1347098 - Startup Crash in mozilla::gfx::DrawTargetD2D1::factory

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect, P3)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-fb9ed713-5dbf-4c0e-af7a-641272170314.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::gfx::DrawTargetD2D1::factory() 	gfx/2d/DrawTargetD2D1.cpp:1169
1 	xul.dll 	mozilla::gfx::Factory::SupportsD2D1() 	gfx/2d/Factory.cpp:650
2 	xul.dll 	gfxWindowsPlatform::InitDWriteSupport() 	gfx/thebes/gfxWindowsPlatform.cpp:410
3 	xul.dll 	gfxWindowsPlatform::InitAcceleration() 	gfx/thebes/gfxWindowsPlatform.cpp:380
4 	xul.dll 	gfxPlatform::Init() 	gfx/thebes/gfxPlatform.cpp:690
5 	xul.dll 	gfxPlatform::GetPlatform() 	gfx/thebes/gfxPlatform.cpp:534
6 	xul.dll 	mozilla::widget::GfxInfo::GetDWriteEnabled(bool*) 	widget/windows/GfxInfo.cpp:69
7 	xul.dll 	NS_InvokeByIndex 	xpcom/reflect/xptcall/md/win32/xptcinvoke_asm_x86_msvc.asm:54
8 	xul.dll 	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) 	js/xpconnect/src/XPCWrappedNative.cpp:1344
9 	xul.dll 	XPC_WN_GetterSetter(JSContext*, unsigned int, JS::Value*) 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1035
10 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:459
11 	xul.dll 	CallGetter 	js/src/vm/NativeObject.cpp:1806
12 	xul.dll 	js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/src/vm/NativeObject.cpp:2115
13 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:480
14 	xul.dll 	js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/src/jsobj.h:854
15 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp:2760
16 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp:405
17 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:477
18 	xul.dll 	CallGetter 	js/src/vm/NativeObject.cpp:1806
19 	xul.dll 	js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) 	js/src/vm/NativeObject.cpp:2115
20 	xul.dll 	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp:480
21 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp:2639
22 	xul.dll 	JS::StructGCPolicy<js::LiveSavedFrameCache>::trace(JSTracer*, js::LiveSavedFrameCache*, char const*) 	obj-firefox/dist/include/js/GCPolicyAPI.h:86
23 	xul.dll 	xptiInterfaceEntry::GetIIDForParamNoAlloc(unsigned short, nsXPTParamInfo const*, nsID*) 	xpcom/reflect/xptinfo/xptiInterfaceInfo.cpp:431
24 	xul.dll 	nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) 	js/xpconnect/src/XPCWrappedJSClass.cpp:1213
25 	xul.dll 	nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) 	js/xpconnect/src/XPCWrappedJS.cpp:613
26 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/md/win32/xptcstubs.cpp:85
27 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/md/win32/xptcstubs.cpp:112
28 	xul.dll 	NS_CreateServicesFromCategory(char const*, nsISupports*, char const*, char16_t const*) 	xpcom/components/nsCategoryManager.cpp:824

this startup crash is regressing in volume in 52.0esr. there it only seems to affect 32bit builds on vista, most of the user comments are in russian.

Correlations for Firefox Esr
(99.74% in signature vs 00.18% overall) address = 0xffffffff83ec8b5d
(100.0% in signature vs 04.82% overall) Module "WindowsCodecs.dll" = true [100.0% vs 17.63% if platform_version = 6.0.6000]
(100.0% in signature vs 25.53% overall) platform_pretty_version = Windows Vista
(99.74% in signature vs 34.73% overall) graphics_startup_test = null
(100.0% in signature vs 36.58% overall) reason = EXCEPTION_ACCESS_VIOLATION_READ
(100.0% in signature vs 05.34% overall) startup_crash = 1 [72.70% vs 06.75% if process_type = null]
(100.0% in signature vs 00.18% overall) GFX_ERROR "Failed to create a D2D1 content device: " = true [37.50% vs 00.15% if process_type = null]

Comment 1

[Vincent Liu[:vliu]]

Hi David,

I'd tried to look into the crash dump and found some possible issues.

1. Almost crash report contains an GraphicsCriticalError in Crash Metadata, which was

      [GFX1-]: Failed to create a D2D1 content device: 0x80004002

   The Hresult 0x80004002 means "No such interface supported"

2. If it happens because of 1, the backtrace should be in [1] instad of [2]. 
   Since [1] and [2] also be the place to do function return, it might be code optimization to cause this.
   Also, mFactory points to NULL seems also make sense if actual function returns was from [1].


   [1]: https://dxr.mozilla.org/mozilla-central/source/gfx/2d/DrawTargetD2D1.cpp#1166
   [2]: https://dxr.mozilla.org/mozilla-central/source/gfx/2d/DrawTargetD2D1.cpp#1177

3. Another found in mini-dump was if I jumped to frame 4 in back trace, the gPlatform also points to NULL. This means gfxWindowsPlatform might be deleted. 
   Deleting gfxWindowsPlatform also triggered D2DCleanup() in [3]. Is it possible the reason why Gecko failed to create a D2D1 device?

   [3]:https://dxr.mozilla.org/mozilla-central/source/gfx/thebes/gfxWindowsPlatform.cpp#325

Through those information, I couldn't have more thought to know what actually cause the crash happens. Could you please have any input for it? Really thanks.

Comment 2

[Kelsey Gilbert [:jgilbert]]

Bump.

Comment 3

[Hani Yacoub, Desktop QA]

Closing this as resolved:worksforme since there were no crashes in the last 6 months for this signature.

Comment 4

[Hani Yacoub, Desktop QA]

I'll Reopen this bug again. There have been crashes with this signature.

Comment 5

[Wayne Mery (:wsmwk)]

At a Firefox crash rate of one per month I doubt this is worth keeping open.

Comment 6

[Jim Mathies [:jimm]]

low volume crash

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.