Closed Bug 759749 Opened 8 years ago Closed 6 years ago

crash in mozilla::dom::CanvasRenderingContext2D::DrawImage @ mozilla::gfx::SourceSurfaceD2DTarget::GetBitmap

Categories

(Core :: Canvas: 2D, defect, critical)

15 Branch
All
Windows 7
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla29
Tracking Status
firefox28 + verified
firefox29 + fixed
firefox33 --- affected

People

(Reporter: scoobidiver, Assigned: jimm)

References

Details

(Keywords: crash, regression, topcrash-metro, Whiteboard: [metro-crash] [beta28] [01-24 Nightly] [01-29 Aurora])

Crash Data

Attachments

(1 file)

It's a low volume crash but there's a spike in crashes from 15.0a1/20120522 making it #72 top crasher over the last 3 days. The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=0e2cc686b07b&tochange=64187d60fae7
It's likely a regression from bug 595375.

Signature 	mozilla::gfx::SourceSurfaceD2DTarget::GetBitmap(ID2D1RenderTarget*) More Reports Search
UUID	93f13211-4a65-417a-8d11-a05eb2120529
Date Processed	2012-05-29 14:45:42
Uptime	2311
Last Crash	40.4 minutes before submission
Install Age	1.1 hours since version was first installed.
Install Time	2012-05-29 09:13:43
Product	Firefox
Version	15.0a1
Build ID	20120528093039
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 42 stepping 7
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x6738, AdapterSubsysID: 31001682, AdapterDriverVersion: 8.951.0.0
Has dual GPUs. GPU #2: AdapterVendorID2: 0x8086, AdapterDeviceID2: 0x0112, AdapterSubsysID2: 0000000c, AdapterDriverVersion2: 8.15.10.2696D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True
Total Virtual Memory	4294836224
Available Virtual Memory	2488291328
System Memory Use Percentage	58
Available Page File	20289925120
Available Physical Memory	7038631936

Frame 	Module 	Signature 	Source
0 	gkmedias.dll 	mozilla::gfx::SourceSurfaceD2DTarget::GetBitmap 	gfx/2d/SourceSurfaceD2DTarget.cpp:166
1 	gkmedias.dll 	mozilla::gfx::DrawTargetD2D::DrawSurface 	gfx/2d/DrawTargetD2D.cpp:268
2 	xul.dll 	gfxContext::PushGroupAndCopyBackground 	gfx/thebes/gfxContext.cpp:1541
3 	xul.dll 	mozilla::layers::BasicLayerManager::PushGroupForLayer 	gfx/layers/basic/BasicLayers.cpp:620
4 	xul.dll 	mozilla::layers::BasicThebesLayer::PaintThebes 	gfx/layers/basic/BasicLayers.cpp:677
5 	xul.dll 	mozilla::layers::BasicLayerManager::PaintLayer 	gfx/layers/basic/BasicLayers.cpp:2023
6 	xul.dll 	mozilla::layers::BasicLayerManager::PaintLayer 	gfx/layers/basic/BasicLayers.cpp:2038
7 	xul.dll 	mozilla::layers::BasicLayerManager::EndTransactionInternal 	gfx/layers/basic/BasicLayers.cpp:1688
8 	xul.dll 	mozilla::layers::BasicLayerManager::EndTransaction 	gfx/layers/basic/BasicLayers.cpp:1635
9 	xul.dll 	mozilla::PaintInactiveLayer 	layout/base/FrameLayerBuilder.cpp:1560
10 	xul.dll 	mozilla::FrameLayerBuilder::DrawThebesLayer 	layout/base/FrameLayerBuilder.cpp:2529
11 	xul.dll 	gfxContext::Clip 	gfx/thebes/gfxContext.cpp:1133
12 	xul.dll 	gfxContext::Clip 	gfx/thebes/gfxContext.cpp:1134
13 	xul.dll 	mozilla::layers::ThebesLayerD3D10::DrawRegion 	gfx/layers/d3d10/ThebesLayerD3D10.cpp:460

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Agfx%3A%3ASourceSurfaceD2DTarget%3A%3AGetBitmap%28ID2D1RenderTarget*%29
Whiteboard: [metro-crash]
It's a low volume crash.

Recent stack traces look like:
Frame 	Module 	Signature 	Source
0 	gkmedias.dll 	mozilla::gfx::SourceSurfaceD2DTarget::GetBitmap 	gfx/2d/SourceSurfaceD2DTarget.cpp:176
1 	gkmedias.dll 	mozilla::gfx::DrawTargetD2D::DrawSurface 	gfx/2d/DrawTargetD2D.cpp:292
2 	xul.dll 	mozilla::dom::CanvasRenderingContext2D::DrawImage 	content/canvas/src/CanvasRenderingContext2D.cpp:3040
3 	xul.dll 	mozilla::dom::CanvasRenderingContext2D::DrawImage 	content/canvas/src/CanvasRenderingContext2D.cpp:3040
4 	xul.dll 	mozilla::dom::CanvasRenderingContext2DBinding::drawImage 	obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp:2131
Summary: crash in mozilla::gfx::SourceSurfaceD2DTarget::GetBitmap → crash in mozilla::dom::CanvasRenderingContext2D::DrawImage @ mozilla::gfx::SourceSurfaceD2DTarget::GetBitmap
Hey Milan, any chance we might be able to get some gfx love on this? It's our current top crasher.

https://crash-stats.mozilla.com/topcrasher/products/MetroFirefox/versions/29.0a1
Flags: needinfo?(milan)
Bas, what do you think - no STR, but if mBitmap is null, either CreateBitmap failed or DrawTargetWillChange got called during this function in another thread?
Flags: needinfo?(milan) → needinfo?(bas)
(In reply to Milan Sreckovic [:milan] from comment #4)
> Bas, what do you think - no STR, but if mBitmap is null, either CreateBitmap
> failed or DrawTargetWillChange got called during this function in another
> thread?

The latter is impossible (because we don't, afaik touch this code off the main thread). So this must have been a failure in CreateBitmap. I haven't yet figure out a possible cause, but it's interesting that this is high volume for metro. So we should look for the cause to be something in metro.

Jim: Could you run some common Canvas benchmarks in metro and see if they happen to trigger this? If I had STR it would help a lot.
Flags: needinfo?(bas) → needinfo?(jmathies)
If we have them, a url list would help here.
Flags: needinfo?(jmathies)
Keywords: needURLs
We have a canvas in our urlbar for downloads, I wonder if this crash is associated with that?

http://mxr.mozilla.org/mozilla-central/source/browser/metro/base/content/bindings/circularprogress.xml
Whiteboard: [metro-crash] → [metro-crash] [beta28]
Looks like we'll want to add a topcrash-metro keyword, will file bug shortly.
(In reply to Lukas Blakk [:lsblakk] from comment #9)
> Looks like we'll want to add a topcrash-metro keyword, will file bug shortly.

nm, we have one - using it.
Keywords: topcrash-metro
Attachment #8363095 - Flags: review?(bas)
I haven't come up with any steps to reproduce. I think we'd prefer some odd drawing anomaly vs. a browser crash, at least for release. We could land this on aurora only for example if we want.
Attachment #8363095 - Flags: review?(bas) → review+
https://hg.mozilla.org/mozilla-central/rev/d86f25820d53
Assignee: nobody → jmathies
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla29
No longer blocks: metrov1backlog
Whiteboard: [metro-crash] [beta28] → [metro-crash] [beta28] [01-24 Nightly]
Comment on attachment 8363095 [details] [diff] [review]
bail if CreateBitmap fails

[Approval Request Comment]
Bug caused by (feature/regressing bug #): unknown
User impact if declined: crashy app
Testing completed (on m-c, etc.): yes
Risk to taking this patch (and alternatives if risky): low
String or IDL/UUID changes made by this patch: none
Attachment #8363095 - Flags: approval-mozilla-aurora?
Attachment #8363095 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Whiteboard: [metro-crash] [beta28] [01-24 Nightly] → [metro-crash] [beta28] [01-24 Nightly] [01-28 Aurora]
Whiteboard: [metro-crash] [beta28] [01-24 Nightly] [01-28 Aurora] → [metro-crash] [beta28] [01-24 Nightly] [01-29 Aurora]
Keywords: verifyme
There are 10 crashes now on Fx28 beta and 2 on Fx29 aurora:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Agfx%3A%3ASourceSurfaceD2DTarget%3A%3AGetBitmap%28ID2D1RenderTarget%2A%29&product=Firefox&query_type=contains&range_unit=weeks&process_type=any&version=Firefox%3A30.0a1&version=Firefox%3A29.0a2&version=Firefox%3A28.0b&hang_type=any&date=2014-02-19+12%3A00%3A00&range_value=4#tab-reports

Is it possible the new crashes are this same bug? Because if they are, we should probably file a followup bug here if the number of crashes keeps increasing.
Flags: needinfo?(jmathies)
(In reply to Ioana Budnar, QA [:ioana] from comment #17)
> There are 10 crashes now on Fx28 beta and 2 on Fx29 aurora:
> https://crash-stats.mozilla.com/report/
> list?signature=mozilla%3A%3Agfx%3A%3ASourceSurfaceD2DTarget%3A%3AGetBitmap%28
> ID2D1RenderTarget%2A%29&product=Firefox&query_type=contains&range_unit=weeks&
> process_type=any&version=Firefox%3A30.0a1&version=Firefox%3A29.
> 0a2&version=Firefox%3A28.0b&hang_type=any&date=2014-02-
> 19+12%3A00%3A00&range_value=4#tab-reports
> 
> Is it possible the new crashes are this same bug? Because if they are, we
> should probably file a followup bug here if the number of crashes keeps
> increasing.

If this is a new and increasing crash in firefox desktop then yes it should be filed.
Flags: needinfo?(jmathies)
(In reply to Jim Mathies [:jimm] (away 4/1-4/21) from comment #18)
> If this is a new and increasing crash in firefox desktop then yes it should
> be filed.

The number of crashes is still quite low: 38 crashes in the last 4 weeks (Fx28+29+30+31). Two of the crashes are on Firefox 29 beta 1.

I don't know if this is a new crash since we don't have reliable steps to reproduce and the crash signature as the one in this bug. This is precisely why I asked whether it is new or the same bug.
Keywords: verifyme
bp-2faa41cb-372a-4034-bb55-3b62b2141013 just happened to me for the fist time. FF 33 RC
5e2bebbb-695b-49e4-96f4-bb2da2141105 just happened to me for the first time. SM 2.26.1
Again and again ... nobody can re-open this bug ?
https://crash-stats.mozilla.com/report/index/87990aea-be47-49a3-9f39-6a4a32141224
In general we prefer to file new bugs when issues like this come back after a long time of the patch being landed, because it gets confusing if we reopen the bug and continue working on it. Feel free to file a new bug using your crash report above using the "Report this bug in" link on the crash-report page and provide any details that you can.
(In reply to Kartikaya Gupta (email:kats@mozilla.com) from comment #24)
> In general we prefer to file new bugs when issues like this come back after
> a long time of the patch being landed, because it gets confusing if we
> reopen the bug and continue working on it. Feel free to file a new bug using
> your crash report above using the "Report this bug in" link on the
> crash-report page and provide any details that you can.

https://bugzilla.mozilla.org/show_bug.cgi?id=1099955
was entered before
This is the new report: https://bugzilla.mozilla.org/show_bug.cgi?id=1115926

Both are untouched ...
You need to log in before you can comment on or make changes to this bug.