This bug was filed from the Socorro interface and is report bp-2a766b3e-d81d-4511-aa32-f98512141020. ============================================================= Currently a top crasher on nightly (36) at #7 in the rank. It's also in the list of explosive reports. Nearly all of these are reported on Windows 7 machines. The signature has been around for a while but the number of crashers started to increase with builds from 10/11 onwards. There are three comments in the reports so far, and one of them mentions: "Crashes while installing ATI Catalyst drivers" Correlations tab was empty. More reports at: https://crash-stats.mozilla.com/report/list?product=Firefox&signature=DrawingContext%3A%3AFillRectangle%28D2D_RECT_F+const%2A%2C+ID2D1Brush%2A%29 0 d2d1.dll DrawingContext::FillRectangle(D2D_RECT_F const*, ID2D1Brush*) 1 d2d1.dll D2DDeviceContextBase<ID2D1HwndRenderTarget, ID2D1HwndRenderTarget, ID2D1DeviceContext>::FillRectangle(D2D_RECT_F const*, ID2D1Brush*) 2 xul.dll mozilla::gfx::DrawTargetD2D1::FillRect(mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::Pattern const&, mozilla::gfx::DrawOptions const&) gfx/2d/DrawTargetD2D1.cpp 3 xul.dll gfxContext::FillAzure(mozilla::gfx::Pattern const&, float) gfx/thebes/gfxContext.cpp 4 xul.dll gfxContext::Fill(mozilla::gfx::Pattern const&) gfx/thebes/gfxContext.cpp 5 xul.dll gfxContext::Fill() gfx/thebes/gfxContext.cpp 6 xul.dll nsCSSRendering::PaintGradient(nsPresContext*, nsRenderingContext&, nsStyleGradient*, nsRect const&, nsRect const&, nsRect const&, mozilla::gfx::IntRectTyped<mozilla::CSSPixel> const&, nsSize const&) layout/base/nsCSSRendering.cpp 7 xul.dll nsImageRenderer::Draw(nsPresContext*, nsRenderingContext&, nsRect const&, nsRect const&, nsRect const&, nsPoint const&, mozilla::gfx::IntRectTyped<mozilla::CSSPixel> const&) layout/base/nsCSSRendering.cpp 8 xul.dll nsImageRenderer::DrawBackground(nsPresContext*, nsRenderingContext&, nsRect const&, nsRect const&, nsPoint const&, nsRect const&) layout/base/nsCSSRendering.cpp 9 xul.dll nsCSSRendering::PaintBackgroundWithSC(nsPresContext*, nsRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleContext*, nsStyleBorder const&, unsigned int, nsRect*, int) layout/base/nsCSSRendering.cpp 10 xul.dll nsCSSRendering::PaintBackground(nsPresContext*, nsRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, unsigned int, nsRect*, int) layout/base/nsCSSRendering.cpp 11 xul.dll nsDisplayBackgroundImage::PaintInternal(nsDisplayListBuilder*, nsRenderingContext*, nsRect const&, nsRect*) layout/base/nsDisplayList.cpp 12 xul.dll nsDisplayBackgroundImage::Paint(nsDisplayListBuilder*, nsRenderingContext*) layout/base/nsDisplayList.cpp 13 xul.dll mozilla::FrameLayerBuilder::PaintItems(nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem>&, nsIntRect const&, gfxContext*, nsRenderingContext*, nsDisplayListBuilder*, nsPresContext*, nsIntPoint const&, float, float, int) layout/base/FrameLayerBuilder.cpp 14 xul.dll mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*) layout/base/FrameLayerBuilder.cpp 15 xul.dll mozilla::layers::BasicPaintedLayer::PaintThebes(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) gfx/layers/basic/BasicPaintedLayer.cpp 16 xul.dll mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext&, gfxContext*) gfx/layers/basic/BasicLayerManager.cpp 17 xul.dll mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) gfx/layers/basic/BasicLayerManager.cpp 18 xul.dll mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext&, gfxContext*) gfx/layers/basic/BasicLayerManager.cpp 19 xul.dll mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) gfx/layers/basic/BasicLayerManager.cpp 20 xul.dll mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext&, gfxContext*) gfx/layers/basic/BasicLayerManager.cpp 21 xul.dll mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) gfx/layers/basic/BasicLayerManager.cpp 22 xul.dll mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) gfx/layers/basic/BasicLayerManager.cpp 23 xul.dll nsSVGIntegrationUtils::PaintFramesWithEffects(nsRenderingContext*, nsIFrame*, nsRect const&, nsDisplayListBuilder*, mozilla::layers::LayerManager*) layout/svg/nsSVGIntegrationUtils.cpp 24 xul.dll nsDisplaySVGEffects::PaintAsLayer(nsDisplayListBuilder*, nsRenderingContext*, mozilla::layers::LayerManager*) layout/base/nsDisplayList.cpp 25 xul.dll mozilla::PaintInactiveLayer layout/base/FrameLayerBuilder.cpp 26 xul.dll mozilla::FrameLayerBuilder::PaintItems(nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem>&, nsIntRect const&, gfxContext*, nsRenderingContext*, nsDisplayListBuilder*, nsPresContext*, nsIntPoint const&, float, float, int) layout/base/FrameLayerBuilder.cpp 27 xul.dll mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*) layout/base/FrameLayerBuilder.cpp 28 xul.dll mozilla::layers::BasicPaintedLayer::PaintThebes(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) gfx/layers/basic/BasicPaintedLayer.cpp 29 xul.dll mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext&, gfxContext*) gfx/layers/basic/BasicLayerManager.cpp 30 xul.dll mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) gfx/layers/basic/BasicLayerManager.cpp 31 xul.dll mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext&, gfxContext*) gfx/layers/basic/BasicLayerManager.cpp 32 xul.dll mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) gfx/layers/basic/BasicLayerManager.cpp 33 xul.dll mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext&, gfxContext*) gfx/layers/basic/BasicLayerManager.cpp 34 xul.dll mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*) gfx/layers/basic/BasicLayerManager.cpp 35 xul.dll mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) gfx/layers/basic/BasicLayerManager.cpp 36 xul.dll nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) layout/base/nsDisplayList.cpp 37 xul.dll nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) layout/base/nsDisplayList.cpp 38 xul.dll nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, unsigned int) layout/base/nsLayoutUtils.cpp 39 xul.dll PresShell::RenderDocument(nsRect const&, unsigned int, unsigned int, gfxContext*) layout/base/nsPresShell.cpp 40 xul.dll mozilla::image::SVGDrawingCallback::operator()(gfxContext*, gfxRect const&, GraphicsFilter const&, gfxMatrix const&) image/src/VectorImage.cpp 41 xul.dll gfxCallbackDrawable::Draw(gfxContext*, gfxRect const&, bool, GraphicsFilter const&, double, gfxMatrix const&) gfx/thebes/gfxDrawable.cpp 42 xul.dll gfxUtils::DrawPixelSnapped(gfxContext*, gfxDrawable*, gfxSize const&, mozilla::image::ImageRegion const&, mozilla::gfx::SurfaceFormat, GraphicsFilter, unsigned int, double) gfx/thebes/gfxUtils.cpp 43 xul.dll mozilla::image::imgFrame::InitWithDrawable(gfxDrawable*, nsIntSize const&, mozilla::gfx::SurfaceFormat, GraphicsFilter, unsigned int) image/src/imgFrame.cpp 44 xul.dll mozilla::image::VectorImage::CreateSurfaceAndShow(mozilla::image::SVGDrawingParameters const&) image/src/VectorImage.cpp 45 xul.dll mozilla::image::VectorImage::Draw(gfxContext*, nsIntSize const&, mozilla::image::ImageRegion const&, unsigned int, GraphicsFilter, mozilla::Maybe<mozilla::SVGImageContext> const&, unsigned int) image/src/VectorImage.cpp 46 xul.dll DrawImageInternal layout/base/nsLayoutUtils.cpp 47 xul.dll nsLayoutUtils::DrawBackgroundImage(nsRenderingContext*, nsPresContext*, imgIContainer*, nsIntSize const&, GraphicsFilter, nsRect const&, nsRect const&, nsPoint const&, nsRect const&, unsigned int) layout/base/nsLayoutUtils.cpp 48 xul.dll nsImageRenderer::Draw(nsPresContext*, nsRenderingContext&, nsRect const&, nsRect const&, nsRect const&, nsPoint const&, mozilla::gfx::IntRectTyped<mozilla::CSSPixel> const&) layout/base/nsCSSRendering.cpp 49 xul.dll nsImageRenderer::DrawBackground(nsPresContext*, nsRenderingContext&, nsRect const&, nsRect const&, nsPoint const&, nsRect const&) layout/base/nsCSSRendering.cpp 50 xul.dll nsCSSRendering::PaintBackgroundWithSC(nsPresContext*, nsRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleContext*, nsStyleBorder const&, unsigned int, nsRect*, int) layout/base/nsCSSRendering.cpp 51 xul.dll nsCSSRendering::PaintBackground(nsPresContext*, nsRenderingContext&, nsIFrame*, nsRect const&, nsRect const&, unsigned int, nsRect*, int) layout/base/nsCSSRendering.cpp 52 xul.dll nsDisplayBackgroundImage::PaintInternal(nsDisplayListBuilder*, nsRenderingContext*, nsRect const&, nsRect*) layout/base/nsDisplayList.cpp 53 xul.dll nsDisplayBackgroundImage::Paint(nsDisplayListBuilder*, nsRenderingContext*) layout/base/nsDisplayList.cpp 54 xul.dll mozilla::FrameLayerBuilder::PaintItems(nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem>&, nsIntRect const&, gfxContext*, nsRenderingContext*, nsDisplayListBuilder*, nsPresContext*, nsIntPoint const&, float, float, int) layout/base/FrameLayerBuilder.cpp 55 xul.dll mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*) layout/base/FrameLayerBuilder.cpp 56 xul.dll mozilla::layers::ClientPaintedLayer::PaintThebes() gfx/layers/client/ClientPaintedLayer.cpp 57 xul.dll mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback(mozilla::layers::ReadbackProcessor*) gfx/layers/client/ClientPaintedLayer.cpp 58 xul.dll mozilla::layers::ClientContainerLayer::RenderLayer() gfx/layers/client/ClientContainerLayer.h 59 xul.dll mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) gfx/layers/client/ClientLayerManager.cpp 60 xul.dll mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) gfx/layers/client/ClientLayerManager.cpp 61 xul.dll nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) layout/base/nsDisplayList.cpp 62 xul.dll nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) layout/base/nsDisplayList.cpp 63 xul.dll nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, unsigned int) layout/base/nsLayoutUtils.cpp 64 xul.dll PresShell::Paint(nsView*, nsRegion const&, unsigned int) layout/base/nsPresShell.cpp 65 xul.dll nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) view/nsViewManager.cpp 66 xul.dll nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) view/nsViewManager.cpp 67 xul.dll nsViewManager::WillPaintWindow(nsIWidget*) view/nsViewManager.cpp 68 xul.dll nsView::WillPaintWindow(nsIWidget*) view/nsView.cpp 69 xul.dll nsWindow::OnPaint(HDC__*, unsigned int) widget/windows/nsWindowGfx.cpp 70 xul.dll nsWindow::ProcessMessage(unsigned int, unsigned __int64&, __int64&, __int64*) widget/windows/nsWindow.cpp 71 xul.dll nsWindow::WindowProcInternal(HWND__*, unsigned int, unsigned __int64, __int64) widget/windows/nsWindow.cpp 72 xul.dll CallWindowProcCrashProtected xpcom/base/nsCrashOnException.cpp 73 xul.dll nsWindow::WindowProc(HWND__*, unsigned int, unsigned __int64, __int64) widget/windows/nsWindow.cpp 74 user32.dll GetRealWindowOwner 75 user32.dll UserCallWinProcCheckWow 76 uxtheme.dll CPaintBuffer::_PaintTargetRect(tagRECT const&, HDC__*) 77 user32.dll DispatchClientMessage 78 xul.dll xul.dll@0xed8093 79 user32.dll _fnDWORD 80 xul.dll xul.dll@0xed8093 81 user32.dll UserCallWinProcCheckWow 82 ntdll.dll KiUserCallbackDispatcher 83 nss3.dll PR_IntervalToMilliseconds nsprpub/pr/src/misc/prinrval.c 84 xul.dll mozilla::Telemetry::TimeHistogram::Add(unsigned int) toolkit/components/telemetry/Telemetry.cpp

[Tracking Requested - why for this release]:

User comments from the duplicate bug 1089458 comment 4: > In my eventlog I see a warning that nvlddmkm (a kernel mode driver component > of my Nvidia Driver) crashed and was restored. > I remember that I was using a Bing 3d Maps when the screen flickered and the > driver crashed. > > Upon switching back to Firefox I got this crash. > > If this is really related, then I think Firefox should recover gracefully > from a failed video device driver. > BTW E10s was enabled.

Just to clarify the user story from comment 4: I used the windows 8.1 Bing 3D Maps preview App,(http://apps.microsoft.com/windows/en-us/app/bing-maps-preview/75ce2a6a-8a25-4916-83d0-19b8e7b60787) My guess is that any any app that makes the video driver fail, may ultimately lead to this issue.

[Tracking Requested - why for this release]: This is now ~7% of all crashes on Aurora 35.

Just an Update to Comment # 5 my video card is a Nvidia GForce GTS 360M running Nivida Driver 9.18.13.4052 (in Properties of driver) Gforce Experience displays it as V 340.52. In each of the instances that I observed this crash I do have a corresponding message in Eventlog that Nvlddmk "Display driver stopped responding and has recovered." If you search in google, for nvlddmk then you will find all sorts of reports and steps to avoid it. . Looking through the bug reports Nightly always crashes with some graphic related code (createBitmap, createTexture, ... ) so I guess that we are using a context/handle/memory from the video driver that is invalid. The driver crashed and was restarted and thus it is not surprising that the display context has become invalid, the surprizing thing is that this lowlevel driver issue boils up and makes an application (Firefox) crash. Researching: The event log Message I see is from TDR a way to restart the video driver, MS InfoPage http://msdn.microsoft.com/en-us/Library/Windows/Hardware/ff570087%28v=vs.85%29.aspx Windows 8 introduced some changes to TDR, which seem to make it more likely to happen, which may explain why we see more crashes of this type. See http://msdn.microsoft.com/en-us/Library/Windows/Hardware/jj676805%28v=vs.85%29.aspx An explanation of that feature and a description of what happens to a system after TDR restarted the driver can be found here: https://forums.geforce.com/default/topic/413110/geforce-drivers/the-nvlddmkm-error-what-is-it-an-fyi-for-those-seeing-this-issue/ I think the relevant part from the link above is: > 3. Desktop recovery: The operating system resets the appropriate state of the graphics stack. The video memory manager, which is also part of Dxgkrnl.sys, purges all allocations from video memory. The display miniport driver resets the GPU hardware state. The graphics stack takes the final actions and restores the desktop to the responsive state. As previously mentioned, some legacy DirectX applications might render just black at the end of this recovery, which requires the end user to restart these applications. Well-written DirectX 9Ex and DirectX 10 and later applications that handle Device Remove technology continue to work correctly. An application must release and then recreate its Direct3D device and all of the device's objects. For more information about how DirectX applications recover, see the Windows SDK. < Could this be the root cause? Firefox not handling Device Remove properly?

I have looked at the crashreports from comment 1 ( https://crash-stats.mozilla.com/report/list?product=Firefox&signature=DrawingContext%3A%3AFillRectangle%28D2D_RECT_F+const%2A%2C+ID2D1Brush%2A%29 ) and have found that that the graphics driver is not from NVIDIA, but from ATI for many of the crashes. This too supports my argument from comment 7. David what do you think?

I have somewhat of an idea what might be causing this. I bet that this happens when the video driver crashes and we get a gradient from the gradient cache and try to draw with that. The question is why this is new with Direct2D 1.1.

Reply to comment 9, Bas, I'v tried to understand what an application needs to do with with respect to the quote in comment 7, I have yet to see or find an example of how this should work. And I'v tried to locate the code doing the initialization for video output in firefox, since I think thats where the registration for a Device Remove event needs to happen. I think this just happens more frequently (and is annoying lots of Firefox users out there) due to the changes in Windows 8(.1) TDR.

Nvidia is higher than average but I don't think this is specific to one vendor. Rank Adapter vendor id Count % 1 0x10de 277 60.88 % 2 0x8086 89 19.56 % 3 0x1002 89 19.56 %

David I agree, seems to happen when Windows TDR restarts any video driver, not just nvidia.

Now that we've disabled D2D1.1 on FF35 in bug 1095608, this shouldn't be affected that branch. Leaving tracking for 36 and higher.

I just got this on nightly during an nvidia driver update: bp-709e3901-8d80-4a68-b275-8cdb52150117

bas, this is one of the top issue in 36 beta. Do you have plan for this? (or we can disable D2D1.1) thanks

(In reply to Sylvestre Ledru [:sylvestre] from comment #15) > bas, this is one of the top issue in 36 beta. Do you have plan for this? (or > we can disable D2D1.1) thanks I highly suspect this is just a signature consolidating several smaller crash signatures when using D2D 1.0, since current release simply always crashes when you update your drivers or get a TDR (which afaiui is when this crash occurs). Having said that we're in the process of addressing the TDR issues. But I -very- much doubt this is a regression in total crashes.

Comment on attachment 8555353 [details] [diff] [review] Prevent usage of incompatible graphics objects after a device reset Review of attachment 8555353 [details] [diff] [review]: ----------------------------------------------------------------- Not a huge fan. Not much choice though.

Bas, is this a difficult uplift?

Comment on attachment 8555353 [details] [diff] [review] Prevent usage of incompatible graphics objects after a device reset Approval Request Comment [Feature/regressing bug #]: Not a regression [User impact if declined]: Crashes during driver reset [Describe test coverage new/current, TreeHerder]: Extensive nightly coverage [Risks and why]: Fairly low [String/UUID change made/needed]: None

Comment on attachment 8555353 [details] [diff] [review] Prevent usage of incompatible graphics objects after a device reset Taking this topcrash fix on Aurora. Bas - 36 is marked as affected as well. What do you think about uplifting this fix to Beta?

(In reply to Lawrence Mandel [:lmandel] (use needinfo) from comment #22) > Comment on attachment 8555353 [details] [diff] [review] > Prevent usage of incompatible graphics objects after a device reset > > Taking this topcrash fix on Aurora. > > Bas - 36 is marked as affected as well. What do you think about uplifting > this fix to Beta? There's no value. Beta crashes under the circumstances that cause this crash anyway (it doesn't have the other work that makes us be able to survive a TDR). We'd be taking away this crash, but we'd just cause a number of smaller crash signatures to come in its place. It would only cause crash stats to be more misleading and confusing, at least this crash signature consolidates a lot of the TDR related crashes into one statistic.

Thanks for the details Bas. Do you think we have any option other than living with this new topcrash in 36?

(In reply to Lawrence Mandel [:lmandel] (use needinfo) from comment #25) > Thanks for the details Bas. Do you think we have any option other than > living with this new topcrash in 36? It's already a crash on 35 (just with a different signature), it's fixed in 37, but the patches to fix it are complicated and I would be very hesitant to upload such a complex set of work to beta. Those patches were just meant to ride the trains as we're not actually fixing a regression here.

Given Bas' feedback in comment 26, I'm setting 36 as wontfix.

I encountered this crash https://crash-stats.mozilla.com/report/index/ccb67422-af23-43fc-960f-915862150401 during my testing around loop tab share, on Firefox 38 Beta 1 (20150330154247) using Windows 8.1 32bit.

Crash on http://reshade.me/ https://crash-stats.mozilla.com/report/index/1fb536a4-8832-41e2-ac5c-955112150411 AMD driver restart after crash

This crash on FF 38 beta3

Still crashing (Firefox 38.0b9). d2d1.dll D2DDeviceContextBase<ID2D1DeviceContext1, ID2D1DeviceContext1, null_type>::FillRectangle(D2D_RECT_F const*, ID2D1Brush*)

(In reply to Stas from comment #31) > Still crashing (Firefox 38.0b9). > > d2d1.dll > D2DDeviceContextBase<ID2D1DeviceContext1, ID2D1DeviceContext1, > null_type>::FillRectangle(D2D_RECT_F const*, ID2D1Brush*) Please comment on bug 1154003 :).

(In reply to Stas from comment #31) > Still crashing (Firefox 38.0b9). > > d2d1.dll > D2DDeviceContextBase<ID2D1DeviceContext1, ID2D1DeviceContext1, > null_type>::FillRectangle(D2D_RECT_F const*, ID2D1Brush*) Could you also send us your exact crash report?

https://crash-stats.mozilla.com/report/index/2461cfa6-ba5c-43c3-9ac7-781ae2150501 Which looks like failing to make a brush here: https://dxr.mozilla.org/mozilla-central/source/gfx/2d/DrawTargetD2D1.cpp#365 and the calling FillRectangle with the null brush?

More for Bas ... We have two topcrashes for Thunderbird 38.1.0 ranked #2 and #3 https://crash-stats.mozilla.com/topcrasher/products/Thunderbird/versions/38.1.0 win7 DrawingContext::FillRectangle(D2D_RECT_F const*, ID2D1Brush*) win8 D2DDeviceContextBase<T>::FillRectangle(D2D_RECT_F const*, ID2D1Brush*) examples: https://crash-stats.mozilla.com/report/list?product=Thunderbird&range_value=7&range_unit=days&date=2015-07-27&signature=DrawingContext%3A%3AFillRectangle%28D2D_RECT_F+const*%2C+ID2D1Brush*%29&version=Thunderbird%3A38.1.0#tab-reports bp-03dd7aca-3c85-43cf-93db-f4ca42150726 https://crash-stats.mozilla.com/report/list?product=Thunderbird&range_value=7&range_unit=days&date=2015-07-27&signature=D2DDeviceContextBase%3CT%3E%3A%3AFillRectangle%28D2D_RECT_F+const*%2C+ID2D1Brush*%29&version=Thunderbird%3A38.1.0#tab-reports bp-725d9ede-20f9-4a19-857e-1deb82150726

I can't find any crashes like this anymore, please reopen if I'm wrong.