759749 - crash in mozilla::dom::CanvasRenderingContext2D::DrawImage @ mozilla::gfx::SourceSurfaceD2DTarget::GetBitmap

Status: RESOLVED FIXED

(Core :: Graphics: Canvas2D, defect)

Description

[Scoobidiver (away)]

It's a low volume crash but there's a spike in crashes from 15.0a1/20120522 making it #72 top crasher over the last 3 days. The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=0e2cc686b07b&tochange=64187d60fae7
It's likely a regression from bug 595375.

Signature 	mozilla::gfx::SourceSurfaceD2DTarget::GetBitmap(ID2D1RenderTarget*) More Reports Search
UUID	93f13211-4a65-417a-8d11-a05eb2120529
Date Processed	2012-05-29 14:45:42
Uptime	2311
Last Crash	40.4 minutes before submission
Install Age	1.1 hours since version was first installed.
Install Time	2012-05-29 09:13:43
Product	Firefox
Version	15.0a1
Build ID	20120528093039
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 42 stepping 7
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x6738, AdapterSubsysID: 31001682, AdapterDriverVersion: 8.951.0.0
Has dual GPUs. GPU #2: AdapterVendorID2: 0x8086, AdapterDeviceID2: 0x0112, AdapterSubsysID2: 0000000c, AdapterDriverVersion2: 8.15.10.2696D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True
Total Virtual Memory	4294836224
Available Virtual Memory	2488291328
System Memory Use Percentage	58
Available Page File	20289925120
Available Physical Memory	7038631936

Frame 	Module 	Signature 	Source
0 	gkmedias.dll 	mozilla::gfx::SourceSurfaceD2DTarget::GetBitmap 	gfx/2d/SourceSurfaceD2DTarget.cpp:166
1 	gkmedias.dll 	mozilla::gfx::DrawTargetD2D::DrawSurface 	gfx/2d/DrawTargetD2D.cpp:268
2 	xul.dll 	gfxContext::PushGroupAndCopyBackground 	gfx/thebes/gfxContext.cpp:1541
3 	xul.dll 	mozilla::layers::BasicLayerManager::PushGroupForLayer 	gfx/layers/basic/BasicLayers.cpp:620
4 	xul.dll 	mozilla::layers::BasicThebesLayer::PaintThebes 	gfx/layers/basic/BasicLayers.cpp:677
5 	xul.dll 	mozilla::layers::BasicLayerManager::PaintLayer 	gfx/layers/basic/BasicLayers.cpp:2023
6 	xul.dll 	mozilla::layers::BasicLayerManager::PaintLayer 	gfx/layers/basic/BasicLayers.cpp:2038
7 	xul.dll 	mozilla::layers::BasicLayerManager::EndTransactionInternal 	gfx/layers/basic/BasicLayers.cpp:1688
8 	xul.dll 	mozilla::layers::BasicLayerManager::EndTransaction 	gfx/layers/basic/BasicLayers.cpp:1635
9 	xul.dll 	mozilla::PaintInactiveLayer 	layout/base/FrameLayerBuilder.cpp:1560
10 	xul.dll 	mozilla::FrameLayerBuilder::DrawThebesLayer 	layout/base/FrameLayerBuilder.cpp:2529
11 	xul.dll 	gfxContext::Clip 	gfx/thebes/gfxContext.cpp:1133
12 	xul.dll 	gfxContext::Clip 	gfx/thebes/gfxContext.cpp:1134
13 	xul.dll 	mozilla::layers::ThebesLayerD3D10::DrawRegion 	gfx/layers/d3d10/ThebesLayerD3D10.cpp:460

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Agfx%3A%3ASourceSurfaceD2DTarget%3A%3AGetBitmap%28ID2D1RenderTarget*%29

Comment 1

[Scoobidiver (away)]

It's a low volume crash.

Recent stack traces look like:
Frame 	Module 	Signature 	Source
0 	gkmedias.dll 	mozilla::gfx::SourceSurfaceD2DTarget::GetBitmap 	gfx/2d/SourceSurfaceD2DTarget.cpp:176
1 	gkmedias.dll 	mozilla::gfx::DrawTargetD2D::DrawSurface 	gfx/2d/DrawTargetD2D.cpp:292
2 	xul.dll 	mozilla::dom::CanvasRenderingContext2D::DrawImage 	content/canvas/src/CanvasRenderingContext2D.cpp:3040
3 	xul.dll 	mozilla::dom::CanvasRenderingContext2D::DrawImage 	content/canvas/src/CanvasRenderingContext2D.cpp:3040
4 	xul.dll 	mozilla::dom::CanvasRenderingContext2DBinding::drawImage 	obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp:2131

Comment 2

[Jim Mathies [:jimm]]

This is now our top crasher in metrofx.

https://crash-stats.mozilla.com/topcrasher/products/MetroFirefox/versions/28.0a1

Comment 3

[Jim Mathies [:jimm]]

Hey Milan, any chance we might be able to get some gfx love on this? It's our current top crasher.

https://crash-stats.mozilla.com/topcrasher/products/MetroFirefox/versions/29.0a1

Comment 4

[Milan Sreckovic [:milan] (needinfo for best results)]

Bas, what do you think - no STR, but if mBitmap is null, either CreateBitmap failed or DrawTargetWillChange got called during this function in another thread?

Comment 5

[Bas Schouten (:bas.schouten)]

(In reply to Milan Sreckovic [:milan] from comment #4)
> Bas, what do you think - no STR, but if mBitmap is null, either CreateBitmap
> failed or DrawTargetWillChange got called during this function in another
> thread?

The latter is impossible (because we don't, afaik touch this code off the main thread). So this must have been a failure in CreateBitmap. I haven't yet figure out a possible cause, but it's interesting that this is high volume for metro. So we should look for the cause to be something in metro.

Jim: Could you run some common Canvas benchmarks in metro and see if they happen to trigger this? If I had STR it would help a lot.

Comment 6

[Jim Mathies [:jimm]]

If we have them, a url list would help here.

Comment 7

[Tracy Walker [:tracy]]

Here are the top URL's  add back the keyword if you'd to see the one timers.

Total Count 	URL
16 	https://www.facebook.com/login.php?login_attempt=1
13 	https://www.facebook.com/
12 	about:blank
5 	about:newtab
3 	yafd:tabs
3 	http://eu1.badoo.com/search/
3 	https://badoo.com/encounters/
3 	https://accounts.google.com/ServiceLoginAuth
2 	http://www.chip.de/downloads/c1_downloads_hs_getfile_v1_44759396.html?t=1389315935&v=3600&s=6a8166ec7d2f45f83fd5dcec495ceab2
2 	https://badoo.com/fr/encounters/
2 	http://badoo.com/encounters/
2 	https://eu1.badoo.com/connections/visitors/
2 	http://badoo.com/search/
2 	https://www.odnoklassniki.ru/https

Comment 8

[Jim Mathies [:jimm]]

We have a canvas in our urlbar for downloads, I wonder if this crash is associated with that?

http://mxr.mozilla.org/mozilla-central/source/browser/metro/base/content/bindings/circularprogress.xml

Comment 9

[Lukas Blakk [:lsblakk] use ?needinfo]

Looks like we'll want to add a topcrash-metro keyword, will file bug shortly.

Comment 10

[Lukas Blakk [:lsblakk] use ?needinfo]

(In reply to Lukas Blakk [:lsblakk] from comment #9)
> Looks like we'll want to add a topcrash-metro keyword, will file bug shortly.

nm, we have one - using it.

Comment 11

[Jim Mathies [:jimm]]

Attachment: bail if CreateBitmap fails

Comment 12

[Jim Mathies [:jimm]]

I haven't come up with any steps to reproduce. I think we'd prefer some odd drawing anomaly vs. a browser crash, at least for release. We could land this on aurora only for example if we want.

Comment 13

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/d86f25820d53

Comment 14

[Jim Mathies [:jimm]]

Comment on attachment 8363095 [details] [diff] [review]
bail if CreateBitmap fails

[Approval Request Comment]
Bug caused by (feature/regressing bug #): unknown
User impact if declined: crashy app
Testing completed (on m-c, etc.): yes
Risk to taking this patch (and alternatives if risky): low
String or IDL/UUID changes made by this patch: none

Comment 15

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/00262fd30bb0

Comment 16

[Bogdan Maris, Desktop Test Engineering]

I was unable to reproduce this crash on Windows 7x32 and Windows 8x32 on old Metro build and non Metro using the information provided in Socorro comments and using links from comment 7.
Based on Socorro there are only 3 crashes in Firefox 28 beta in the last 2 weeks and 16 crashes in Aurora 28.0a2 in the last 2 weeks.
Firefox 28 beta 
https://crash-stats.mozilla.com/query/?product=Firefox&version=Firefox%3A28.0b&range_value=2&range_unit=weeks&date=02%2F11%2F2014+09%3A00%3A00&query_search=signature&query_type=contains&query=mozilla%3A%3Agfx%3A%3ASourceSurfaceD2DTarget%3A%3AGetBitmap%28ID2D1RenderTarget*%29&reason=&release_channels=&build_id=&process_type=any&hang_type=any
Aurora 28.0a2
https://crash-stats.mozilla.com/query/?product=Firefox&version=Firefox%3A28.0a2&range_value=2&range_unit=weeks&date=02%2F11%2F2014+09%3A00%3A00&query_search=signature&query_type=contains&query=mozilla%3A%3Agfx%3A%3ASourceSurfaceD2DTarget%3A%3AGetBitmap%28ID2D1RenderTarget*%29&reason=&release_channels=&build_id=&process_type=any&hang_type=any
I think we can call this verified based on Socorro stats.

Comment 17

[Ioana (away)]

There are 10 crashes now on Fx28 beta and 2 on Fx29 aurora:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Agfx%3A%3ASourceSurfaceD2DTarget%3A%3AGetBitmap%28ID2D1RenderTarget%2A%29&product=Firefox&query_type=contains&range_unit=weeks&process_type=any&version=Firefox%3A30.0a1&version=Firefox%3A29.0a2&version=Firefox%3A28.0b&hang_type=any&date=2014-02-19+12%3A00%3A00&range_value=4#tab-reports

Is it possible the new crashes are this same bug? Because if they are, we should probably file a followup bug here if the number of crashes keeps increasing.

Comment 18

[Jim Mathies [:jimm]]

(In reply to Ioana Budnar, QA [:ioana] from comment #17)
> There are 10 crashes now on Fx28 beta and 2 on Fx29 aurora:
> https://crash-stats.mozilla.com/report/
> list?signature=mozilla%3A%3Agfx%3A%3ASourceSurfaceD2DTarget%3A%3AGetBitmap%28
> ID2D1RenderTarget%2A%29&product=Firefox&query_type=contains&range_unit=weeks&
> process_type=any&version=Firefox%3A30.0a1&version=Firefox%3A29.
> 0a2&version=Firefox%3A28.0b&hang_type=any&date=2014-02-
> 19+12%3A00%3A00&range_value=4#tab-reports
> 
> Is it possible the new crashes are this same bug? Because if they are, we
> should probably file a followup bug here if the number of crashes keeps
> increasing.

If this is a new and increasing crash in firefox desktop then yes it should be filed.

Comment 19

[Ioana (away)]

(In reply to Jim Mathies [:jimm] (away 4/1-4/21) from comment #18)
> If this is a new and increasing crash in firefox desktop then yes it should
> be filed.

The number of crashes is still quite low: 38 crashes in the last 4 weeks (Fx28+29+30+31). Two of the crashes are on Firefox 29 beta 1.

I don't know if this is a new crash since we don't have reliable steps to reproduce and the crash signature as the one in this bug. This is precisely why I asked whether it is new or the same bug.

Comment 20

[alex_mayorga]

bp-b1fd4213-c8a5-41bb-9270-666332140918	18/09/2014	01:35 p.m.

Comment 21

[Fernando Hartmann]

bp-2faa41cb-372a-4034-bb55-3b62b2141013 just happened to me for the fist time. FF 33 RC

Comment 22

[Raymond]

5e2bebbb-695b-49e4-96f4-bb2da2141105 just happened to me for the first time. SM 2.26.1

Comment 23

[Raymond]

Again and again ... nobody can re-open this bug ?
https://crash-stats.mozilla.com/report/index/87990aea-be47-49a3-9f39-6a4a32141224

Comment 24

[Kartikaya Gupta (email:[e-mail])]

In general we prefer to file new bugs when issues like this come back after a long time of the patch being landed, because it gets confusing if we reopen the bug and continue working on it. Feel free to file a new bug using your crash report above using the "Report this bug in" link on the crash-report page and provide any details that you can.

Comment 25

[Raymond]

(In reply to Kartikaya Gupta (email:[e-mail]) from comment #24)
> In general we prefer to file new bugs when issues like this come back after
> a long time of the patch being landed, because it gets confusing if we
> reopen the bug and continue working on it. Feel free to file a new bug using
> your crash report above using the "Report this bug in" link on the
> crash-report page and provide any details that you can.

https://bugzilla.mozilla.org/show_bug.cgi?id=1099955
was entered before
This is the new report: https://bugzilla.mozilla.org/show_bug.cgi?id=1115926

Both are untouched ...