1522662 - Crash in memcpy | TextStageManager::FillSubrect

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect, P3)

Description

[Marcia Knous [:marcia]]

This bug is for crash report bp-1c865400-9571-455e-9855-f56d80190120.

Seen while looking at nightly crash stats: https://bit.ly/2sJqryC. Although present on other branches, nightly has 35 crashes/18 installs. All the crashes occur on Windows 8.1.

All the URLs are you tube. There is a strong correlation to the BlockSite addon:

81.48% in signature vs 00.63% overall) Addon "BlockSite" = true
https://addons.mozilla.org/en-US/firefox/addon/block-site-2/

Top 10 frames of crashing thread:

0 msvcrt.dll memcpy 
1 d2d1.dll TextStageManager::FillSubrect 
2 d2d1.dll TextStageManager::FillSubrect 
3 d2d1.dll GlyphRunRenderer::ProcessSubRects 
4 d2d1.dll GlyphRunRenderer::ProcessAliasingMode 
5 d2d1.dll CHwSurfaceRenderTarget::DrawGlyphRun 
6 d2d1.dll BrushRedirectionCompatibleCommand<CCommand_DrawGlyphRun, 0>::Execute 
7 d2d1.dll BatchCommandWork::ExecuteConsumer 
8 d2d1.dll PCChainManager::Execute 
9 d2d1.dll CHwSurfaceRenderTarget::ProcessBatch 

Comment 1

[Marcia Knous [:marcia]]

This crash is happening again on 69 and 68 and showed up in the 6-20 spiking signatures report.

Comment 2

[Marcia Knous [:marcia]]

Adding 70 as affected since there are some crashes in recent nightly builds starting on 8-6.

Comment 3

[Asif Youssuff]

User posting about this here: https://www.reddit.com/r/firefox/comments/eluura/ff_tabs_are_crashing_constantly_and_at_random/

Is there something they could do to provide additional detail?

Crash here: https://crash-stats.mozilla.org/report/index/410e2da1-b813-46dc-9fc6-c14c60200108

Comment 4

[Marcia Knous [:marcia]]

743 crashes in the last release. Strong (almost 60%) correlation to Ellesmere [Radeon RX 470/480/570/570X/580/580X] (0x67df). All users are running Windows 8.1.

Not seeing any other correlations currently. 72.0 just went out, so we should keep on eye on this as rollout continues.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.