Closed Bug 1521774 Opened 11 months ago Closed 9 months ago

Crash in mozilla::gfx::Factory::GetD2DDeviceContext

Categories

(Core :: Graphics, defect, P1, critical)

All
Windows
defect

Tracking

()

RESOLVED FIXED
mozilla67
Tracking Status
firefox-esr60 --- unaffected
firefox64 --- unaffected
firefox65 --- unaffected
firefox66 + fixed
firefox67 --- fixed

People

(Reporter: marcia, Assigned: bas.schouten)

References

Details

(Keywords: crash, regression)

Crash Data

Attachments

(2 files)

This bug is for crash report bp-b6685b06-5afa-4934-a3f1-4e34a0190121.

Small volume Win regression which started in 20190119095933: https://bit.ly/2HsTD7i.

Code was touched in Bug 1519760. ni on :bas

Top 10 frames of crashing thread:

0 xul.dll mozilla::gfx::Factory::GetD2DDeviceContext gfx/2d/Factory.cpp:875
1 xul.dll mozilla::gfx::DrawTargetD2D1::OptimizeSourceSurface gfx/2d/DrawTargetD2D1.cpp:2157
2 xul.dll static struct nsLayoutUtils::SurfaceFromElementResult nsLayoutUtils::SurfaceFromElement layout/base/nsLayoutUtils.cpp:7277
3 xul.dll nsLayoutUtils::SurfaceFromElement layout/base/nsLayoutUtils.cpp:7424
4 xul.dll mozilla::dom::CanvasRenderingContext2D::DrawImage dom/canvas/CanvasRenderingContext2D.cpp:4658
5 xul.dll static bool mozilla::dom::CanvasRenderingContext2D_Binding::drawImage dom/bindings/CanvasRenderingContext2DBinding.cpp:2621
6 xul.dll mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3124
7 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:533
8 xul.dll static bool InternalCall js/src/vm/Interpreter.cpp:588
9 xul.dll static bool Interpret js/src/vm/Interpreter.cpp:3068

Flags: needinfo?(bas)
Duplicate of this bug: 1521993

Marking 67 as affected. This is visible in the 66 betas as well, in small volume.

Some URLs:

Correlations for Firefox Nightly:
(35.71% in signature vs 99.95% overall) ipc_message_name = null
(42.86% in signature vs 00.67% overall) GFX_ERROR "Compositors might be mixed (" = true [120.00% vs 00.55% if startup_crash = null]
(100.0% in signature vs 26.23% overall) address = 0x0
(100.0% in signature vs 14.36% overall) GFX_ERROR ": " = true [100.0% vs 20.27% if adapter_vendor_id = 0x8086]
(100.0% in signature vs 33.70% overall) reason = EXCEPTION_ACCESS_VIOLATION_READ
(71.43% in signature vs 02.41% overall) GFX_ERROR "Receive IPC close with reason=AbnormalShutdown" = true [85.71% vs 03.81% if adapter_vendor_id = 0x10de]
(35.71% in signature vs 00.27% overall) Module "nvapi64.dll" = true

Blocks: 1519760
OS: Windows 10 → Windows
Hardware: Unspecified → All
Priority: -- → P3

Maybe related to bug 1524554 and its friend bug 1521368. If so, we should see a significant drop in the beta 5 crash rate.

I don't see this particular crash in the top50 for Beta 5.

Flags: needinfo?(bas)

it's the #17 content crash in 66.0b5 (0.6% of all tab crashes)

Yep, I see it's appeared in the top 50 now. The fix for this is pretty easy so I'll put it up here, and we can decide if it needs uplifting.

Pushed by bschouten@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ab254a4faafe
Ensure a DC is available when using the generic dc on the main thread. r=rhunt
Status: NEW → RESOLVED
Closed: 10 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla67

Bas, can you request beta uplift? Thanks!

Flags: needinfo?(bas)

Changing the priority to p1 as the bug is tracked by a release manager for the current beta.
See How Do You Triage for more information

Priority: P3 → P1

Comment on attachment 9042462 [details]
Bug 1521774: Ensure a DC is available when using the generic dc on the main thread. r=rhunt

Beta/Release Uplift Approval Request

Feature/Bug causing the regression

Bug 1519760

User impact if declined

Content process crash on some decide resets

Is this code covered by automated tests?

No

Has the fix been verified in Nightly?

Yes

Needs manual test from QE?

No

If yes, steps to reproduce

List of other uplifts needed

None

Risk to taking this patch

Low

Why is the change risky/not risky? (and alternatives if risky)

Simple null pointer check

String changes made/needed

None

Flags: needinfo?(bas)
Attachment #9042462 - Flags: approval-mozilla-beta?

Comment on attachment 9042462 [details]
Bug 1521774: Ensure a DC is available when using the generic dc on the main thread. r=rhunt

Top crash fix, let's uplift for beta 8.

Attachment #9042462 - Flags: approval-mozilla-beta? → approval-mozilla-beta+

the number of submitted crash reports on beta hasn't significantly improved after the patch has landed unfortunately.

Status: RESOLVED → REOPENED
Resolution: FIXED → ---

Is bug 1526045 related?

Is this ready to land?

Flags: needinfo?(bas)
Pushed by bschouten@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/0d10f1a69e9a
Part 2: Ensure a device is available when attempting to create a device context. r=rhunt
Status: REOPENED → RESOLVED
Closed: 10 months ago9 months ago
Resolution: --- → FIXED

Comment on attachment 9048115 [details]
Bug 1521774 - Part 2: Ensure a device is available when attempting to create a device context. r=rhunt

Beta/Release Uplift Approval Request

  • Feature/Bug causing the regression: Bug 1519760
  • User impact if declined: Crashes
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): Simple null check
  • String changes made/needed: None
Flags: needinfo?(bas)
Attachment #9048115 - Flags: approval-mozilla-beta?

Comment on attachment 9048115 [details]
Bug 1521774 - Part 2: Ensure a device is available when attempting to create a device context. r=rhunt

Plugging away at these D2D crashes. OK to uplift.
We'll see how it does in the RC build next week.

Attachment #9048115 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Regressions: 1535866
You need to log in before you can comment on or make changes to this bug.