Closed Bug 704124 Opened 12 years ago Closed 11 years ago

Firefox Crash @ gfxContext::SetSource

Categories

(Core :: Graphics, defect)

Product:
Core
Component:
Graphics
Version:
11 Branch
Platform:
All
Windows 7
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla14
Tracking Flags:
Tracking Status
firefox12 --- affected
firefox13 --- affected

People

(Reporter: marcia, Assigned: mattwoodrow)

References

(
URL
)

Details

(4 keywords)

Crash Data

Attachments

(1 file)

Use correct source surface
1.05 KB, patch
bas.schouten
: review+
akeybl
: approval-mozilla-aurora+
akeybl
: approval-mozilla-beta-
blassey
: approval-mozilla-central+
Details | Diff | Splinter Review 
Seen while looking at trunk crash stats. Crashes started showing up on trunk using the 2011111800 build. 35 crashes using the 2011112000 build. Crashes show up in small volume in other versions of Firefox as well.

http://tinyurl.com/6lq6u52 is the crashes in this signature across all versions in the last week.

https://crash-stats.mozilla.com/report/index/212de145-c74d-49fd-9f2d-f9b192111121

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	gfxContext::SetSource 	gfx/thebes/gfxContext.cpp:760
1 	xul.dll 	mozilla::layers::CanvasLayerD3D9::UpdateSurface 	gfx/layers/d3d9/CanvasLayerD3D9.cpp:195
2 	xul.dll 	mozilla::layers::CanvasLayerD3D9::RenderLayer 	gfx/layers/d3d9/CanvasLayerD3D9.cpp:226
3 	xul.dll 	mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerD3D9> 	gfx/layers/d3d9/ContainerLayerD3D9.cpp:285
4 	xul.dll 	mozilla::layers::ContainerLayerD3D9::RenderLayer 	gfx/layers/d3d9/ContainerLayerD3D9.cpp:357
5 	xul.dll 	mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerD3D9> 	gfx/layers/d3d9/ContainerLayerD3D9.cpp:285
6 	xul.dll 	mozilla::layers::ContainerLayerD3D9::RenderLayer 	gfx/layers/d3d9/ContainerLayerD3D9.cpp:357
7 	xul.dll 	mozilla::layers::LayerManagerD3D9::Render 	gfx/layers/d3d9/LayerManagerD3D9.cpp:347
8 	xul.dll 	mozilla::layers::LayerManagerD3D9::EndTransaction 	gfx/layers/d3d9/LayerManagerD3D9.cpp:184
9 	xul.dll 	nsDisplayList::PaintForFrame 	layout/base/nsDisplayList.cpp:635
10 	xul.dll 	nsLayoutUtils::PaintFrame 	layout/base/nsLayoutUtils.cpp:1700
11 	xul.dll 	PresShell::Paint 	layout/base/nsPresShell.cpp:5472
12 	xul.dll 	nsViewManager::Refresh 	view/src/nsViewManager.cpp:390
13 	xul.dll 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:887
14 	xul.dll 	AttachedHandleEvent 	view/src/nsView.cpp:191
15 	xul.dll 	nsWindow::DispatchEvent 	widget/src/windows/nsWindow.cpp:3614
16 	xul.dll 	nsWindow::DispatchWindowEvent 	widget/src/windows/nsWindow.cpp:3642
17 	xul.dll 	nsWindow::OnPaint 	
18 	ntdll.dll 	RtlUnicodeStringToAnsiString 	
19 	ntdll.dll 	RtlUnicodeStringToAnsiString
It's currently #1 top crasher in the latest nightly builds.
D2D? D2D+
DWrite? DWrite+
D3D9 Layers? D3D9 Layers+

Do we really support D2D with D3D9 Layers?
Absolutely not, and we should remove support for it.
It's #4 top crasher in 11.0a1 over the last 3 days.
Keywords: regression
Two comments talk about printing a bank statement.

The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=30161b298513&tochange=447556784745
I am adding the top crash keyword since it's in the top 10 on the trunk.
Keywords: topcrash
I see this crash when I try to open "tab groups" always.
Here is a comment:
"I have this problem whith firefox tor a long time. I figured out how you can avoid it. I have Notebook with intel i5 64bit processor and 64bit OS Win7. I have 2 Graphic cards one is integrated into Intel i5 processor another is Nvidia GEFORCE 310M. When I run it on Nvidia GEforce it crashes after opening tab groups /every time/ (also is blinking time to time). When I run it on intel i5 integrated Graphic card, works fine. I hope this help to someone." and its related crash report: bp-ef77fc5b-45ef-4594-bfb4-fc02d2120104.
He was using D3D9 layers on Windows 7.
(In reply to Benoit Jacob [:bjacob] from comment #2)
> D2D? D2D+
> DWrite? DWrite+
> D3D9 Layers? D3D9 Layers+
> 
> Do we really support D2D with D3D9 Layers?

(In reply to Joe Drew (:JOEDREW!) from comment #3)
> Absolutely not, and we should remove support for it.

Bas, Joe, OK to make D3D10 Layers a hard requirement for D2D now? Will you do it or should I?
It's #3 top crasher in 12.0a1 with about 20 crashes per build.
The culprit might be bug 703472.
Version: Trunk → 11 Branch
I am having similar problems 
with google instant
http://www.cybelesoft.com/thinvnc/
I allow scripts on this page and crash and burn
http://demos.hacks.mozilla.org/openweb/HWACCEL/
same thing when I allow scripts from noscript crash
started in build 11 all the way to 13
have nightly 64 bit windows version
I also used to get 60+ fps now 14
then restarted browser and any html 5 page I go to crashes
I fixed my own problem, I tried different builds try builds.

I then said you know what I have a lot of change prefs.
SO I cut my prefs.js and started it from scratch.
Not only do I have my speed back but
http://ie.microsoft.com/testdrive/mobile/performance/speedreading/default.html
is showing 0 seconds for browser score.

I am slowly adding each pref I have back one at a time until it crashes.
I will post if it fails again.
STR from MrX1980:
1. Set layers.prefer-d3d9 to true
2. Go to http://lab.aerotwist.com/canvas/fireworks/
URL: http://lab.aerotwist.com/canvas/firew...
Keywords: reproducible
There are 2 regression.
#1 Browser does not crash and does not draw anything.
#2 Browser crashes.


#1Regression window(m-c)
Works:
http://hg.mozilla.org/mozilla-central/rev/2be7246491d5
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111102 Firefox/10.0a1 ID:20111103054539
Browser does not crash and does not draw anything:
http://hg.mozilla.org/mozilla-central/rev/6cbeabc07c59
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111103 Firefox/10.0a1 ID:20111103075740
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=2be7246491d5&tochange=6cbeabc07c59

#1Regression window(m-i)
Works:
http://hg.mozilla.org/integration/mozilla-inbound/rev/50f566a3b449
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111102 Firefox/10.0a1 ID:20111102123242
Browser does not crash and does not draw anything:
http://hg.mozilla.org/integration/mozilla-inbound/rev/5de05fbcdc67
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111102 Firefox/10.0a1 ID:20111102142340
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=50f566a3b449&tochange=5de05fbcdc67



#2Regression window(m-c)
Browser does not crash and does not draw anything:
http://hg.mozilla.org/mozilla-central/rev/169516414349
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0a1) Gecko/20111117 Firefox/11.0a1 ID:20111117175637
Browser crashes:
http://hg.mozilla.org/mozilla-central/rev/447556784745
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0a1) Gecko/20111118 Firefox/11.0a1 ID:20111118004637
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=169516414349&tochange=447556784745

#2Regression window(m-i)
Browser does not crash and does not draw anything:
http://hg.mozilla.org/integration/mozilla-inbound/rev/244a16163240
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0a1) Gecko/20111117 Firefox/11.0a1 ID:20111117195637
Browser crashes:
http://hg.mozilla.org/integration/mozilla-inbound/rev/4af4c72eafa7
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0a1) Gecko/20111117 Firefox/11.0a1 ID:20111117200138
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=244a16163240&tochange=4af4c72eafa7
(In reply to Alice0775 White from comment #16)
> There are 2 regression.
> #1 Browser does not crash and does not draw anything.
File a new bug for that.
(In reply to Scoobidiver from comment #17)
> (In reply to Alice0775 White from comment #16)
> > There are 2 regression.
> > #1 Browser does not crash and does not draw anything.
> File a new bug for that.

Filed Bug 730885
It's #196 top browser crasher in 11.0b5, #91 in 12.0a2, #15 in 13.0a1.
For #2Regression window:

Last good: e63e256daecc	Marco Castelluccio — Bug 699258 - Move skia gradient shader implementations out of the class to fix a compile error on windows. r=mattwoodrow
First bad: 215593486382	Marco Castelluccio — Bug 699258 - Get skia backend compiling and running on Windows. r=mattwoodrow
Blocks: 699258
It happens mainly on 64-bit builds.
Hardware: x86 → All
For comment 22 crash report is here: https://crash-stats.mozilla.com/report/index/bp-1843b9c7-a7ab-4511-aa28-98df42120316. This is a reproducible crash with this link on nightly.
This signature has spiked on 12, 13, and 14 in the last 2 days, and this seems to have a reroducible testcase, can we get someone to actually work on it?
Looks like this is the issue, haven't tested it (my laptop refuses to use d3d9 layers).

Why do we have Azure enabled with d3d9 layers? I assume this crash is only possible if you have the prefer-d3d9 pref set, unless our blacklisting code is inconsistent.
Attachment #615572 - Flags: review?(bas.schouten)
Assignee: nobody → matt.woodrow
Comment on attachment 615572 [details] [diff] [review]
Use correct source surface

Review of attachment 615572 [details] [diff] [review]:
-----------------------------------------------------------------

Something could disable D3D10 after the canvas was created. I really remember patching this bug myself ages ago, oh well.
Attachment #615572 - Flags: review?(bas.schouten) → review+
Comment on attachment 615572 [details] [diff] [review]
Use correct source surface

[Approval Request Comment]
Regression caused by (bug #): 699258
User impact if declined: Causes crashes, affects all branches.
Testing completed (on m-c, etc.): None currently, I want to land it on m-c/m-i at least, and then move it to the other branches.
Risk to taking this patch (and alternatives if risky): Very low risk, just fixes a null pointer deref.
String changes made by this patch: None
Attachment #615572 - Flags: approval-mozilla-central?
Attachment #615572 - Flags: approval-mozilla-beta?
Attachment #615572 - Flags: approval-mozilla-aurora?
Attachment #615572 - Flags: approval-mozilla-central? → approval-mozilla-central+
https://hg.mozilla.org/mozilla-central/rev/e2b8678bc866
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla14
Comment on attachment 615572 [details] [diff] [review]
Use correct source surface

[Triage Comment]
We discussed this in the channel meeting. We believe that there is some channel bias that is causing this to be a higher top crash on the Nightly/Aurora/Beta channels than in release channel (see FF11, which does appear to be affected by bug 699258). Given that, we'll get this fix into a release for the first time in Firefox 13.
Attachment #615572 - Flags: approval-mozilla-beta?
Attachment #615572 - Flags: approval-mozilla-beta-
Attachment #615572 - Flags: approval-mozilla-aurora?
Attachment #615572 - Flags: approval-mozilla-aurora+
I guess it's too late to fix this for FF 12 now, but as a result of this not getting fixed, the appmanifest.org (used by app developers for developing app manifests) cannot be used in FF 12. It works in FF Aurora and Nightly though.
(In reply to Alex Keybl [:akeybl] from comment #30)
> Given that, we'll get this fix into a release for the first time in Firefox 13.
Despite your approval, it has never lander in Aurora 13:
http://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?fromchange=d44c15d3ecd0&tochange=5a24d517543c
status-firefox12: --- → affected
status-firefox13: --- → affected
You need to log in before you can comment on or make changes to this bug.