This bug was filed from the Socorro interface and is report bp-e44dd355-7677-4034-a53a-c29122140326. ============================================================= We are seeing a large number of crashes with this signature, and there are a lot of related signatures that start with "igd10umd32.dll@" in the explosiveness reports in Firefox 29 (beta). I am adding all the related signatures coming up in the explosiveness reports for Fx29. 0 igd10umd32.dll iSTD::FastMemCopy_SSE2_movntdq_movdqa(void *,void const *,unsigned int) 1 igd10umd32.dll iSTD::FastMemCopy(void *,void const *,unsigned int) 2 igd10umd32.dll iSTD::FastCpuBlt(unsigned char *,unsigned long,unsigned char *,unsigned long,unsigned long,unsigned long) 3 igd10umd32.dll D3D10::CDevice::PerformSubresourceUpdate(D3D10::CResource *,unsigned int,D3D10_DDI_BOX const *,unsigned char * &,unsigned char * &,unsigned int,unsigned int,unsigned int,unsigned int) 4 igd10umd32.dll D3D10::CDevice::ResourceUpdateSubResourceUP(D3D10::CResource *,unsigned int,D3D10_DDI_BOX const *,void const *,unsigned int,unsigned int,int) 5 igd10umd32.dll D3D10::CResource::InitializeTextureData(D3D10_DDIARG_SUBRESOURCE_UP *) 6 igd10umd32.dll D3D10::CResource::Initialize<D3D10DDIARG_CREATERESOURCE const >(D3D10DDIARG_CREATERESOURCE const *,D3D10::CResource *) 7 igd10umd32.dll D3D10::CResource2D<D3D10::CGfxResource>::Create<D3D10DDIARG_CREATERESOURCE>(D3D10DDIARG_CREATERESOURCE const *,D3D10DDI_HRTRESOURCE,D3D10::CResource *,D3D10::CDevice *,D3D10::CResource2D<D3D10::CGfxResource> * &,bool) 8 igd10umd32.dll D3D10::CResource::CreateSpecificResource<D3D10::CGfxResource,D3D10DDIARG_CREATERESOURCE>(D3D10DDIARG_CREATERESOURCE const *,D3D10DDI_HRTRESOURCE,D3D10::CResource *,D3D10::CDevice *,D3D10::CResource * &,bool) 9 igd10umd32.dll D3D10::CResource::CreateResource<D3D10DDIARG_CREATERESOURCE>(D3D10DDIARG_CREATERESOURCE const *,D3D10DDI_HRTRESOURCE,D3D10::CResource *,D3D10::CDevice *,D3D10::CResource * &,bool) 10 igd10umd32.dll D3D10::CDevice::CreateResource(D3D10DDIARG_CREATERESOURCE const *,D3D10DDI_HRTRESOURCE,D3D10::CResource *) 11 igd10umd32.dll D3D10API::CreateResource10(D3D10DDI_HDEVICE,D3D10DDIARG_CREATERESOURCE const *,D3D10DDI_HRESOURCE,D3D10DDI_HRTRESOURCE) 12 d3d11.dll CResource<ID3D11Texture3D>::CLS::FinalConstruct(CContext *,D3D11DDIARG_CREATERESOURCE const *,SD3D11SharedResourceCreationArgs *,SD3D11CrossLayerData *,D3D10DDI_HRTRESOURCE) 13 d3d11.dll TCLSWrappers<CTexture2D>::CLSFinalConstructFn(CTexture2D::CLS *,CContext *,CTexture2D::TConstructorArgs const *) 14 d3d11.dll CLayeredObjectWithCLS<CTexture2D>::FinalConstruct(CTexture2D::TConstructorArgs const &,_GUID const &,void * *,CLayeredObjectWithCLS<CTexture2D>::SInfo const *) 15 d3d11.dll CLayeredObjectWithCLS<CTexture2D>::CreateInstance(CTexture2D::TConstructorArgs &,void *,void *,_GUID const &,void * *,CLayeredObjectWithCLS<CTexture2D>::SInfo const *) 16 d3d11.dll CDevice::CreateLayeredChild(unsigned int,void const *,unsigned long,ID3D11LayeredUseCounted *,_GUID const &,void * *) 17 d3d11.dll CBridgeImpl<ID3D11LayeredDevice,ID3D11LayeredDevice,CLayeredObject<CDevice> >::CreateLayeredChild(unsigned int,void const *,unsigned long,ID3D11LayeredUseCounted *,_GUID const &,void * *) 18 d3d11.dll CD3D11LayeredChild<ID3D11DeviceChild,NDXGI::CDevice,64>::FinalConstruct(ED3D11DeviceChildType,SLayeredArgs const *,unsigned long,ID3D11LayeredUseCounted *,_GUID const &) 19 d3d11.dll NDXGI::CResource::FinalConstruct(NDXGI::CResource::TConstructorArgs const &) 20 d3d11.dll NDXGI::CDevice::CreateLayeredChild(unsigned int,void const *,unsigned long,ID3D11LayeredUseCounted *,_GUID const &,void * *) 21 d3d11.dll CBridgeImpl<ID3D11LayeredDevice,ID3D11LayeredDevice,CLayeredObject<NDXGI::CDevice> >::CreateLayeredChild(unsigned int,void const *,unsigned long,ID3D11LayeredUseCounted *,_GUID const &,void * *) 22 d3d11.dll NOutermost::CDeviceChild::FinalConstruct(NOutermost::CDeviceChild::TConstructorArgs const &) 23 d3d11.dll CUseCountedObject<NOutermost::CDeviceChild>::CUseCountedObject<NOutermost::CDeviceChild>(void *,NOutermost::CDeviceChild::TConstructorArgs const &,NOutermost::CDevice *,_GUID const &,void * *) 24 d3d11.dll CUseCountedObject<NOutermost::CDeviceChild>::CreateInstance(NOutermost::CDeviceChild::TConstructorArgs const &,NOutermost::CDevice *,void *,void *,_GUID const &,void * *) 25 d3d11.dll NOutermost::CDevice::CreateLayeredChild(unsigned int,void const *,unsigned long,ID3D11LayeredUseCounted *,_GUID const &,void * *) 26 d3d11.dll CDevice::CreateAndRecreateLayeredChild<SD3D11LayeredTexture2DCreationArgs>(unsigned int,SD3D11LayeredTexture2DCreationArgs *,ID3D11LayeredUseCounted *,_GUID const &,void * *,bool) 27 d3d11.dll CDevice::CreateTexture2D_Worker(D3D11_TEXTURE2D_DESC const *,D3D11_SUBRESOURCE_DATA const *,int,ID3D11Texture2D * *,SD3D11SharedResourceCreationArgs *,bool) 28 d3d11.dll CDevice::CreateTexture2D(D3D11_TEXTURE2D_DESC const *,D3D11_SUBRESOURCE_DATA const *,ID3D11Texture2D * *) 29 d2d1.dll d2d1.dll@0x2cf3d6 30 d2d1.dll d2d1.dll@0x2d1207 31 d2d1.dll d2d1.dll@0x2cd0f5 32 d2d1.dll d2d1.dll@0x2ccce2 33 d2d1.dll d2d1.dll@0x2408f0 34 d2d1.dll d2d1.dll@0x23d224 35 d2d1.dll d2d1.dll@0x229612 36 d2d1.dll d2d1.dll@0x21ca8b 37 gkmedias.dll mozilla::gfx::DrawTargetD2D::GetBitmapForSurface(mozilla::gfx::SourceSurface *,mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> &) gfx/2d/DrawTargetD2D.cpp 38 gkmedias.dll mozilla::gfx::DrawTargetD2D::DrawSurface(mozilla::gfx::SourceSurface *,mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const &,mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const &,mozilla::gfx::DrawSurfaceOptions const &,mozilla::gfx::DrawOptions const &) gfx/2d/DrawTargetD2D.cpp 39 xul.dll mozilla::dom::CanvasRenderingContext2D::DrawImage(mozilla::dom::HTMLImageElementOrHTMLCanvasElementOrHTMLVideoElement const &,double,double,double,double,double,double,double,double,unsigned char,mozilla::ErrorResult &) content/canvas/src/CanvasRenderingContext2D.cpp 40 xul.dll mozilla::dom::CanvasRenderingContext2D::DrawImage(mozilla::dom::HTMLImageElementOrHTMLCanvasElementOrHTMLVideoElement const &,double,double,double,double,double,double,double,double,mozilla::ErrorResult &) obj-firefox/dist/include/mozilla/dom/CanvasRenderingContext2D.h 41 xul.dll mozilla::dom::CanvasRenderingContext2DBinding::drawImage obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp 42 xul.dll mozilla::dom::CanvasRenderingContext2DBinding::genericMethod obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp 43 @0x5307b74 44 @0x1765d4d8 45 @0x53070b9 46 @0x1222b6b0 47 @0xc217539 48 mozjs.dll EnterBaseline js/src/jit/BaselineJIT.cpp 49 mozjs.dll js::jit::EnterBaselineMethod(JSContext *,js::RunState &) js/src/jit/BaselineJIT.cpp 50 mozjs.dll js::RunScript(JSContext *,js::RunState &) js/src/vm/Interpreter.cpp 51 mozjs.dll js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) js/src/vm/Interpreter.cpp 52 mozjs.dll js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value *,JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 53 mozjs.dll JS::Call(JSContext *,JS::Value,JS::Value,unsigned int,JS::Value *,JS::MutableHandle<JS::Value>) js/src/jsapi.cpp 54 xul.dll mozilla::dom::FrameRequestCallback::Call(JSContext *,JS::Handle<JS::Value>,double,mozilla::ErrorResult &) obj-firefox/dom/bindings/WindowBinding.cpp 55 xul.dll mozilla::dom::FrameRequestCallback::Call(double,mozilla::ErrorResult &,mozilla::dom::CallbackObject::ExceptionHandling) obj-firefox/dist/include/mozilla/dom/WindowBinding.h 56 xul.dll nsRefreshDriver::Tick(__int64,mozilla::TimeStamp) layout/base/nsRefreshDriver.cpp 57 xul.dll mozilla::RefreshDriverTimer::Tick() layout/base/nsRefreshDriver.cpp 58 xul.dll nsTimerImpl::Fire() xpcom/threads/nsTimerImpl.cpp 59 xul.dll nsTimerEvent::Run() xpcom/threads/nsTimerImpl.cpp 60 xul.dll nsThread::ProcessNextEvent(bool,bool *) xpcom/threads/nsThread.cpp 61 ntdll.dll NtSetEvent 62 nss3.dll PR_Unlock nsprpub/pr/src/threads/combined/prulock.c 63 xul.dll NS_ProcessNextEvent(nsIThread *,bool) xpcom/glue/nsThreadUtils.cpp 64 xul.dll mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) ipc/glue/MessagePump.cpp 65 xul.dll _SEH_epilog4 66 xul.dll MessageLoop::Run() ipc/chromium/src/base/message_loop.cc 67 xul.dll nsBaseAppShell::Run() widget/xpwidgets/nsBaseAppShell.cpp 68 xul.dll nsAppShell::Run() widget/windows/nsAppShell.cpp 69 nss3.dll nss3.dll@0x7960 70 xul.dll XREMain::XRE_main(int,char * * const,nsXREAppData const *) toolkit/xre/nsAppRunner.cpp 71 xul.dll XRE_main toolkit/xre/nsAppRunner.cpp 72 firefox.exe do_main browser/app/nsBrowserApp.cpp 73 firefox.exe NS_internal_main(int,char * *) browser/app/nsBrowserApp.cpp 74 firefox.exe wmain toolkit/xre/nsWindowsWMain.cpp 75 firefox.exe __tmainCRTStartup f:/dd/vctools/crt_bld/self_x86/crt/src/crtexe.c 76 kernel32.dll BaseThreadInitThunk 77 ntdll.dll __RtlUserThreadStart 78 ntdll.dll _RtlUserThreadStart

Most of the installations affected are in Windows 7 (~90%), and most of the URLs where this happens (and where people have commented this happens) are yahoo.com related. From the list of URLs: Total Count URL 956 https://www.yahoo.com/ 54 http://ca.yahoo.com/ 30 http://in.yahoo.com/ 29 https://www.yahoo.com/?ilc=1

The iSTD::FastMemCopy_SSE2_movntdq_movdqa signature exists with very low volume in previous versions, but spiked hugely in 29, the other signatures actually only exist in 29+ at all.

I summed up the crash value of those in yesterday's data and saw that this ends up being the #1 crash on 29 that way, it also is very probably the main reason why overall crash volume of 29 is worse than 28. Naveed, can you please have someone from the Graphics team take a look at this? It's canvas2d calling D2D, crashing in the graphics driver (mostly Intel, sometimes NVidia), on Windows 7/8/8.1 (maybe also Vista).

OK, I found that we also have some NVidia driver crashes in our 28->29 regression list that show the same kind of stack coming from CanvasRenderingContext2D::DrawImage. Reflecting that in bug summary and signatures.

Looks like bug 986146 has the same kind of stack and a possible way to reproduce!

Bah, I'm already mixing up JS and GFX leaders... ;-) Milan, can you please have someone from the Graphics team take a look at this? This is the #1 regression from 28 to 29 on Beta, happening with canvas2d calling D2D, crashing in the graphics driver (mostly Intel, sometimes NVidia), on Windows 7/8/8.1 (maybe also Vista), URLs mostly point to Yahoo.

As somebody mentioned from the sites earlier. The reports also show a lot of people talking about logging into Yahoo, I wonder if this is related to the Yahoo Toolbar or something that was added to the Yahoo website. Do we have a yahoo account we can try to use to repro?

I suspect this might be a dupe of bug 973264. We should try testing with the r+'ed patch there.

(In reply to Bas Schouten (:bas.schouten) from comment #8) > I suspect this might be a dupe of bug 973264. We should try testing with the > r+'ed patch there. The STR in bug 986146 are something where we can try to reproduce (and not on Yahoo, BTW) but the bug here is filed on the large crash volume on 29, to "test" if the patch helps there, we'll need to uplift to beta.

(In reply to Robert Kaiser (:kairo@mozilla.com) from comment #9) > (In reply to Bas Schouten (:bas.schouten) from comment #8) > > I suspect this might be a dupe of bug 973264. We should try testing with the > > r+'ed patch there. > > The STR in bug 986146 are something where we can try to reproduce (and not > on Yahoo, BTW) but the bug here is filed on the large crash volume on 29, to > "test" if the patch helps there, we'll need to uplift to beta. The patch is a little involved for beta. So at the very least we need to get some good testing on other branches. I think there's a fairly good chance it fixes things though.

(In reply to Bas Schouten (:bas.schouten) from comment #10) > The patch is a little involved for beta. So at the very least we need to get > some good testing on other branches. I think there's a fairly good chance it > fixes things though. Well, we at least will need to have this landed on Nightly for a few days and see https://crash-stats.mozilla.com/search/?signature=~iSTD%3A%3AFastMemCopy_SSE2_movntdq_movdqa&version=31.0a1&_facets=build_id&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform not listing post-landing builds in the build ID facet. If that works, we have data confirmation. When it landed on Nightly, we can also can have the guy in bug 986146 test and see if he still can reproduce.

I am stating the obvious but it would be nice to have this fixed for 29. FYI, beta 5 is going to build next Thursday.

From all the searches I have done on Nightly data, it doesn't look like this is fixed in yesterday's Nightly, even though bug 973264 should have been included there. I'll do more searches in the next days and have asked the reporter of bug 986146 to try if it's fixed on Nightly.

Can we get a comment with an update about this bug's volume and any correlations if available?

(In reply to Lukas Blakk [:lsblakk] from comment #14) > Can we get a comment with an update about this bug's volume and any > correlations if available? https://crash-stats.mozilla.com/topcrasher_ranks_bybug/?bug_number=988548 says none of the signatures in here do appear in any versions where bug 973264 has landed, and bug 986146 confirms that the reproducible way for this bug has been fixed as well, so I'm duping this to the bug that has the actual patch that landed. Also setting flags for the branches to verified to get it off the radars.