1267914 - crash in mozilla::ipc::FatalError | mozilla::layers::PImageBridgeParent::Read, spiking in Nightly builds since 2016-April-20

Status: RESOLVED DUPLICATE of bug 1266878

(Core :: IPC, defect)

Description

[Nicholas Nethercote [inactive]]

This bug was filed from the Socorro interface and is 
report bp-22d76873-98f0-4a2d-a066-89fa92160423.
=============================================================

This crash signature has been seen previously in small numbers in older versions, but there has been a spike in recent Nightly builds, starting with Nightly 20160420030213 and occurring 36 times since.

Here's a typical stack trace, though some of them are slightly different (e.g.
fewer |Read()| frames in the trace):

> 0 	xul.dll 	mozilla::ipc::FatalError(char const*, char const*, bool) 	ipc/glue/ProtocolUtils.cpp
> 1 	xul.dll 	mozilla::layers::PImageBridgeParent::Read(mozilla::layers::YCbCrDescriptor*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PImageBridgeParent.cpp
> 2 	xul.dll 	mozilla::layers::PImageBridgeParent::Read(mozilla::layers::BufferDescriptor*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PImageBridgeParent.cpp
> 3 	xul.dll 	mozilla::layers::PImageBridgeParent::Read(mozilla::layers::SurfaceDescriptorBuffer*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PImageBridgeParent.cpp
> 4 	xul.dll 	mozilla::layers::PImageBridgeParent::Read(mozilla::layers::SurfaceDescriptor*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PImageBridgeParent.cpp
> 5 	xul.dll 	mozilla::layers::PImageBridgeParent::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PImageBridgeParent.cpp
> 6 	xul.dll 	mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
> 7 	xul.dll 	mozilla::ipc::MessageChannel::DispatchMessageW(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
> 8 	xul.dll 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	ipc/glue/MessageChannel.cpp
> 9 	xul.dll 	RunnableMethod<mozilla::ipc::MessageChannel, void ( mozilla::ipc::MessageChannel::*)(void), mozilla::Tuple<> >::Run() 	ipc/chromium/src/base/task.h
> 10 	xul.dll 	MessageLoop::RunTask(Task*) 	ipc/chromium/src/base/message_loop.cc

I looked at about 15 individual crash reports and most of them involved YouTube, and one or two involved other video sites.

A possible regression window (the changesets that went into Nightly 20160420030213, obtained from http://dbaron.org/mozilla/crashes-by-build):

https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ae7413abfa4d3954a6a4ce7c1613a7100f367f9a&tochange=f05a1242fb29023bd7ebc492897ed3d6907733c7

Comment 1

[Nicholas Nethercote [inactive]]

mconley, any idea what might have caused this, or who might know? I don't know much about this one.

Comment 2

[Andrew McCreight [:mccr8]]

You want to look at the IPCFatalErrorMsg and IPCFatalErrorProtocol fields to see what is going wrong.

These look like these are almost entire "Error deserializing 'stereoMode' (StereoMode) member of 'YCbCrDescriptor'", in PImageBridgeParent. Looks like it must be the constructor for PTexture() in that class.

In fact, looking at the changes in file that has the ParamTraits for StereoMode, I see bug 1266878, which fixes it.

Comment 3

[Andrew McCreight [:mccr8]]

(ParamTraits<StereoMode> is the class responsible for serializing/deserializing StereoMode in IPC, so I figured there was a probably a bug in there somewhere that could be causing this error when deserializing a StereoMode.)