612125 - [D2D] Firefox 4.0b7 crash [@ _cairo_d2d_acquire_source_image ] [@ nvwgf2um.dll@0x88c10 ][@ nvwgf2um.dll@0xcfcc8 ][@ nvwgf2um.dll@0x163e40 ][@ nvwgf2um.dll@0xcfb68 ][@ nvwgf2um.dll@0xcfbc8 ][@ nvwgf2um.dll@0xceee8 ]

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect)

Description

[Scoobidiver (away)]

It is a new crash signature that exists in 4.0b7, b8pre.
It is #177 top crasher in 4.0b7 for the last week.

Signature	nvwgf2um.dll@0x88c10
UUID	08aff12e-efdb-4018-bcef-56dde2101114
Time 	2010-11-14 04:44:28.210175
Uptime	1520
Last Crash	256070 seconds (3.0 days) before submission
Install Age	299837 seconds (3.5 days) since version was first installed.
Product	Firefox
Version	4.0b7
Build ID	20101104142426
Branch	2.0
OS	Windows NT
OS Version	6.1.7600
CPU	x86
CPU Info	GenuineIntel family 6 model 23 stepping 6
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x3c
App Notes 	AdapterVendorID: 10de, AdapterDeviceID: 0e22

Frame 	Module 	Signature [Expand] 	Source
0 	nvwgf2um.dll 	nvwgf2um.dll@0x88c10 	
1 	nvwgf2um.dll 	nvwgf2um.dll@0x88aed 	
2 	nvwgf2um.dll 	nvwgf2um.dll@0x55cbb 	
3 	nvwgf2um.dll 	nvwgf2um.dll@0x3c20d 	
4 	d3d10_1core.dll 	d3d10_1core.dll@0x2ebe0 	
5 	d3d10_1core.dll 	d3d10_1core.dll@0x31266 	
6 	xul.dll 	_cairo_d2d_acquire_source_image 	gfx/cairo/cairo/src/cairo-d2d-surface.cpp:2455
7 	d3d10_1core.dll 	d3d10_1core.dll@0x157f 	
8 	xul.dll 	_cairo_surface_acquire_source_image 	gfx/cairo/cairo/src/cairo-surface.c:1304
9 	xul.dll 	_cairo_surface_clone_similar 	gfx/cairo/cairo/src/cairo-surface.c:1630
10 	xul.dll 	_cairo_pattern_acquire_surface_for_surface 	gfx/cairo/cairo/src/cairo-pattern.c:2161
11 	xul.dll 	_cairo_pattern_acquire_surface 	gfx/cairo/cairo/src/cairo-pattern.c:2339
12 	xul.dll 	_cairo_pattern_acquire_surfaces 	gfx/cairo/cairo/src/cairo-pattern.c:2415
13 	xul.dll 	_cairo_image_surface_composite 	gfx/cairo/cairo/src/cairo-image-surface.c:1136
14 	mozcrt19.dll 	arena_dalloc_small 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:4204
15 	mozcrt19.dll 	arena_dalloc 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:4284
16 	xul.dll 	nsDisplayList::PaintForFrame 	layout/base/nsDisplayList.cpp:469

More reports at:
http://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=nvwgf2um.dll%400x88c10

Comment 1

[Scoobidiver (away)]

It is now #202 top crasher in 4.0b7 for the last 2 weeks and #2 top driver crasher.

Chris,
As Dbaron's script does not work for correlation by module version, is it possible to have a correlation by version of nvwgf2um.dll?

Comment 2

[chris hofmann]

looking at a sample of 50 of the last 200 crashes it appears it is all the same version of nvwgf2um.dll

  50 8.17.12.6099

as in reports like http://crash-stats.mozilla.com/report/index/e34476f4-d6d6-4c2d-b240-e8afc2101120

Comment 3

[Bas Schouten (:bas.schouten)]

We should probably figure out then what driver version this is associated with.

Comment 4

[chris hofmann]

yeah,  all 209 crash reports from the last 9 days are that same .dll version.

Comment 5

[Scoobidiver (away)]

8.17.12.6099 is the latest version of NVIDIA driver for most of graphics.

Comment 7

[Benoit Jacob [:bjacob] (mostly away)]

This is happening on a very broad range of NVIDIA driver versions, at least from 187.87 to 260.99.

Comment 8

[Benoit Jacob [:bjacob] (mostly away)]

(In reply to comment #4)
> yeah,  all 209 crash reports from the last 9 days are that same .dll version.

Once you concentrate on a single signature, it's usual that it selects a precise dll version. However, listing all crashes in that dll,

http://crash-stats.mozilla.com/query/query?product=Firefox&version=ALL%3AALL&platform=windows&branch=2.0&range_value=1&range_unit=weeks&query_search=signature&query_type=startswith&query=nvwgf2um.dll&build_id=&process_type=any&hang_type=any&do_query=1

Shows lots more crash signatures, and the stack traces show they're all coming from the same place in our code.

Comment 9

[Benoit Jacob [:bjacob] (mostly away)]

Also, this is happening on a very broad range of NVIDIA GPUs. Just with driver 260.99, we have Geforce 9000, G200 and G400 series i.e. many different generations.

Comment 10

[Benoit Jacob [:bjacob] (mostly away)]

Assigning to Bas, since this is a D2D bug.

I think that this should block. We get hundreds of reports every week about this.

Comment 11

[Benoit Jacob [:bjacob] (mostly away)]

(In reply to comment #3)
> We should probably figure out then what driver version this is associated with.

See comment 7: this happens on many different driver versions.

Comment 12

[Joe Drew (not getting mail)]

Every single one of these looks like a null dereference (+ offset).

Having STR would sure help. I wonder if it's possible we're OOM?

However, I'm not sure this is important enough to block the release of 4.0. We have significantly more prominent crashes. This could easily be a 4.0.x fix.

Comment 13

[Joe Drew (not getting mail)]

Benoit points out that, summed up, this is something like 500 crashes/week. That's certainly in the top 10 crashes, so we should probably block on this.

Comment 14

[Joe Drew (not getting mail)]

Let me amend that: it's not in the top 10, since most of these crashes are occurring on b7, but it's still important enough for us to tentatively block on.

Comment 15

[Scoobidiver (away)]

There are about 900 crashes/week on 4.0b7, so it is #31 top crasher.
There are about 100 crashes/week on 4.0b8pre, so it is #19 top crasher.

Comment 16

[Scoobidiver (away)]

Stack traces of 4.0b7 crashes and 4.0b8pre crashes are different.
So I think this bug specific to 4.0b7 is closed. But let's wait 4.0b8 release.
See bug 612103 for 4.0b8 crashes.

Comment 17

[Scoobidiver (away)]

No crash reports in 4.0b8 for stack traces including _cairo_d2d_acquire_source_image. It works for me.