909000 - Crashes with gfx.content.azure.enabled set to false

Status: VERIFIED FIXED

(Core :: Graphics, defect)

Description

[Jim Jeffery not reading bug-mail 1/2/11]

Starting with build from cset:
https://hg.mozilla.org/mozilla-central/rev/fa56d4c9e630 

The browser will crash when opening tabs, clicking links and sometimes during startup if you have the following pref set to 'false'
gfx.content.azure.enabled set to false

Setting the pref back to the default of 'true' there are no crashes.

Regression range:
good: http://hg.mozilla.org/mozilla-central/rev/fb2318875cd4
bad:  https://hg.mozilla.org/mozilla-central/rev/fa56d4c9e630

I noted that these two patches landed in that range that affect 'Azure' from what I can tell.
https://bugzilla.mozilla.org/show_bug.cgi?id=907926 <-Enable Azure content for windows BasicLayers
https://bugzilla.mozilla.org/show_bug.cgi?id=907011 <- Enable Azure content for D3D9

This presents a problem for those that affected by bug
https://bugzilla.mozilla.org/show_bug.cgi?id=812695 
The 'work-around' for that bug for users that have AMD hardware/graphics is to set the pref to 'false'.  Now that is not possible leaving those users with bad rendering.

Need help finding which patch in range regressed the turning off of the pref.
Link to crash-report:
https://crash-stats.mozilla.com/report/index/531007fd-a01c-4906-806c-6cc042130824

Tested with Nightly build from cset:
http://hg.mozilla.org/mozilla-central/rev/17143a9a0d83
win7 x64 

Graphics info:
Graphics
--------

Adapter Description: ATI Radeon HD 3200 Graphics
Adapter Drivers: aticfx64 aticfx64 aticfx32 aticfx32 atiumd64 atidxx64 atiumdag atidxx32 atiumdva atiumd6a atitmm64
Adapter RAM: 256
ClearType Parameters: DISPLAY1 [ Gamma: 2200 Pixel Structure: RGB ClearType Level: 100 Enhanced Contrast: 300 ] DISPLAY4 [ Gamma: 2200 Pixel Structure: RGB ClearType Level: 100 Enhanced Contrast: 50 ]
Device ID: 0x9610
Direct2D Enabled: true
DirectWrite Enabled: true (6.2.9200.16571)
Driver Date: 7-28-2011
Driver Version: 8.881.0.0
GPU #2 Active: false
GPU Accelerated Windows: 1/1 Direct3D 10
Vendor ID: 0x1002
WebGL Renderer: Google Inc. -- ANGLE (ATI Radeon HD 3200 Graphics Direct3D9Ex vs_3_0 ps_3_0)
windowLayerManagerRemote: false
AzureCanvasBackend: direct2d
AzureContentBackend: direct2d
AzureFallbackCanvasBackend: cairo
AzureSkiaAccelerated: 0

Comment 1

[Alice0775 White]

The crash happens on Aero/AeroBasic, but not on Classic.

Steps To Reproduce:
1. gfx.content.azure.enabled set to false with HWA on
2. Restart
3. Mouse move over any toolbutton in order to popup tooltip
   Ex. mouse over StarUI
       mouse over bookmarks item

Actual Results:
Crash


There are 2 regressions:
#1 No tooltips pop up
#2 Crash

#1 Regresson window(m-i)
Good
http://hg.mozilla.org/integration/mozilla-inbound/rev/3ab03b70a92c
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 ID:20130822221923
No tooltip
http://hg.mozilla.org/integration/mozilla-inbound/rev/ed0b6a11532d
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 ID:20130822233723
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=3ab03b70a92c&tochange=ed0b6a11532d

#2 Regresson window(m-i)
No tooltip
http://hg.mozilla.org/integration/mozilla-inbound/rev/1ad8a6674785
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 ID:20130823004123
Crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/d46d0f4f4a8a
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 ID:20130823011323
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=1ad8a6674785&tochange=d46d0f4f4a8a

Regressed by: Bug 907926

Comment 4

[IU]

Crashing Thread
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::layers::RotatedBuffer::DrawBufferQuadrant(mozilla::gfx::DrawTarget *,mozilla::layers::RotatedBuffer::XSide,mozilla::layers::RotatedBuffer::YSide,mozilla::layers::RotatedBuffer::ContextSource,float,mozilla::gfx::SourceSurface *,mozilla::gfx::Matrix const *) 	gfx/layers/ThebesLayerBuffer.cpp
1 	xul.dll 	mozilla::layers::RotatedBuffer::DrawBufferWithRotation(mozilla::gfx::DrawTarget *,mozilla::layers::RotatedBuffer::ContextSource,float,mozilla::gfx::SourceSurface *,mozilla::gfx::Matrix const *) 	gfx/layers/ThebesLayerBuffer.cpp
2 	xul.dll 	mozilla::layers::ThebesLayerBuffer::DrawTo(mozilla::layers::ThebesLayer *,gfxContext *,float,gfxASurface *,gfxMatrix const *) 	gfx/layers/ThebesLayerBuffer.cpp
3 	xul.dll 	mozilla::layers::BasicThebesLayer::PaintThebes(gfxContext *,mozilla::layers::Layer *,void (*)(mozilla::layers::ThebesLayer *,gfxContext *,nsIntRegion const &,nsIntRegion const &,void *),void *,mozilla::layers::ReadbackProcessor *) 	gfx/layers/basic/BasicThebesLayer.cpp
4 	xul.dll 	mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext &,gfxContext *) 	gfx/layers/basic/BasicLayerManager.cpp
5 	xul.dll 	mozilla::layers::BasicLayerManager::PaintLayer(gfxContext *,mozilla::layers::Layer *,void (*)(mozilla::layers::ThebesLayer *,gfxContext *,nsIntRegion const &,nsIntRegion const &,void *),void *,mozilla::layers::ReadbackProcessor *) 	gfx/layers/basic/BasicLayerManager.cpp
6 	xul.dll 	mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext &,gfxContext *) 	gfx/layers/basic/BasicLayerManager.cpp
7 	xul.dll 	mozilla::layers::BasicLayerManager::PaintLayer(gfxContext *,mozilla::layers::Layer *,void (*)(mozilla::layers::ThebesLayer *,gfxContext *,nsIntRegion const &,nsIntRegion const &,void *),void *,mozilla::layers::ReadbackProcessor *) 	gfx/layers/basic/BasicLayerManager.cpp
8 	xul.dll 	mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::ThebesLayer *,gfxContext *,nsIntRegion const &,nsIntRegion const &,void *),void *,mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/basic/BasicLayerManager.cpp
9 	xul.dll 	mozilla::layers::BasicLayerManager::EndEmptyTransaction(mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/basic/BasicLayerManager.cpp
10 	xul.dll 	PresShell::Paint(nsView *,nsRegion const &,unsigned int) 	layout/base/nsPresShell.cpp
11 	xul.dll 	nsViewManager::Refresh(nsView *,nsIntRegion const &) 	view/src/nsViewManager.cpp
12 	xul.dll 	nsViewManager::PaintWindow(nsIWidget *,nsIntRegion) 	view/src/nsViewManager.cpp
13 	xul.dll 	nsView::PaintWindow(nsIWidget *,nsIntRegion) 	view/src/nsView.cpp
14 	xul.dll 	nsWindow::OnPaint(HDC__ *,unsigned int) 	widget/windows/nsWindowGfx.cpp
15 	xul.dll 	nsWindow::ProcessMessage(unsigned int,unsigned int &,long &,long *) 	widget/windows/nsWindow.cpp
16 	xul.dll 	nsCOMPtr_base::assign_from_qi(nsQueryInterface,nsID const &) 	obj-firefox/xpcom/build/nsCOMPtr.cpp
17 	xul.dll 	nsWindow::WindowProcInternal(HWND__ *,unsigned int,unsigned int,long) 	widget/windows/nsWindow.cpp
18 	xul.dll 	CallWindowProcCrashProtected 	xpcom/base/nsCrashOnException.cpp
19 	xul.dll 	xul.dll@0xf8d70 	
20 	user32.dll 	InternalCallWinProc 	
21 	user32.dll 	GetRealWindowOwner 	
22 	user32.dll 	DispatchClientMessage 	
23 	user32.dll 	__fnDWORD 	
24 	ntdll.dll 	KiUserCallbackDispatcher 	
25 	ntdll.dll 	KiUserApcDispatcher 	
26 	xul.dll 	nsWindow::Show(bool) 	widget/windows/nsWindow.cpp
27 	xul.dll 	nsXULWindow::SetVisibility(bool) 	xpfe/appshell/src/nsXULWindow.cpp
28 	xul.dll 	nsXULWindow::OnChromeLoaded() 	xpfe/appshell/src/nsXULWindow.cpp
29 	xul.dll 	nsWebShellWindow::OnStateChange(nsIWebProgress *,nsIRequest *,unsigned int,tag_nsresult) 	xpfe/appshell/src/nsWebShellWindow.cpp
30 	xul.dll 	nsDocLoader::DoFireOnStateChange(nsIWebProgress * const,nsIRequest * const,int &,tag_nsresult) 	uriloader/base/nsDocLoader.cpp
31 	xul.dll 	nsDocLoader::doStopDocumentLoad(nsIRequest *,tag_nsresult) 	uriloader/base/nsDocLoader.cpp
32 	xul.dll 	nsDocLoader::DocLoaderIsEmpty(bool) 	uriloader/base/nsDocLoader.cpp
33 	xul.dll 	nsDocLoader::OnStopRequest(nsIRequest *,nsISupports *,tag_nsresult) 	uriloader/base/nsDocLoader.cpp
34 	xul.dll 	nsLoadGroup::RemoveRequest(nsIRequest *,nsISupports *,tag_nsresult) 	netwerk/base/src/nsLoadGroup.cpp
35 	xul.dll 	nsDocument::DoUnblockOnload() 	content/base/src/nsDocument.cpp
36 	xul.dll 	nsUnblockOnloadEvent::Run() 	content/base/src/nsDocument.cpp
37 	xul.dll 	nsThread::ProcessNextEvent(bool,bool *) 	xpcom/threads/nsThread.cpp
38 	xul.dll 	NS_ProcessNextEvent(nsIThread *,bool) 	obj-firefox/xpcom/build/nsThreadUtils.cpp
39 	xul.dll 	nsXULWindow::ShowModal() 	xpfe/appshell/src/nsXULWindow.cpp
40 	xul.dll 	nsContentTreeOwner::ShowAsModal() 	xpfe/appshell/src/nsContentTreeOwner.cpp
41 	xul.dll 	nsWindowWatcher::OpenWindowInternal(nsIDOMWindow *,char const *,char const *,char const *,bool,bool,bool,nsIArray *,nsIDOMWindow * *) 	embedding/components/windowwatcher/src/nsWindowWatcher.cpp
42 	xul.dll 	nsWindowWatcher::OpenWindow(nsIDOMWindow *,char const *,char const *,char const *,nsISupports *,nsIDOMWindow * *) 	embedding/components/windowwatcher/src/nsWindowWatcher.cpp
43 	xul.dll 	NS_InvokeByIndex 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp
44 	xul.dll 	XPC_WN_CallMethod(JSContext *,unsigned int,JS::Value *) 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp
45 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
46 	mozjs.dll 	Interpret 	js/src/vm/Interpreter.cpp
47 	mozjs.dll 	js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value *,JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
48 	mozjs.dll 	js::CrossCompartmentWrapper::call(JSContext *,JS::Handle<JSObject *>,JS::CallArgs const &) 	js/src/jswrapper.cpp
49 	mozjs.dll 	proxy_Call 	js/src/jsproxy.cpp
50 	mozjs.dll 	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
51 	mozjs.dll 	Interpret 	js/src/vm/Interpreter.cpp
52 	mozjs.dll 	js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value *,JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
53 	mozjs.dll 	JS_CallFunctionValue(JSContext *,JSObject *,JS::Value,unsigned int,JS::Value *,JS::Value *) 	js/src/jsapi.cpp
54 	xul.dll 	nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS *,unsigned short,XPTMethodDescriptor const *,nsXPTCMiniVariant *) 	js/xpconnect/src/XPCWrappedJSClass.cpp
55 	mfreadwrite.dll 	CMFTWrapperAsync::ProcessEvent(unsigned long,IMFMediaEvent *) 	
56 	xul.dll 	nsXPCWrappedJS::CallMethod(unsigned short,XPTMethodDescriptor const *,nsXPTCMiniVariant *) 	js/xpconnect/src/XPCWrappedJS.cpp
57 	mozglue.dll 	arena_dalloc_small 	memory/mozjemalloc/jemalloc.c
58 	mozglue.dll 	je_free 	memory/mozjemalloc/jemalloc.c
59 	xul.dll 	nsTArray_base<nsTArrayInfallibleAllocator,nsTArray_CopyElements<ObserverRef> >::ShiftData(unsigned int,unsigned int,unsigned int,unsigned int,unsigned int) 	obj-firefox/dist/include/nsTArray-inl.h
60 	xul.dll 	nsObserverList::FillObserverArray(nsCOMArray<nsIObserver> &) 	xpcom/ds/nsObserverList.cpp
61 	xul.dll 	NS_InvokeByIndex

Comment 5

[Matt Woodrow (:mattwoodrow)]

Attachment: Correctly check if azure is enabled

Looks like SupportsAzureContentForType ignores the prefs and just uses the compiled bitmask.

Comment 6

[Nick Cameron [:nrc]]

Comment on attachment 795196 [details] [diff] [review]
Correctly check if azure is enabled

Review of attachment 795196 [details] [diff] [review]:
-----------------------------------------------------------------

We should change SupportsAzureContentForType so that it does the right thing rather than modifying the callers. The right thing is probably keeping a record of backends in the pref string and checking against that as well as the mask.

Comment 7

[Matt Woodrow (:mattwoodrow)]

Attachment: Correctly check if azure is enabled v2

Hope this doesn't break the existing caller of SupportsAzureContentForType!

Comment 8

[Nick Cameron [:nrc]]

Comment on attachment 795203 [details] [diff] [review]
Correctly check if azure is enabled v2

Review of attachment 795203 [details] [diff] [review]:
-----------------------------------------------------------------

I think if it does break the callers, then it should break the callers and we need to fix them. r=me with the formatting nits fixed.

::: gfx/thebes/gfxPlatform.h
@@ +636,5 @@
>      /**
>       * returns the first backend named in the pref gfx.content.azure.backend
>       * which is a component of aBackendBitmask, a bitmask of backend types
>       */
> +    static mozilla::gfx::BackendType GetContentBackendPref(uint32_t &aBackendBitmask);

nit uint32_t& here and elsewhere

Comment 9

[Matt Woodrow (:mattwoodrow)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ad2d342973da

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ad2d342973da

Comment 11

[Mike Beltzner [:beltzner, not reading bugmail]]

Confirmed that the http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-win32/1377523042/firefox-26.0a1.en-US.win32.zip build no longer crashes - thanks!

Comment 12

[Ryan VanderMeulen [:RyanVM]]

New nightlies triggered to pick up this fix.

Comment 13

[Mihai Morar, (:MihaiMorar)]

I had reproduced the initial issue on Nightly 26 (2013-08-24) 

https://crash-stats.mozilla.com/report/index/71afc9b4-1c3c-47ac-954e-b7f042131022

I can confirm the fix is verified on Latest Aurora 26 (20131020004007) on Windows 7 x64, Mac OSX 8.4 and Ubuntu 13.04 x86.