1691344 - Crash in [@ CContext::ID3D11DeviceContext_Map_<T>]

Status: RESOLVED DUPLICATE of bug 1696325

(Core :: Graphics: WebRender, defect, P3)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

All crashes on Windows 7, >90% with x86 builds. 20-30 crash reports per beta. This started when Software Webrender got activated for Windows and Linux users in early Beta (bug 1689186) => setting status for Firefox 86 as disabled.

Crash report: https://crash-stats.mozilla.org/report/index/bbdef46d-2de6-4224-b97d-70a450210207

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 d3d11.dll static long __stdcall CContext::ID3D11DeviceContext_Map_<3> 
1 xul.dll xul.dll@0x155847a 
2 xul.dll xul.dll@0x155662b 
3 xul.dll xul.dll@0x38ba0f1 
4 xul.dll xul.dll@0x38cd6c9 
5 xul.dll xul.dll@0x4394a6a 
6 xul.dll xul.dll@0x437e713 
7 xul.dll xul.dll@0x437cac2 
8 xul.dll xul.dll@0x156202e 
9 xul.dll xul.dll@0x1561ab9 

Comment 1

[Lee Salzman [:lsalzman]]

Reports seem to have SW-WR enabled. Matt, this looks like something going wrong in the mapping code in RcD3D11SWGL compositor?

Comment 3

[Chris Peterson [:cpeterson]]

Is fuzz bug 1603880 crashing in CreateDirect3D11SurfaceFromDXGISurface possible related to this crash? Both bugs have the same [@ CContext::TID3D11DeviceContext_Map_<T>] crash signature.

Comment 4

[Lee Salzman [:lsalzman]]

It looks like maybe here the context or mStagintTexture is somehow null in some of the crash stacks I am looking at: https://hg.mozilla.org/releases/mozilla-beta/file/c850f93582ef95f2ca5dd2a1f37e3d475fa05cd7/gfx/webrender_bindings/RenderCompositorD3D11SWGL.cpp#l322

At least, the crash address is 0x31, which suspects a read off of something that originally started as a null pointer, for example: https://crash-stats.mozilla.org/report/index/24a9ae43-1c33-4ce3-8f25-664a20210303

Comment 5

[Sotaro Ikeda [:sotaro]]

I am going to look into it.

Comment 6

[Sotaro Ikeda [:sotaro]]

The following crash seemed happen in D3D11YCbCrImage::GetAsSourceSurface().
https://crash-stats.mozilla.org/report/index/5be67fd3-913f-44d6-96a4-b2bc50210208

Comment 7

[Andrew Osmond [:aosmond] (he/him)]

The CContext::TID3D11DeviceContext_Map_<T> signature happens on Windows 10.

Comment 8

[Sotaro Ikeda [:sotaro]]

Crashes seemed to be addressed on nightly.

Comment 9

[Andrew Osmond [:aosmond] (he/him)]

Same build as bug 1696325 landed in, nothing else looks interesting to have fixed it.