from 2016-11-01.
 - esr     (version 45): 2 crashes from 2016-07-06.

Crash volume on the last weeks (Week N is from 01-02 to 01-08):
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       0       0       2       5       0       1       3
 - aurora        0     513     134       6       7       0       0
 - beta         35      45     670     969     211     170      30
 - release      31      71      62      89      93     140     107
 - esr           0       0       0       0       0       0       0

Affected platform: Windows

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly           #237
 - aurora            #19
 - beta    #8030     #11
 - release #6156     #194
 - esr
status-firefox50: --- → affected
status-firefox52: --- → affected
status-firefox53: --- → affected
status-firefox-esr45: --- → affected
I spent some time trying to reproduce this along the lines of comment 2, setting up scenarios where this call to GetDefaultFont would be hit during initial launch/page-load (before we've run the background font loader). But so far, I haven't been able to trigger it; my suspicion is that it depends on some more specific conditions. If anyone _is_ able to reproduce this, it would be really helpful to have more details of the configuration involved.
Too late for 51, mark 51 as won't fix.
status-firefox51: affected → wontfix
[Tracking Requested - why for this release]:
Carry over the tracking flag from 51.
tracking-firefox52: --- → ?
Sounds like we're stuck here without repro steps.  We're a week from RC for 52, marking fix-optional.
status-firefox52: affected → fix-optional
tracking-firefox52: ? → -
It looks like some of the reports have about:blank as the current URL, so I don't think this is specific to a certain page.
(Reporter)

Updated

6 months ago
Crash Signature: [@ mozalloc_abort | NS_DebugBreak | gfxFontGroup::GetDefaultFont] → [@ mozalloc_abort | NS_DebugBreak | gfxFontGroup::GetDefaultFont] [@ gfxFontGroup::GetDefaultFont ]

Comment 12

5 months ago
Quite high rate for FF 58.0.2
You need to log in before you can comment on or make changes to this bug.