1336710 - Crash in rx::Blit9::initialize

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-00248d30-e2fb-41a6-b5b5-096c32170204.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	libglesv2.dll 	rx::Blit9::initialize() 	gfx/angle/src/libANGLE/renderer/d3d/d3d9/Blit9.cpp:109
1 	libglesv2.dll 	rx::Renderer9::initializeDevice() 	gfx/angle/src/libANGLE/renderer/d3d/d3d9/Renderer9.cpp:366
2 	libglesv2.dll 	rx::Renderer9::resetDevice() 	gfx/angle/src/libANGLE/renderer/d3d/d3d9/Renderer9.cpp:2272
3 	d3d9.dll 	DdFlipToGDISurface 	
4 	libglesv2.dll 	rx::DisplayD3D::restoreLostDevice() 	gfx/angle/src/libANGLE/renderer/d3d/DisplayD3D.cpp:267
5 	libglesv2.dll 	egl::Display::restoreLostDevice() 	gfx/angle/src/libANGLE/Display.cpp:739
6 	libglesv2.dll 	egl::Display::createPbufferSurface(egl::Config const*, egl::AttributeMap const&, egl::Surface**) 	gfx/angle/src/libANGLE/Display.cpp:577
7 	libglesv2.dll 	egl::CreatePbufferSurface(void*, void*, int const*) 	gfx/angle/src/libGLESv2/entry_points_egl.cpp:304
8 	xul.dll 	mozilla::gl::GLContextEGL::CreatePBufferSurfaceTryingPowerOfTwo(void*, unsigned int, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits>&) 	gfx/gl/GLContextProviderEGL.cpp:577
9 	xul.dll 	mozilla::gl::GLContextEGL::CreateEGLPBufferOffscreenContext(mozilla::gl::CreateContextFlags, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gl::SurfaceCaps const&, nsACString_internal* const) 	gfx/gl/GLContextProviderEGL.cpp:972
10 	xul.dll 	mozilla::gl::GLContextProviderEGL::CreateOffscreen(mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gl::SurfaceCaps const&, mozilla::gl::CreateContextFlags, nsACString_internal* const) 	gfx/gl/GLContextProviderEGL.cpp:1038
11 	xul.dll 	mozilla::PopulateCapFallbackQueue 	dom/canvas/WebGLContext.cpp:523
12 	ucrtbase.dll 	getenv_s 	
13 	ucrtbase.dll 	getenv

these crashes are increasing in frequency in release versions of firefox starting with 50.0. 
the crashes are all coming from users of windows xp with particular intel gpus:

Adapter device id facet
1 	0x2e32 	913 	33.62 %
2 	0x2a42 	719 	26.47 %
3 	0x0042 	438 	16.13 %
4 	0x0046 	358 	13.18 %
5 	0x2e22 	158 	5.82 %
6 	0x2e12 	130 	4.79 %

Adapter driver version facet
1 	6.14.10.5047 	897 	33.03 %
2 	6.14.10.5068 	678 	24.96 %
3 	6.14.10.5060 	309 	11.38 %
4 	6.14.10.5179 	301 	11.08 %
5 	6.14.10.5189 	246 	9.06 %

Comment 1

[Gerry Chang [:gchang]]

Hi Peter,
Can you help take a look at this one?

Comment 2

[Michael Leu[:Lenzak](UTC+8)]

These device IDs are all based on Intel GMA X4500, that is really old......

I think this crash is not hard to reproduce if we have a PC with GMA X4500.

Comment 3

[Michael Leu[:Lenzak](UTC+8)]

It crashes in memcpy here
https://dxr.mozilla.org/mozilla-central/source/gfx/angle/src/libANGLE/renderer/d3d/d3d9/Blit9.cpp#109

I think it is because the driver fails to allocate correct memory space to copy.

Can we just blacklist GMA X4500 from using ANGLE?

Maybe that will solve the problem.

Comment 4

[Peter Chang[:pchang]]

It looks like the address that got from IDirect3DVertexBuffer9::Lock had problem, but there was no error code for this. Jeff, any concern to disable ANGLE for users with GMA X4500 users?

Comment 5

[Kelsey Gilbert [:jgilbert]]

Sounds really broken. Let's block the driver.

Comment 6

[Michael Leu[:Lenzak](UTC+8)]

Attachment: Bug1336710 - Add blacklist from using ANGLE for particular Intel GFX under Windows XP.

Just blacklist Intel GFX which may crash ANGLE under Windows XP.

ps. 0x0042 and 0x0046 are the first generation of Intel HD graphics which integrated inside CPU chip, but they share similar architecture with GMA X4500 which lies in northbridge in older platform like G41.

Comment 7

[Peter Chang[:pchang]]

Comment on attachment 8834770 [details] [diff] [review]
Bug1336710 - Add blacklist from using ANGLE for particular Intel GFX under Windows XP.

Review of attachment 8834770 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM, but I have one concern that why this only happened before FF52.

Comment 8

[Peter Chang[:pchang]]

Anthony, are you able to reproduce this?

Comment 9

[u279076]

(In reply to Peter Chang[:pchang] from comment #8)
> Anthony, are you able to reproduce this?

I don't have a computer with theIntel GMA X4500 chipset but according to the inventory wiki there is one in Toronto, dubbed "Silly Box". Milan, can you try to track this system down?

Comment 10

[Michael Leu[:Lenzak](UTC+8)]

I will land this after we got this "Silly box" to test.

BTW, bug1153381 landed a similar blacklist for D3D11 ANGLE, I wonder if it has anything to do with this crash.

Comment 11

[Peter Chang[:pchang]]

(In reply to Anthony Hughes (:ashughes) [GFX][QA][Mentor] from comment #9)
> (In reply to Peter Chang[:pchang] from comment #8)
> > Anthony, are you able to reproduce this?
> 
> I don't have a computer with theIntel GMA X4500 chipset but according to the
> inventory wiki there is one in Toronto, dubbed "Silly Box". Milan, can you
> try to track this system down?

I'm in Toronto and saw lots of machine there. But I'm not sure which one it is.

Comment 12

[Peter Chang[:pchang]]

Ohoh, I just found the machine. I will give it a try later.

Comment 13

[Peter Chang[:pchang]]

(In reply to Peter Chang[:pchang] from comment #12)
> Ohoh, I just found the machine. I will give it a try later.

Unfortunately, it uses window 7.

Comment 14

[Michael Leu[:Lenzak](UTC+8)]

(In reply to Peter Chang[:pchang] from comment #13)
> (In reply to Peter Chang[:pchang] from comment #12)
> > Ohoh, I just found the machine. I will give it a try later.
> 
> Unfortunately, it uses window 7.

Oops...

In that case, maybe we can just land this blacklist since WebGL is a quite advanced function and XP+GMAX4500 has been a legacy platform for a long time, I don't think user with this hardware uses WebGL frequently.

Comment 15

[Peter Chang[:pchang]]

(In reply to Michael Leu[:lenzak800](UTC+8) from comment #14)
> (In reply to Peter Chang[:pchang] from comment #13)
> > (In reply to Peter Chang[:pchang] from comment #12)
> > > Ohoh, I just found the machine. I will give it a try later.
> > 
> > Unfortunately, it uses window 7.
> 
> Oops...
> 
> In that case, maybe we can just land this blacklist since WebGL is a quite
> advanced function and XP+GMAX4500 has been a legacy platform for a long
> time, I don't think user with this hardware uses WebGL frequently.

Sound reasonable.

Comment 16

[Michael Leu[:Lenzak](UTC+8)]

OK, I'll land this after this try ended.
https://treeherder.mozilla.org/#/jobs?repo=try&revision=1d664bd4f9aaa7090c3dd04741ee41bdd2318398

Comment 17

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/aeaa3e4a2351
Add blacklist from using ANGLE for particular Intel GFX under Windows XP. r=pchang

Comment 18

[Tom S. (please needinfo tschuster)]

Do we really need this on inbound considering that Windows XP is not supported anymore?

Comment 19

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/aeaa3e4a2351

Comment 20

[(PTO June 19-July 7) Ryan VanderMeulen]

Please request Aurora/Beta approval on this when you get a chance.

Comment 21

[Michael Leu[:Lenzak](UTC+8)]

Comment on attachment 8834770 [details] [diff] [review]
Bug1336710 - Add blacklist from using ANGLE for particular Intel GFX under Windows XP.

Review of attachment 8834770 [details] [diff] [review]:
-----------------------------------------------------------------

[Feature/regressing bug #]: WindowsXP with GMA X4500 may encounter crash in rx::Blit9::initialize .
    [User impact if declined]: Crashes are bad.
    [Describe test coverage new/current, TBPL]: We have no XP box, but manual test OK under other Windows.
    [Risks and why]: Low risk since it just add a blacklist entry to prevent user with certain hardware configuration using ANGLE.
    [String/UUID change made/needed]: none

Comment 22

[Julien Cristau [:jcristau]]

Comment on attachment 8834770 [details] [diff] [review]
Bug1336710 - Add blacklist from using ANGLE for particular Intel GFX under Windows XP.

blacklist some intel gfx devices on winxp, beta52+

Not sure how much sense this makes in m-c or m-a since winxp support was removed post 52.

Comment 23

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-beta/rev/774a7a3e5a48

Comment 24

[(PTO June 19-July 7) Ryan VanderMeulen]

https://hg.mozilla.org/releases/mozilla-esr52/rev/774a7a3e5a48

Comment 25

[Gerry Chang [:gchang]]

Comment on attachment 8834770 [details] [diff] [review]
Bug1336710 - Add blacklist from using ANGLE for particular Intel GFX under Windows XP.

Fix a crash. Aurora53+.

Comment 26

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/37e8200f6c4b