956967 - Crash loop in [@ PathFromRegionInternal ] with gfx.content.azure.backends empty and layers.prefer-d3d9=true

Status: VERIFIED FIXED

(Core :: Graphics, defect)

Description

[Loic]

STR:
You need to use a testing profile.
Set in about:config:
user_pref("gfx.content.azure.backends", "");
user_pref("layers.prefer-d3d9", true);
Restart Firefox.

Result: instant crash at each new restart.
prefs.js in the folder must be deleted to restart Firefox without crashing.

CR:
https://crash-stats.mozilla.com/report/index/f61ee020-9f77-4820-996b-880e72140107

Frame 	Module 	Signature 	Source
0 	xul.dll 	PathFromRegionInternal 	gfx/thebes/gfxUtils.cpp
1 	xul.dll 	mozilla::layers::RotatedContentBuffer::DrawTo(mozilla::layers::ThebesLayer *,gfxContext *,float,gfxASurface *,gfxMatrix const *) 	gfx/layers/RotatedBuffer.cpp
2 	xul.dll 	mozilla::layers::BasicThebesLayer::PaintThebes(gfxContext *,mozilla::layers::Layer *,void (*)(mozilla::layers::ThebesLayer *,gfxContext *,nsIntRegion const &,mozilla::layers::DrawRegionClip,nsIntRegion const &,void *),void *,mozilla::layers::ReadbackProcessor *) 	gfx/layers/basic/BasicThebesLayer.cpp
3 	xul.dll 	mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext &,gfxContext *) 	gfx/layers/basic/BasicLayerManager.cpp
4 	xul.dll 	mozilla::layers::BasicLayerManager::PaintLayer(gfxContext *,mozilla::layers::Layer *,void (*)(mozilla::layers::ThebesLayer *,gfxContext *,nsIntRegion const &,mozilla::layers::DrawRegionClip,nsIntRegion const &,void *),void *,mozilla::layers::ReadbackProcessor *) 	gfx/layers/basic/BasicLayerManager.cpp
5 	xul.dll 	mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext &,gfxContext *) 	gfx/layers/basic/BasicLayerManager.cpp
6 	xul.dll 	mozilla::layers::BasicLayerManager::PaintLayer(gfxContext *,mozilla::layers::Layer *,void (*)(mozilla::layers::ThebesLayer *,gfxContext *,nsIntRegion const &,mozilla::layers::DrawRegionClip,nsIntRegion const &,void *),void *,mozilla::layers::ReadbackProcessor *)

Comment 1

[Loic]

about:support

Adapter Description	Intel(R) HD Graphics 3000
Adapter Description (GPU #2)	NVIDIA GeForce GT 550M
Adapter Drivers	igdumd64 igd10umd64 igd10umd64 igdumd32 igd10umd32 igd10umd32
Adapter Drivers (GPU #2)	nvd3dumx,nvwgf2umx,nvwgf2umx nvd3dum,nvwgf2um,nvwgf2um
Adapter RAM	Unknown
Adapter RAM (GPU #2)	2048
ClearType Parameters	Gamma: 2200 Pixel Structure: R ClearType Level: 100 Enhanced Contrast: 50
Device ID	0x0116
Device ID (GPU #2)	0x0df6
Direct2D Enabled	true
DirectWrite Enabled	true (6.2.9200.16571)
Driver Date	10-31-2013
Driver Date (GPU #2)	3-14-2013
Driver Version	9.17.10.3347
Driver Version (GPU #2)	9.18.13.1144
GPU #2 Active	false
GPU Accelerated Windows	1/1 Direct3D 10
Vendor ID	0x8086
Vendor ID (GPU #2)	0x10de
WebGL Renderer	Google Inc. -- ANGLE (Intel(R) HD Graphics 3000 Direct3D9Ex vs_3_0 ps_3_0)
windowLayerManagerRemote	false
AzureCanvasBackend	direct2d
AzureContentBackend	direct2d
AzureFallbackCanvasBackend	cairo
AzureSkiaAccelerated	0

Comment 2

[Loic]

Regression range:
good=2013-11-26
bad=2013-11-27
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=53d55d2d0a25&tochange=6ecf0c4dfcbe

Maybe bug 932888 is involved.

Comment 3

[Benjamin Kerensa [:bkerensa]]

Can you have a look at this and let us know if this is valid and some insight as to what is going on here?

Comment 4

[Nick Cameron [:nrc]]

Sure sounds like the default Azure backend is incorrect and we're using d2d where we shouldn't. I'll have a poke around in the next few days.

Comment 5

[Nick Cameron [:nrc]]

The crash happens because you have forced direct3d9 but have direct2d enabled. This doesn't really work and is not possible without tweaking prefs. I always get a bit confused as to whether or not this should be a supported configuration and it gets more complicated because we can use direct2d directly from Azure or via Cairo using the Cairo Azure backend.

I will propose a patch which disables d2d if we are using d3d9, not sure if that is 100% something we should disallow though.

Comment 6

[Nick Cameron [:nrc]]

Attachment: patch 1: if we have to fallback to the default azure backend, pretend we support it.

Hopefully this part is not controversial. The default backend should always be supported (that is the intention) so we should report that if we check with gfxPlatform.

Comment 7

[Nick Cameron [:nrc]]

Attachment: patch 2: don't use d2d if we force on d3d9

I don't recall if this is meant to be supported or not, but it leads to crashes in both main thread and OMTC rendering, so I think we should forbid it.

Comment 8

[Bas Schouten (:bas.schouten)]

Comment on attachment 8358109 [details] [diff] [review]
patch 2: don't use d2d if we force on d3d9

Review of attachment 8358109 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/thebes/gfxWindowsPlatform.cpp
@@ -438,5 @@
>      // the preferences will be ignored until restart.
>      d2dDisabled = OncePreferenceDirect2DDisabled();
>      d2dForceEnabled = OncePreferenceDirect2DForceEnabled();
>  
> -    bool tryD2D = !d2dBlocked || d2dForceEnabled;

It was meant to be supported at some point. But let's not. If you force-enable it, that's fine.

Comment 9

[Nick Cameron [:nrc]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3b1616997a89
https://hg.mozilla.org/integration/mozilla-inbound/rev/f03891e62f0e

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/3b1616997a89
https://hg.mozilla.org/mozilla-central/rev/f03891e62f0e

Comment 11

[Paul Silaghi, QA [:pauly]]

Reproduced nightly 2014-01-08.
Verified fixed F 29.0a1 2014-01-14, Win 7 x64.

Comment 12

[u279076]

This is very low volume on Aurora at #134 with 12 crashes. That said, it is a startup crash as indicated by crashstats. If this is a low-risk fix it may be worth uplifting to Aurora so it makes it to Beta when we merge in just over a week. Keeping in mind that QA has tested and verified the issue is fixed.

Comment 13

[Nick Cameron [:nrc]]

Comment on attachment 8358107 [details] [diff] [review]
patch 1: if we have to fallback to the default azure backend, pretend we support it.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Regressed by one of the 'making Azure work' bugs from a while ago.
User impact if declined: Rare, but possible startup crash.
Testing completed (on m-c, etc.): Verified by QA, been on m-c for a couple of weeks (I think).
Risk to taking this patch (and alternatives if risky): Low risk
String or IDL/UUID changes made by this patch: None

Comment 14

[Nick Cameron [:nrc]]

Comment on attachment 8358109 [details] [diff] [review]
patch 2: don't use d2d if we force on d3d9

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Gradual regression of the technically supported, but never tested combination of d3d9 and d2d.
User impact if declined: Rare, but possible startup crash.
Testing completed (on m-c, etc.): Verified by QA, been on m-c for a couple of weeks.
Risk to taking this patch (and alternatives if risky): Low risk
String or IDL/UUID changes made by this patch: None

Comment 15

[Nick Cameron [:nrc]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/d1517e677805
https://hg.mozilla.org/releases/mozilla-aurora/rev/f4a23af7c5c7

Comment 16

[u279076]

Flagging for verification via crashstats after the weekend.

Comment 17

[Petruta Horea [:phorea], Desktop QA]

No crashes for Firefox 28 in the last days on crashstats. 

Also, I couldn't reproduce the initial issue on Fx 28 beta 1 under Win 7 64-bit (reproducible on Nightly 20131219030202).