crash in mozilla::gl::SharedSurface_ANGLEShareHandle::Create

RESOLVED FIXED in Firefox 23

Status

()

defect
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: simona.marcu, Assigned: jgilbert)

Tracking

({crash, regression})

22 Branch
mozilla24
All
Windows 7
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox21 unaffected, firefox22+ wontfix, firefox23+ verified, firefox24+ verified)

Details

(crash signature, URL)

Attachments

(1 attachment)

This bug was filed from the Socorro interface and is 
report bp-4ea3490a-08b4-42fb-8f19-e74a42130528 .
============================================================= 
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20130528 Firefox/24.0

Steps to reproduce:
1. Go to http://sam3dsnakegame.tk/
2. Load the game several times.

Results: At some point, while the game is loading - Firefox crashes.

Note: 
Reproduced the crash on Firefox 22 beta 2, on Aurora 23.a2 and on the latest Nightly.
I could not reproduce the crash on Firefox 21.

Reproduced the issue on Windows 7 x64 bit with the following specs:
Adapter Description:	NVIDIA GeForce GT 610
Adapter Drivers	nvd3dumx,nvwgf2umx,nvwgf2umx nvd3dum,nvwgf2um,nvwgf2um
Adapter RAM	1023
Device ID	0x104a
Direct2D Enabled	true
DirectWrite Enabled	true (6.2.9200.16492)
Driver Date	5-12-2013
Driver Version	9.18.13.2018
GPU #2 Active	false
GPU Accelerated Windows	1/1 Direct3D 10
Vendor ID	0x10de
WebGL Renderer	Google Inc. -- ANGLE (NVIDIA GeForce GT 610 Direct3D9Ex vs_3_0 ps_3_0)
windowLayerManagerRemote	false
AzureCanvasBackend	direct2d
AzureContentBackend	direct2d
AzureFallbackCanvasBackend	cairo

I could not reproduce the issue on a PC running with ATI Radeon HD 5450 video card.
I'm working on the regression range and I'll post it as soon as I get it.
(In reply to Simona B [QA] from comment #0)
> Reproduced the crash on Firefox 22 beta 2, on Aurora 23.a2 and on the latest
> Nightly.
> I could not reproduce the crash on Firefox 21.
Confirmed by crash stats: https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Agl%3A%3ASharedSurface_ANGLEShareHandle%3A%3ACreate%28mozilla%3A%3Agl%3A%3AGLContext*%2C+ID3D10Device1*%2C+void*%2C+void*%2C+nsIntSize+const%26%2C+bool%29
First crash seen in 22.0a1/20130221.
Hardware: x86_64 → All
Version: Trunk → 22 Branch
(In reply to Scoobidiver from comment #1)
> First crash seen in 22.0a1/20130221.

The Nightly from 20130221 did not crash for me.
Unfortunately I could not determine the exact regression range and apparently I currently can't access the game from http://sam3dsnakegame.tk/ (hopefully I wasn't restricted in using the game).
This is the regression I got to after using the STR from the Description:

Last good build: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130321 Firefox/22.0, Build ID: 20130321030940

First bad build: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130322 Firefox/22.0, Build ID: 20130322031028

Pushlog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1d6fe70c79c5&tochange=0e9badd3cf39
Version: 22 Branch → Trunk
(In reply to Simona B [QA] from comment #3)
> Last good build: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130321
> Firefox/22.0, Build ID: 20130321030940
Are you sure of that?

Based on the stack trace, it's a regression from bug 716859 that landed in 22.0a1/20130222.
Blocks: 716859
Version: Trunk → 22 Branch
(Assignee)

Comment 5

6 years ago
This looks a lot like some flavor of OOM, so I could understand a seemingly unrelated change (GC change, especially) start to cause issues.
(Assignee)

Updated

6 years ago
Depends on: 878365
(Assignee)

Comment 6

6 years ago
Assignee: nobody → jgilbert
Attachment #756888 - Flags: review?(bas)
Attachment #756888 - Flags: review?(bas) → review+
Nominating for tracking since this is a regression in Firefox 22.
Can this get landed soon so we can see if the volume of crashes decreases?
Flags: needinfo?(jgilbert)
(Assignee)

Comment 9

6 years ago
It is blocked on its dependency.
Flags: needinfo?(jgilbert)
https://hg.mozilla.org/mozilla-central/rev/1b9cbc30e085
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla24
Uplift to Aurora and Beta as the tracking flags suggest?
(In reply to Scoobidiver from comment #12)
> Uplift to Aurora and Beta as the tracking flags suggest?

Has this verifiably fixed the underlying issue? What's the risk/reward here?
Flags: needinfo?(jgilbert)
(Assignee)

Comment 14

6 years ago
(In reply to Alex Keybl [:akeybl] (out till 6/10) from comment #13)
> (In reply to Scoobidiver from comment #12)
> > Uplift to Aurora and Beta as the tracking flags suggest?
> 
> Has this verifiably fixed the underlying issue? What's the risk/reward here?

It eliminates an unnecessary crash, but whether the rest of the browser handles the potential GPU OOM situation well is unknown.
Flags: needinfo?(jgilbert)
(Assignee)

Comment 15

6 years ago
Comment on attachment 756888 [details] [diff] [review]
patch: Allow SwapProd to fail for ANGLE ShSurfs

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 716859
User impact if declined: Crash on Vista/Win7 if allocating a new ideal-typed frame fails.
Testing completed (on m-c, etc.): On m-c.
Risk to taking this patch (and alternatives if risky): Very low. It basically just removes the crash call.
String or IDL/UUID changes made by this patch: None.
Attachment #756888 - Flags: approval-mozilla-beta?
Attachment #756888 - Flags: approval-mozilla-aurora?
Comment on attachment 756888 [details] [diff] [review]
patch: Allow SwapProd to fail for ANGLE ShSurfs

Based upon our uncertainty about whether or not this is a better user experience, we'll take this on Aurora but not Beta. It's unfortunate that we're taking a regression, but it's manageable given where we are in the cycle.
Attachment #756888 - Flags: approval-mozilla-beta?
Attachment #756888 - Flags: approval-mozilla-beta-
Attachment #756888 - Flags: approval-mozilla-aurora?
Attachment #756888 - Flags: approval-mozilla-aurora+
Verified fixed with Firefox 23 beta 1 (build ID: 20130625125232) on a Win 7 64bit machine.

Loading the game in a few tabs doesn't cause a crash anymore, and the game works smoothly also.
QA Contact: manuela.muntean
Verified fixed with Firefox 24 beta 1 (build ID: 20130806170643) on a Win 7 64bit machine.

Loading the game in a few tabs doesn't cause a crash, and the game works smoothly.
Keywords: verifyme
You need to log in before you can comment on or make changes to this bug.