Last Comment Bug 656589 - Crash [@ cairo_d2d_present_backbuffer ] invalid & oversize select option content causes crash on clicking select box
: Crash [@ cairo_d2d_present_backbuffer ] invalid & oversize select option cont...
Status: VERIFIED FIXED
[tbird crash][qa!]
: crash, testcase, verified-beta
Product: Core
Classification: Components
Component: Graphics (show other bugs)
: 2.0 Branch
: x86 Windows 7
: -- critical (vote)
: mozilla10
Assigned To: Bas Schouten (:bas.schouten)
:
Mentors:
: 659626 682103 (view as bug list)
Depends on:
Blocks: 679859 682103
  Show dependency treegraph
 
Reported: 2011-05-12 05:28 PDT by loki1985
Modified: 2012-01-04 13:19 PST (History)
16 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
-
affected
affected
verified


Attachments
testcase (3.53 KB, text/html)
2011-05-12 06:49 PDT, Bob Clary [:bc:]
no flags Details
Avoid using non-functional Direct2D surfaces (5.31 KB, patch)
2011-08-29 09:22 PDT, Bas Schouten (:bas.schouten)
no flags Details | Diff | Splinter Review
Avoid using non-functional Direct2D surfaces v2 (5.35 KB, patch)
2011-10-03 06:04 PDT, Bas Schouten (:bas.schouten)
jmathies: review+
Details | Diff | Splinter Review

Description loki1985 2011-05-12 05:28:20 PDT
User-Agent:       Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Build Identifier: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1

while developing a PHP site, i had a serverside bug which destroyed the sites content and filled the content of a select option tag with html.

then i noticed that clicking said select in firefox, it crashed firefox.

i managed to reduce the HTML to a working testcase, see "additional information".

when reducing the dummy text content (lorem ipsum) by half, instead of crashing firefox causes windows 7 to switch to basic color mode in an ugly way.

speculation: could have to do with multimonitor setups, since all machines i have access to at the moment have 2 or 3 monitors. cannot test on single monitor machine right now.


Reproducible: Always

Steps to Reproduce:
1. create somefile.html on your harddrive
2. copy HTML from "additinal information" somefile.html and save
3. open somefile.html in firefox
4. click on visible selectbox (lorem ipsum text)


Actual Results:  
firefox crashes

Expected Results:  
no crash

<div>
<select>
<option value="0">
<html>
<body>
Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua.
At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor
sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et
accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.
Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua.
At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor
sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et
accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.
Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua.
At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor
sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et
accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.
Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua.
At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor
sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et
accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.
Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua.
At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor
sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et
accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.
Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua.
At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor
sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et
accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.
</body>
</html>
Comment 1 Bob Clary [:bc:] 2011-05-12 06:49:40 PDT
Created attachment 531921 [details]
testcase

I don't crash with Nightly nor Namaroka on Mac.
Comment 2 Bob Clary [:bc:] 2011-05-12 06:57:09 PDT
Nor 4.0, 4.0.1 or Nightly on WinXp. loki, can you submit a crash report and paste the id here? http://support.mozilla.com/en-US/kb/Firefox%20crashes?s=crash+report&as=s
Comment 3 loki1985 2011-05-12 08:00:40 PDT
bp-d44d9c8b-7c2a-4580-9dfc-01d0c2110512
Comment 4 Bob Clary [:bc:] 2011-05-12 08:05:38 PDT
maybe related to bug 595990 ?

not security sensitive.
Comment 5 Bas Schouten (:bas.schouten) 2011-05-12 08:11:49 PDT
This function (should) never get called with default settings, considering this only occurs in a combination of Direct2D with BasicLayers, which is unsupported. Could you post your about:support?
Comment 6 loki1985 2011-05-12 08:25:37 PDT

  Allgemeine Informationen

        Name
        Firefox

        Version
        4.0.1

        User-Agent
        Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1

        Profilordner

          Beinhaltenden Ordner anzeigen

        Aktivierte Plugins

          about:plugins

        Build-Konfiguration

          about:buildconfig

  Erweiterungen

        Name

        Version

        Aktiviert

        ID

        Java Console
        6.0.23
        true
        {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

        Java Console
        6.0.25
        true
        {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}

        Firebug
        1.7.0
        true
        firebug@software.joehewitt.com

        FirePHP
        0.5.0
        true
        FirePHPExtension-Build@firephp.org

        Adblock Plus
        1.3.6
        true
        {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

  Modifizierte Einstellungen

      Name

      Wert

        accessibility.typeaheadfind.flashBar
        0

        browser.places.importBookmarksHTML
        false

        browser.places.smartBookmarksVersion
        2

        browser.startup.homepage
        http://www.google.de/

        browser.startup.homepage_override.buildID
        20110413222027

        browser.startup.homepage_override.mstone
        rv:2.0.1

        extensions.lastAppVersion
        4.0.1

        network.cookie.prefsMigrated
        true

        places.database.lastMaintenance
        1305188377

        places.history.expiration.transient_current_max_pages
        128466

        privacy.sanitize.migrateFx3Prefs
        true

        security.warn_viewing_mixed
        false

  Grafik

        Karten-Beschreibung
        NVIDIA GeForce 8500 GT

        Vendor-ID
        10de

        Geräte-ID
        0421

        Karten-Ram
        256

        Karten-Treiber
        nvd3dumx,nvwgf2umx,nvwgf2umx nvd3dum,nvwgf2um,nvwgf2um

        Treiber-Version
        8.17.12.6658

        Treiber-Datum
        1-7-2011

        Direct2D aktiviert
        true

        DirectWrite aktiviert
        true (6.1.7601.17563, font cache 1,43 MB)

        WebGL-Renderer
        Google Inc. -- ANGLE -- OpenGL ES 2.0 (ANGLE 0.0.0.611)

        GPU-beschleunigte Fenster
        1/1 Direct3D 10
Comment 7 loki1985 2011-05-12 08:27:28 PDT
some more information: my machine has 3 monitors on 2 graphics cards active, one nvidia (shown above), one intel onboard, and runs windows 7.

the problem was reproducible on 2 other machines, specs not completely known, but with 2 monitors each.
Comment 8 loki1985 2011-05-12 08:28:43 PDT
forgot to say: the 2 other machines are also running windows 7.

so this was only reproduced on win7 by me.
Comment 9 Bas Schouten (:bas.schouten) 2011-05-12 08:45:58 PDT
So, I can confirm this bug, the problem is that this is causing a window to be created which is two big for the D3D10 layer manager, so its creation fails. It then creates a fallback layermanager. Which is a problem, in the past we clamped window sizes but it seems somehow that stopped.

I suspect we'll want this fixed for Firefox 6.
Comment 10 Johnathan Nightingale [:johnath] 2011-05-24 15:00:42 PDT
Looks like this is broken since 4.0 and hence not 6.0-specific - we would like to see an approval request for a safe fix, but not tracking+
Comment 11 Markus Fischer 2011-05-25 06:44:09 PDT
*** Bug 659626 has been marked as a duplicate of this bug. ***
Comment 12 Bas Schouten (:bas.schouten) 2011-08-29 09:21:06 PDT
*** Bug 682103 has been marked as a duplicate of this bug. ***
Comment 13 Bas Schouten (:bas.schouten) 2011-08-29 09:22:53 PDT
Created attachment 556574 [details] [diff] [review]
Avoid using non-functional Direct2D surfaces

This patch causes us to:

1. Not use accelerated layers when the window is very big. (On my ATI drivers D3D9 would pretend to succesfully create a swap chain but not actually work, this made this bug not crash for me, but not work right either)
2. Fallback to GDI when a non-functional D2D surface is created.
Comment 14 Jim Mathies [:jimm] 2011-09-07 07:32:11 PDT
Comment on attachment 556574 [details] [diff] [review]
Avoid using non-functional Direct2D surfaces

Review of attachment 556574 [details] [diff] [review]:
-----------------------------------------------------------------

This solves the crash problem on my system. I did see an assert though when selecting the drop down:

###!!! ASSERTION: gfxASurface::CairoSurface called with mSurface == nsnull!: 'mSurface != nsnull', file f:\Mozilla\firefox\MC-DBG\dist\include\gfxASurface.h, line 119

Is that expected?

::: widget/src/windows/nsWindow.cpp
@@ +3183,5 @@
>  
> +// We should never really try to accelerate windows bigger than this. In some
> +// cases this might lead to no D3D9 acceleration where we could have had it
> +// but D3D9 does not reliably report when it supports bigger windows.
> +#define MAX_ACCELERATED_DIMENSION 8192

Please move this up to the top of the file with the rest of the defines. What was your reasoning for using this specific value?
Comment 15 Wayne Mery (:wsmwk, NI for questions) 2011-09-07 14:04:56 PDT
reporter of bp-ca41b661-9deb-4dba-a14a-89bb62110826 could possibly test once this lands.  ("hitting send button kills nvidia 330m driver on spring 2010 macbook pro 15, win 7 64 ult, all updates. happens all the time.")
Comment 16 Bas Schouten (:bas.schouten) 2011-10-03 03:58:52 PDT
Ugh, this review escaped my attention during the all-hands it seems.

(In reply to Jim Mathies [:jimm] from comment #14)
> Comment on attachment 556574 [details] [diff] [review] [diff] [details] [review]
> Avoid using non-functional Direct2D surfaces
> 
> Review of attachment 556574 [details] [diff] [review] [diff] [details] [review]:
> -----------------------------------------------------------------
> 
> This solves the crash problem on my system. I did see an assert though when
> selecting the drop down:
> 
> ###!!! ASSERTION: gfxASurface::CairoSurface called with mSurface == nsnull!:
> 'mSurface != nsnull', file
> f:\Mozilla\firefox\MC-DBG\dist\include\gfxASurface.h, line 119
> 
> Is that expected?

It is. We use CairoSurface() to check the validity. We conclude it's invalid, it kinda sucks that asserts. I could switch this to just use CairoStatus which returns -1 if the surface is invalid.

> 
> ::: widget/src/windows/nsWindow.cpp
> @@ +3183,5 @@
> >  
> > +// We should never really try to accelerate windows bigger than this. In some
> > +// cases this might lead to no D3D9 acceleration where we could have had it
> > +// but D3D9 does not reliably report when it supports bigger windows.
> > +#define MAX_ACCELERATED_DIMENSION 8192
> 
> Please move this up to the top of the file with the rest of the defines.
> What was your reasoning for using this specific value?

This is the maximum texture size for D3D10. I'm fine with moving it up.
Comment 17 Bas Schouten (:bas.schouten) 2011-10-03 06:04:06 PDT
Created attachment 564169 [details] [diff] [review]
Avoid using non-functional Direct2D surfaces v2

Updated to address review comments.
Comment 18 Bas Schouten (:bas.schouten) 2011-10-03 18:21:57 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/30c3c5ab99e7
Comment 19 Marco Bonardo [::mak] 2011-10-04 02:08:10 PDT
https://hg.mozilla.org/mozilla-central/rev/30c3c5ab99e7
Comment 20 Scoobidiver (away) 2011-10-05 02:03:06 PDT
If the fix of this bug is required to fix bug 679859 (tracking for Fx 8), the patch should land on Aurora and Beta.
Comment 21 Vlad [QA] 2012-01-04 08:09:43 PST
I've tested this using the steps from the description and I confirm the fact that Firefox doesn't crash any more.

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0) Gecko/20100101 Firefox/10.0 beta 2
Mozilla/5.0 (Windows NT 6.1; rv:10.0) Gecko/20100101 Firefox/10.0 beta 2

Considering this, setting resolution to Verified Fixed.
Comment 22 Markus Fischer 2012-01-04 13:19:21 PST
Just an observation I made with Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1 on W7 Pro x64 : FF does not crash but it seems that "dwm.exe" crashes, leaving Aero mode switching to basic windowing. "dwm.exe" gets immediately restartet, but only once I exit FF Aero gets restored.

Note You need to log in before you can comment on or make changes to this bug.