disable-optimize yields instant GPU thread crash on Windows 10

NEW
Unassigned

Status

()

Core
Graphics
P3
normal
a year ago
6 months ago

People

(Reporter: ng, Unassigned)

Tracking

({crash})

unspecified
crash
Points:
---

Firefox Tracking Flags

(firefox57 fix-optional)

Details

(Whiteboard: gfx-noted)

Attachments

(2 attachments)

(Reporter)

Description

a year ago
Created attachment 8894659 [details]
firefox_gpu_proc_crash_disable_optimize_no_heap.dmp

I am seeing an Instant crash in the GPU process When compiling FF on Windows 10 (Insider Edition) with an out of memory error. Note the amount of memory requested changes every run.


My mozconfig file:


    #DEBUG non-opt configuration
    ac_add_options --disable-optimize --enable-debug


Attached is a mini-dump, and a run log.
(Reporter)

Comment 1

a year ago
Created attachment 8894660 [details]
firefox_gpu_proc_crash_disable_optimize.log
ng,
do you build it with 32-bit or 64-bit config?
Flags: needinfo?(na-g)
(Reporter)

Comment 3

a year ago
32-bit, and the mozconfig above is all the config I used.
Flags: needinfo?(na-g)
I can not reproduce it locally.
Keywords: crash
(Reporter)

Comment 5

a year ago
I tried again with latest rev of central, 65507616792c, still the same crash.
Build with 57.0a1 (2017-08-14) (64-bit) and configure with

# 64 bits
ac_add_options --target=x86_64-pc-mingw32
ac_add_options --host=x86_64-pc-mingw32

# For debug
ac_add_options --enable-debug
ac_add_options --disable-optimize

I still can't reproduce it.

Updated

11 months ago
Priority: -- → P3
Whiteboard: gfx-noted

Updated

11 months ago
QA Contact: dmajor

Comment 7

11 months ago
Sorry I didn't see this earlier; I don't normally watch for QA-contact bugs.

Why in the world are we requesting 968M of memory?

Can you provide a stack trace? (I can't get one out of the minidump because you build this binary locally and I don't have your debug symbol files)

Updated

11 months ago
Flags: needinfo?(na-g)
(Reporter)

Comment 8

11 months ago
Stack trace (mozilla-central @rev 65507616792c):
 	xul.dll!mozilla::gfx::PathBuilderCairo::BezierTo(const mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits,float> & aCP1, const mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits,float> & aCP2, const mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits,float> & aCP3) Line 61	C++
 	xul.dll!mozilla::SVGPathData::BuildPath(mozilla::gfx::PathBuilder * builder, unsigned char aStrokeLineCap, float aStrokeWidth) Line 405	C++
 	xul.dll!mozilla::dom::SVGPathElement::BuildPath(mozilla::gfx::PathBuilder * aBuilder) Line 344	C++
 	xul.dll!mozilla::dom::SVGGeometryElement::GetOrBuildPath(const mozilla::gfx::DrawTarget & aDrawTarget, mozilla::gfx::FillRule aFillRule) Line 112	C++
 	xul.dll!mozilla::SVGGeometryFrame::GetBBoxContribution(const mozilla::gfx::BaseMatrix<float> & aToBBoxUserspace, unsigned int aFlags) Line 557	C++
 	xul.dll!mozilla::SVGGeometryFrame::ReflowSVG() Line 414	C++
 	xul.dll!nsSVGDisplayContainerFrame::ReflowSVG() Line 355	C++
 	xul.dll!nsSVGOuterSVGFrame::Reflow(nsPresContext * aPresContext, mozilla::ReflowOutput & aDesiredSize, const mozilla::ReflowInput & aReflowInput, nsReflowStatus & aStatus) Line 455	C++
 	xul.dll!nsContainerFrame::ReflowChild(nsIFrame * aKidFrame, nsPresContext * aPresContext, mozilla::ReflowOutput & aDesiredSize, const mozilla::ReflowInput & aReflowInput, const mozilla::WritingMode & aWM, const mozilla::LogicalPoint & aPos, const nsSize & aContainerSize, unsigned int aFlags, nsReflowStatus & aStatus, nsOverflowContinuationTracker * aTracker) Line 940	C++
 	xul.dll!nsCanvasFrame::Reflow(nsPresContext * aPresContext, mozilla::ReflowOutput & aDesiredSize, const mozilla::ReflowInput & aReflowInput, nsReflowStatus & aStatus) Line 756	C++
 	xul.dll!nsContainerFrame::ReflowChild(nsIFrame * aKidFrame, nsPresContext * aPresContext, mozilla::ReflowOutput & aDesiredSize, const mozilla::ReflowInput & aReflowInput, const mozilla::WritingMode & aWM, const mozilla::LogicalPoint & aPos, const nsSize & aContainerSize, unsigned int aFlags, nsReflowStatus & aStatus, nsOverflowContinuationTracker * aTracker) Line 940	C++
 	xul.dll!nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput * aState, bool aAssumeHScroll, bool aAssumeVScroll, mozilla::ReflowOutput * aMetrics, bool aFirstPass) Line 553	C++
 	xul.dll!nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput * aState, const mozilla::ReflowOutput & aDesiredSize) Line 684	C++
 	xul.dll!nsHTMLScrollFrame::Reflow(nsPresContext * aPresContext, mozilla::ReflowOutput & aDesiredSize, const mozilla::ReflowInput & aReflowInput, nsReflowStatus & aStatus) Line 1039	C++
 	xul.dll!nsContainerFrame::ReflowChild(nsIFrame * aKidFrame, nsPresContext * aPresContext, mozilla::ReflowOutput & aDesiredSize, const mozilla::ReflowInput & aReflowInput, int aX, int aY, unsigned int aFlags, nsReflowStatus & aStatus, nsOverflowContinuationTracker * aTracker) Line 983	C++
 	xul.dll!mozilla::ViewportFrame::Reflow(nsPresContext * aPresContext, mozilla::ReflowOutput & aDesiredSize, const mozilla::ReflowInput & aReflowInput, nsReflowStatus & aStatus) Line 331	C++
 	xul.dll!mozilla::PresShell::DoReflow(nsIFrame * target, bool aInterruptible) Line 9372	C++
 	xul.dll!mozilla::PresShell::ProcessReflowCommands(bool aInterruptible) Line 9539	C++
 	xul.dll!mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush aFlush) Line 4237	C++
 	xul.dll!nsIPresShell::FlushPendingNotifications(mozilla::ChangesToFlush aType) Line 592	C++
 	xul.dll!mozilla::PresShell::DoFlushPendingNotifications(mozilla::FlushType aType) Line 4077	C++
 	xul.dll!nsIPresShell::FlushPendingNotifications(mozilla::FlushType aType) Line 583	C++
 	xul.dll!mozilla::image::SVGDocumentWrapper::FlushLayout() Line 427	C++
 	xul.dll!mozilla::image::VectorImage::OnSVGDocumentLoaded() Line 1271	C++
 	xul.dll!mozilla::image::SVGLoadEventListener::HandleEvent(nsIDOMEvent * aEvent) Line 227	C++
 	xul.dll!mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener * aListener, nsIDOMEvent * aDOMEvent, mozilla::dom::EventTarget * aCurrentTarget) Line 1146	C++
 	xul.dll!mozilla::EventListenerManager::HandleEventInternal(nsPresContext * aPresContext, mozilla::WidgetEvent * aEvent, nsIDOMEvent * * aDOMEvent, mozilla::dom::EventTarget * aCurrentTarget, nsEventStatus * aEventStatus) Line 1316	C++
 	xul.dll!mozilla::EventListenerManager::HandleEvent(nsPresContext * aPresContext, mozilla::WidgetEvent * aEvent, nsIDOMEvent * * aDOMEvent, mozilla::dom::EventTarget * aCurrentTarget, nsEventStatus * aEventStatus) Line 377	C++
 	xul.dll!mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor & aVisitor, mozilla::ELMCreationDetector & aCd) Line 319	C++
 	xul.dll!mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem> & aChain, mozilla::EventChainPostVisitor & aVisitor, mozilla::EventDispatchingCallback * aCallback, mozilla::ELMCreationDetector & aCd) Line 466	C++
 	xul.dll!mozilla::EventDispatcher::Dispatch(nsISupports * aTarget, nsPresContext * aPresContext, mozilla::WidgetEvent * aEvent, nsIDOMEvent * aDOMEvent, nsEventStatus * aEventStatus, mozilla::EventDispatchingCallback * aCallback, nsTArray<mozilla::dom::EventTarget *> * aTargets) Line 824	C++
 	xul.dll!mozilla::EventDispatcher::DispatchDOMEvent(nsISupports * aTarget, mozilla::WidgetEvent * aEvent, nsIDOMEvent * aDOMEvent, nsPresContext * aPresContext, nsEventStatus * aEventStatus) Line 890	C++
 	xul.dll!nsINode::DispatchEvent(nsIDOMEvent * aEvent, bool * aRetVal) Line 1346	C++
 	xul.dll!mozilla::AsyncEventDispatcher::Run() Line 71	C++
 	xul.dll!nsThread::ProcessNextEvent(bool aMayWait, bool * aResult) Line 1447	C++
 	xul.dll!NS_ProcessNextEvent(nsIThread * aThread, bool aMayWait) Line 480	C++
 	xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate * aDelegate) Line 97	C++
 	xul.dll!MessageLoop::RunInternal() Line 327	C++
 	xul.dll!MessageLoop::RunHandler() Line 320	C++
 	xul.dll!MessageLoop::Run() Line 300	C++
 	xul.dll!nsBaseAppShell::Run() Line 158	C++
 	xul.dll!nsAppShell::Run() Line 210	C++
 	xul.dll!nsAppStartup::Run() Line 287	C++
 	xul.dll!XREMain::XRE_mainRun() Line 4602	C++
 	xul.dll!XREMain::XRE_main(int argc, char * * argv, const mozilla::BootstrapConfig & aConfig) Line 4766	C++
 	xul.dll!XRE_main(int argc, char * * argv, const mozilla::BootstrapConfig & aConfig) Line 4861	C++
 	xul.dll!mozilla::BootstrapImpl::XRE_main(int argc, char * * argv, const mozilla::BootstrapConfig & aConfig) Line 45	C++
 	firefox.exe!do_main(int argc, char * * argv, char * * envp) Line 237	C++
 	firefox.exe!NS_internal_main(int argc, char * * argv, char * * envp) Line 309	C++
 	firefox.exe!wmain(int argc, wchar_t * * argv) Line 115	C++
(Reporter)

Comment 9

11 months ago
Locals  @ 	xul.dll!mozilla::gfx::PathBuilderCairo::BezierTo(const mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits,float> & aCP1, const mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits,float> & aCP2, const mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits,float> & aCP3) Line 61	C++
-		aCP1	{...}	const mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits,float> &
	+		mozilla::gfx::BasePoint<float,mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits,float>,mozilla::gfx::CoordTyped<mozilla::gfx::UnknownUnits,float> >	{x=nan y=nan components=0x011bcf04 {nan, nan} }	mozilla::gfx::BasePoint<float,mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits,float>,mozilla::gfx::CoordTyped<mozilla::gfx::UnknownUnits,float> >
			mozilla::gfx::UnknownUnits	{...}	mozilla::gfx::UnknownUnits
			aCP1.x	nan	const float
			aCP1.y	nan	const float
-		aCP2	{...}	const mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits,float> &
	+		mozilla::gfx::BasePoint<float,mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits,float>,mozilla::gfx::CoordTyped<mozilla::gfx::UnknownUnits,float> >	{x=nan y=nan components=0x011bceec {nan, nan} }	mozilla::gfx::BasePoint<float,mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits,float>,mozilla::gfx::CoordTyped<mozilla::gfx::UnknownUnits,float> >
			mozilla::gfx::UnknownUnits	{...}	mozilla::gfx::UnknownUnits
			aCP2.x	nan	const float
-		data	{header={type=CAIRO_PATH_MOVE_TO (0) length=2146959360 } point={x=nan y=nan } }	_cairo_path_data_t
	+		header	{type=CAIRO_PATH_MOVE_TO (0) length=2146959360 }	_cairo_path_data_t::<unnamed-type-header>
	+		point	{x=nan y=nan }	_cairo_path_data_t::<unnamed-type-point>
+		data.point	{x=nan y=nan }	_cairo_path_data_t::<unnamed-type-point>
		data.point.x	nan	double
		data.point.y	nan	double
-		mPathData	{ size=40360465 }	std::vector<_cairo_path_data_t,std::allocator<_cairo_path_data_t> >
			[capacity]	40360465	int
	+		[allocator]	allocator	std::_Compressed_pair<std::_Wrap_alloc<std::allocator<_cairo_path_data_t> >,std::_Vector_val<std::_Simple_types<_cairo_path_data_t> >,1>
	+		[0]	{header={type=CAIRO_PATH_MOVE_TO (0) length=2 } point={x=4.243991581931e-314#DEN y=2.5342423084621311e-303 } }	_cairo_path_data_t
	+		[1]	{header={type=1610612736 length=1076240056 } point={x=11.060000419616699 y=10.000000000000000 } }	_cairo_path_data_t
	+		[2]	{header={type=CAIRO_PATH_LINE_TO (1) length=2 } point={x=4.243991582425e-314#DEN y=2.659260672275e-314#DEN } }	_cairo_path_data_t
	+		[3]	{header={type=1073741824 length=1076694876 } point={x=14.530000686645508 y=6.5299997329711914 } }	_cairo_path_data_t
	+		[4]	{header={type=CAIRO_PATH_CURVE_TO (2) length=4 } point={x=8.487983164849e-314#DEN y=nan } }	_cairo_path_data_t
	+		[5]	{header={type=CAIRO_PATH_MOVE_TO (0) length=2146959360 } point={x=nan y=nan } }	_cairo_path_data_t
	+		[...] many more, debugger stops at ~500k
-		this	0x2102ebe0 {mFillRule=FILL_WINDING (0 '\0') mPathData={ size=40360465 } mCurrentPoint={...} ...}	mozilla::gfx::PathBuilderCairo *
	+		mozilla::gfx::PathBuilder	{...}	mozilla::gfx::PathBuilder
			mFillRule	FILL_WINDING (0 '\0')	mozilla::gfx::FillRule
	+		mPathData	{ size=40360465 }	std::vector<_cairo_path_data_t,std::allocator<_cairo_path_data_t> >
	+		mCurrentPoint	{...}	mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits,float>
	+		mBeginPoint	{...}	mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits,float>
Flags: needinfo?(na-g)

Comment 10

11 months ago
> Why in the world are we requesting 968M of memory?

Could it be that we have some bad data somewhere that leads the PathBuilder to build some horribly huge path?
Flags: needinfo?(jmuizelaar)
(In reply to David Major [:dmajor] from comment #10)
> > Why in the world are we requesting 968M of memory?
> 
> Could it be that we have some bad data somewhere that leads the PathBuilder
> to build some horribly huge path?

Possible. Also odd is the fact that PathBuilderCairo is begin used. I wouldn't expect that to be used in regular configuration on Windows. It would be valuable to know the url of the svg being drawn.
Flags: needinfo?(jmuizelaar)
(In reply to Jeff Muizelaar [:jrmuizel] from comment #11)
> (In reply to David Major [:dmajor] from comment #10)
> > > Why in the world are we requesting 968M of memory?
> > 
> > Could it be that we have some bad data somewhere that leads the PathBuilder
> > to build some horribly huge path?
> 
> Possible. Also odd is the fact that PathBuilderCairo is begin used. I
> wouldn't expect that to be used in regular configuration on Windows. It
> would be valuable to know the url of the svg being drawn.

This can be dug out of the VectorImage that mozilla::image::VectorImage::OnSVGDocumentLoaded() is being called on.
(Reporter)

Comment 13

11 months ago
mozilla::detail::nsCStringRepr	{mData=0x205de588 "chrome://global/skin/icons/close.svg" mLength=36 mDataFlags=TERMINATED | SHARED (5) ...}	mozilla::detail::nsCStringRepr
status-firefox57: --- → fix-optional

Comment 14

6 months ago
When a 32 bit process exeeds 2 gb, firefox 32 bit will probably crash due to a design out of memory. If possible run 64 bit.
You need to log in before you can comment on or make changes to this bug.