1351993 - Crash in std::map<T>::_Try_emplace<T> called from GPUVideoTextureHost()

Status: RESOLVED DUPLICATE of bug 1331761

(Core :: Graphics: Layers, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-1b60cbd1-9891-4904-aa56-0bad72170329.
=============================================================
Crashing Thread (25)
Frame 	Module 	Signature 	Source
0 	xul.dll 	std::map<unsigned __int64, mozilla::layers::PTextureParent*, std::less<unsigned __int64>, std::allocator<std::pair<unsigned __int64 const, mozilla::layers::PTextureParent*> > >::_Try_emplace<unsigned __int64 const&>(unsigned __int64 const&) 	vs2015u3/VC/include/map:209
1 	xul.dll 	std::map<unsigned __int64, mozilla::layers::PTextureParent*, std::less<unsigned __int64>, std::allocator<std::pair<unsigned __int64 const, mozilla::layers::PTextureParent*> > >::operator[](unsigned __int64 const&) 	vs2015u3/VC/include/map:338
2 	xul.dll 	mozilla::layers::GPUVideoTextureHost::GPUVideoTextureHost(mozilla::layers::TextureFlags, mozilla::layers::SurfaceDescriptorGPUVideo const&) 	gfx/layers/composite/GPUVideoTextureHost.cpp:19
3 	xul.dll 	mozilla::layers::CreateBackendIndependentTextureHost(mozilla::layers::SurfaceDescriptor const&, mozilla::layers::ISurfaceAllocator*, mozilla::layers::TextureFlags) 	gfx/layers/composite/TextureHost.cpp:266
4 	xul.dll 	mozilla::layers::TextureHost::Create(mozilla::layers::SurfaceDescriptor const&, mozilla::layers::ISurfaceAllocator*, mozilla::layers::LayersBackend, mozilla::layers::TextureFlags) 	gfx/layers/composite/TextureHost.cpp:197
5 	xul.dll 	mozilla::layers::TextureParent::Init(mozilla::layers::SurfaceDescriptor const&, mozilla::layers::LayersBackend const&, mozilla::layers::TextureFlags const&) 	gfx/layers/composite/TextureHost.cpp:1093
6 	xul.dll 	mozilla::layers::TextureHost::CreateIPDLActor(mozilla::layers::HostIPCAllocator*, mozilla::layers::SurfaceDescriptor const&, mozilla::layers::LayersBackend, mozilla::layers::TextureFlags, unsigned __int64) 	gfx/layers/composite/TextureHost.cpp:111
7 	xul.dll 	mozilla::layers::ImageBridgeParent::AllocPTextureParent(mozilla::layers::SurfaceDescriptor const&, mozilla::layers::LayersBackend const&, mozilla::layers::TextureFlags const&, unsigned __int64 const&) 	gfx/layers/ipc/ImageBridgeParent.cpp:260
8 	xul.dll 	mozilla::layers::PImageBridgeParent::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PImageBridgeParent.cpp:341
9 	xul.dll 	mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp:1804
10 	xul.dll 	mozilla::ipc::MessageChannel::DispatchMessageW(IPC::Message&&) 	ipc/glue/MessageChannel.cpp:1739
11 	xul.dll 	mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) 	ipc/glue/MessageChannel.cpp:1620
12 	xul.dll 	mozilla::ipc::MessageChannel::MessageTask::Run() 	ipc/glue/MessageChannel.cpp:1645
13 	xul.dll 	MessageLoop::RunTask(already_AddRefed<mozilla::Runnable>) 	ipc/chromium/src/base/message_loop.cc:358
14 	xul.dll 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask&&) 	ipc/chromium/src/base/message_loop.cc:366
15 	xul.dll 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc:441
16 	xul.dll 	base::MessagePumpForUI::DoRunLoop() 	ipc/chromium/src/base/message_pump_win.cc:212
17 	xul.dll 	base::MessagePumpWin::RunWithDispatcher(base::MessagePump::Delegate*, base::MessagePumpWin::Dispatcher*) 	ipc/chromium/src/base/message_pump_win.cc:56
18 	xul.dll 	base::MessagePumpWin::Run(base::MessagePump::Delegate*) 	ipc/chromium/src/base/message_pump_win.h:80
19 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:231
20 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:211
21 	xul.dll 	base::Thread::ThreadMain() 	ipc/chromium/src/base/thread.cc:179
22 	xul.dll 	`anonymous namespace'::ThreadFunc 	ipc/chromium/src/base/platform_thread_win.cc:28
23 	kernel32.dll 	BaseThreadInitThunk 	
24 	ntdll.dll 	__RtlUserThreadStart 	
25 	ntdll.dll 	_RtlUserThreadStart

crash reports going through mozilla::layers::GPUVideoTextureHost::GPUVideoTextureHost popped up in firefox 53 for 32bit users of the browser on windows. overall it's rather low voulme though with ~0.1% of browser crashes on 53.0b last week.

after 54.0a1 build 20170131030205 the crash signatures aren't present any more which suggests that something landing at that time on nightly fixed the issue for 54+ again.

Comment 1

[Blake Wu [:bwu][:blakewu]]

From comment 0, it seems more related to layout.

Comment 2

[Randell Jesup [:jesup] (needinfo me)]

There are several crashes hiding behind this signature.  I'll start by restricting this bug (arbitrarily) to crashes that started in 53a2 (1/30 build), where this is called from GPUVideoTextureHost(), from ImageBridge.  Since it started crashing, 276 crashes, mostly in beta (as you'd expect).  This does *not* seem to happen in 54 or 55, though this was low-volume in 53a2, so it's possible that's wrong.

So from this report it seems more like gfx/layers.

https://crash-stats.mozilla.com/signature/?product=Firefox&proto_signature=~GPUVideoTextureHost&signature=std%3A%3Amap%3CT%3E%3A%3A_Try_emplace%3CT%3E&date=%3E%3D2017-01-02T20%3A40%3A22.000Z&date=%3C2017-04-02T20%3A40%3A22.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=version&page=1

Comment 3

[Milan Sreckovic [:milan] (needinfo for best results)]

David, would this be covered by the recent uplifts?

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Yes, this should be bug 1331761.

Comment 6

[Blake Wu [:bwu][:blakewu]]

Set "firefox53" fixed since bug 1331761 has landed in 53 as well.