Last Comment Bug 704124 - Firefox Crash @ gfxContext::SetSource
: Firefox Crash @ gfxContext::SetSource
Status: RESOLVED FIXED
: crash, regression, reproducible, topcrash
Product: Core
Classification: Components
Component: Graphics (show other bugs)
: 11 Branch
: All Windows 7
: -- critical with 2 votes (vote)
: mozilla14
Assigned To: Matt Woodrow (:mattwoodrow)
:
Mentors:
http://lab.aerotwist.com/canvas/firew...
: 723058 (view as bug list)
Depends on:
Blocks: 699258
  Show dependency treegraph
 
Reported: 2011-11-21 06:55 PST by Marcia Knous [:marcia - use ni]
Modified: 2012-05-04 00:28 PDT (History)
18 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
affected
affected


Attachments
Use correct source surface (1.05 KB, patch)
2012-04-16 17:53 PDT, Matt Woodrow (:mattwoodrow)
bas: review+
akeybl: approval‑mozilla‑aurora+
akeybl: approval‑mozilla‑beta-
blassey.bugs: approval‑mozilla‑central+
Details | Diff | Review

Description Marcia Knous [:marcia - use ni] 2011-11-21 06:55:20 PST
Seen while looking at trunk crash stats. Crashes started showing up on trunk using the 2011111800 build. 35 crashes using the 2011112000 build. Crashes show up in small volume in other versions of Firefox as well.

http://tinyurl.com/6lq6u52 is the crashes in this signature across all versions in the last week.

https://crash-stats.mozilla.com/report/index/212de145-c74d-49fd-9f2d-f9b192111121

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	gfxContext::SetSource 	gfx/thebes/gfxContext.cpp:760
1 	xul.dll 	mozilla::layers::CanvasLayerD3D9::UpdateSurface 	gfx/layers/d3d9/CanvasLayerD3D9.cpp:195
2 	xul.dll 	mozilla::layers::CanvasLayerD3D9::RenderLayer 	gfx/layers/d3d9/CanvasLayerD3D9.cpp:226
3 	xul.dll 	mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerD3D9> 	gfx/layers/d3d9/ContainerLayerD3D9.cpp:285
4 	xul.dll 	mozilla::layers::ContainerLayerD3D9::RenderLayer 	gfx/layers/d3d9/ContainerLayerD3D9.cpp:357
5 	xul.dll 	mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerD3D9> 	gfx/layers/d3d9/ContainerLayerD3D9.cpp:285
6 	xul.dll 	mozilla::layers::ContainerLayerD3D9::RenderLayer 	gfx/layers/d3d9/ContainerLayerD3D9.cpp:357
7 	xul.dll 	mozilla::layers::LayerManagerD3D9::Render 	gfx/layers/d3d9/LayerManagerD3D9.cpp:347
8 	xul.dll 	mozilla::layers::LayerManagerD3D9::EndTransaction 	gfx/layers/d3d9/LayerManagerD3D9.cpp:184
9 	xul.dll 	nsDisplayList::PaintForFrame 	layout/base/nsDisplayList.cpp:635
10 	xul.dll 	nsLayoutUtils::PaintFrame 	layout/base/nsLayoutUtils.cpp:1700
11 	xul.dll 	PresShell::Paint 	layout/base/nsPresShell.cpp:5472
12 	xul.dll 	nsViewManager::Refresh 	view/src/nsViewManager.cpp:390
13 	xul.dll 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:887
14 	xul.dll 	AttachedHandleEvent 	view/src/nsView.cpp:191
15 	xul.dll 	nsWindow::DispatchEvent 	widget/src/windows/nsWindow.cpp:3614
16 	xul.dll 	nsWindow::DispatchWindowEvent 	widget/src/windows/nsWindow.cpp:3642
17 	xul.dll 	nsWindow::OnPaint 	
18 	ntdll.dll 	RtlUnicodeStringToAnsiString 	
19 	ntdll.dll 	RtlUnicodeStringToAnsiString
Comment 1 Scoobidiver (away) 2011-11-21 07:27:51 PST
It's currently #1 top crasher in the latest nightly builds.
Comment 2 Benoit Jacob [:bjacob] (mostly away) 2011-11-21 07:40:26 PST
D2D? D2D+
DWrite? DWrite+
D3D9 Layers? D3D9 Layers+

Do we really support D2D with D3D9 Layers?
Comment 3 Joe Drew (not getting mail) 2011-11-21 10:46:13 PST
Absolutely not, and we should remove support for it.
Comment 4 Scoobidiver (away) 2011-11-23 00:29:24 PST
It's #4 top crasher in 11.0a1 over the last 3 days.
Comment 5 Scoobidiver (away) 2011-12-01 03:32:34 PST
Two comments talk about printing a bank statement.

The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=30161b298513&tochange=447556784745
Comment 6 Sheila Mooney 2011-12-21 22:08:00 PST
I am adding the top crash keyword since it's in the top 10 on the trunk.
Comment 7 Martin 2011-12-31 03:00:18 PST
I see this crash when I try to open "tab groups" always.
Comment 8 Scoobidiver (away) 2012-01-07 14:53:48 PST
Here is a comment:
"I have this problem whith firefox tor a long time. I figured out how you can avoid it. I have Notebook with intel i5 64bit processor and 64bit OS Win7. I have 2 Graphic cards one is integrated into Intel i5 processor another is Nvidia GEFORCE 310M. When I run it on Nvidia GEforce it crashes after opening tab groups /every time/ (also is blinking time to time). When I run it on intel i5 integrated Graphic card, works fine. I hope this help to someone." and its related crash report: bp-ef77fc5b-45ef-4594-bfb4-fc02d2120104.
He was using D3D9 layers on Windows 7.
Comment 9 Benoit Jacob [:bjacob] (mostly away) 2012-01-07 15:06:06 PST
(In reply to Benoit Jacob [:bjacob] from comment #2)
> D2D? D2D+
> DWrite? DWrite+
> D3D9 Layers? D3D9 Layers+
> 
> Do we really support D2D with D3D9 Layers?

(In reply to Joe Drew (:JOEDREW!) from comment #3)
> Absolutely not, and we should remove support for it.

Bas, Joe, OK to make D3D10 Layers a hard requirement for D2D now? Will you do it or should I?
Comment 10 Scoobidiver (away) 2012-01-15 01:17:52 PST
It's #3 top crasher in 12.0a1 with about 20 crashes per build.
The culprit might be bug 703472.
Comment 11 Paul Rouget [:paul] 2012-02-01 04:11:19 PST
*** Bug 723058 has been marked as a duplicate of this bug. ***
Comment 12 will 2012-02-04 13:16:29 PST
I am having similar problems 
with google instant
http://www.cybelesoft.com/thinvnc/
I allow scripts on this page and crash and burn
http://demos.hacks.mozilla.org/openweb/HWACCEL/
same thing when I allow scripts from noscript crash
started in build 11 all the way to 13
have nightly 64 bit windows version
I also used to get 60+ fps now 14
then restarted browser and any html 5 page I go to crashes
Comment 13 will 2012-02-04 15:23:12 PST
I fixed my own problem, I tried different builds try builds.

I then said you know what I have a lot of change prefs.
SO I cut my prefs.js and started it from scratch.
Not only do I have my speed back but
http://ie.microsoft.com/testdrive/mobile/performance/speedreading/default.html
is showing 0 seconds for browser score.

I am slowly adding each pref I have back one at a time until it crashes.
I will post if it fails again.
Comment 15 Scoobidiver (away) 2012-02-27 01:17:18 PST
STR from MrX1980:
1. Set layers.prefer-d3d9 to true
2. Go to http://lab.aerotwist.com/canvas/fireworks/
Comment 16 Alice0775 White 2012-02-27 08:12:38 PST
There are 2 regression.
#1 Browser does not crash and does not draw anything.
#2 Browser crashes.


#1Regression window(m-c)
Works:
http://hg.mozilla.org/mozilla-central/rev/2be7246491d5
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111102 Firefox/10.0a1 ID:20111103054539
Browser does not crash and does not draw anything:
http://hg.mozilla.org/mozilla-central/rev/6cbeabc07c59
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111103 Firefox/10.0a1 ID:20111103075740
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=2be7246491d5&tochange=6cbeabc07c59

#1Regression window(m-i)
Works:
http://hg.mozilla.org/integration/mozilla-inbound/rev/50f566a3b449
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111102 Firefox/10.0a1 ID:20111102123242
Browser does not crash and does not draw anything:
http://hg.mozilla.org/integration/mozilla-inbound/rev/5de05fbcdc67
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111102 Firefox/10.0a1 ID:20111102142340
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=50f566a3b449&tochange=5de05fbcdc67



#2Regression window(m-c)
Browser does not crash and does not draw anything:
http://hg.mozilla.org/mozilla-central/rev/169516414349
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0a1) Gecko/20111117 Firefox/11.0a1 ID:20111117175637
Browser crashes:
http://hg.mozilla.org/mozilla-central/rev/447556784745
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0a1) Gecko/20111118 Firefox/11.0a1 ID:20111118004637
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=169516414349&tochange=447556784745

#2Regression window(m-i)
Browser does not crash and does not draw anything:
http://hg.mozilla.org/integration/mozilla-inbound/rev/244a16163240
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0a1) Gecko/20111117 Firefox/11.0a1 ID:20111117195637
Browser crashes:
http://hg.mozilla.org/integration/mozilla-inbound/rev/4af4c72eafa7
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0a1) Gecko/20111117 Firefox/11.0a1 ID:20111117200138
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=244a16163240&tochange=4af4c72eafa7
Comment 17 Scoobidiver (away) 2012-02-27 10:27:11 PST
(In reply to Alice0775 White from comment #16)
> There are 2 regression.
> #1 Browser does not crash and does not draw anything.
File a new bug for that.
Comment 18 Alice0775 White 2012-02-27 10:41:28 PST
(In reply to Scoobidiver from comment #17)
> (In reply to Alice0775 White from comment #16)
> > There are 2 regression.
> > #1 Browser does not crash and does not draw anything.
> File a new bug for that.

Filed Bug 730885
Comment 19 Scoobidiver (away) 2012-03-08 06:41:56 PST
It's #196 top browser crasher in 11.0b5, #91 in 12.0a2, #15 in 13.0a1.
Comment 20 Alice0775 White 2012-03-08 06:53:52 PST
For #2Regression window:

Last good: e63e256daecc	Marco Castelluccio — Bug 699258 - Move skia gradient shader implementations out of the class to fix a compile error on windows. r=mattwoodrow
First bad: 215593486382	Marco Castelluccio — Bug 699258 - Get skia backend compiling and running on Windows. r=mattwoodrow
Comment 21 Scoobidiver (away) 2012-03-12 00:50:28 PDT
It happens mainly on 64-bit builds.
Comment 22 Jason Smith [:jsmith] 2012-03-16 14:26:49 PDT
Note - Crash also occurs with http://www.eventbrite.com/event/2984806637/efbnen.
Comment 23 Jason Smith [:jsmith] 2012-03-16 14:27:57 PDT
For comment 22 crash report is here: https://crash-stats.mozilla.com/report/index/bp-1843b9c7-a7ab-4511-aa28-98df42120316. This is a reproducible crash with this link on nightly.
Comment 24 Robert Kaiser (not working on stability any more) 2012-04-09 09:27:54 PDT
This signature has spiked on 12, 13, and 14 in the last 2 days, and this seems to have a reroducible testcase, can we get someone to actually work on it?
Comment 25 Matt Woodrow (:mattwoodrow) 2012-04-16 17:53:23 PDT
Created attachment 615572 [details] [diff] [review]
Use correct source surface

Looks like this is the issue, haven't tested it (my laptop refuses to use d3d9 layers).

Why do we have Azure enabled with d3d9 layers? I assume this crash is only possible if you have the prefer-d3d9 pref set, unless our blacklisting code is inconsistent.
Comment 26 Bas Schouten (:bas.schouten) 2012-04-17 12:01:19 PDT
Comment on attachment 615572 [details] [diff] [review]
Use correct source surface

Review of attachment 615572 [details] [diff] [review]:
-----------------------------------------------------------------

Something could disable D3D10 after the canvas was created. I really remember patching this bug myself ages ago, oh well.
Comment 27 Matt Woodrow (:mattwoodrow) 2012-04-17 18:38:39 PDT
Comment on attachment 615572 [details] [diff] [review]
Use correct source surface

[Approval Request Comment]
Regression caused by (bug #): 699258
User impact if declined: Causes crashes, affects all branches.
Testing completed (on m-c, etc.): None currently, I want to land it on m-c/m-i at least, and then move it to the other branches.
Risk to taking this patch (and alternatives if risky): Very low risk, just fixes a null pointer deref.
String changes made by this patch: None
Comment 28 Matt Woodrow (:mattwoodrow) 2012-04-18 17:35:40 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/e2b8678bc866
Comment 29 :Ehsan Akhgari (busy, don't ask for review please) 2012-04-19 07:27:48 PDT
https://hg.mozilla.org/mozilla-central/rev/e2b8678bc866
Comment 30 Alex Keybl [:akeybl] 2012-04-19 14:36:28 PDT
Comment on attachment 615572 [details] [diff] [review]
Use correct source surface

[Triage Comment]
We discussed this in the channel meeting. We believe that there is some channel bias that is causing this to be a higher top crash on the Nightly/Aurora/Beta channels than in release channel (see FF11, which does appear to be affected by bug 699258). Given that, we'll get this fix into a release for the first time in Firefox 13.
Comment 31 Jason Smith [:jsmith] 2012-05-03 19:33:17 PDT
I guess it's too late to fix this for FF 12 now, but as a result of this not getting fixed, the appmanifest.org (used by app developers for developing app manifests) cannot be used in FF 12. It works in FF Aurora and Nightly though.
Comment 32 Scoobidiver (away) 2012-05-04 00:28:50 PDT
(In reply to Alex Keybl [:akeybl] from comment #30)
> Given that, we'll get this fix into a release for the first time in Firefox 13.
Despite your approval, it has never lander in Aurora 13:
http://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?fromchange=d44c15d3ecd0&tochange=5a24d517543c

Note You need to log in before you can comment on or make changes to this bug.