1038253 - crash in mozilla::CrossProcessMutex::CrossProcessMutex

Status: RESOLVED INCOMPLETE

(Core :: Graphics: Layers, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-d7d0060e-e520-4ac2-acdb-a134e2140702.
=============================================================
Crashing Thread
Frame 	Module 	Signature 	Source
0 	libxul.so 	mozilla::CrossProcessMutex::CrossProcessMutex 	/home/geeksphone/FOS/peak/gecko/ipc/glue/CrossProcessMutex_posix.cpp:81
1 	libxul.so 	mozilla::layers::CompositorChild::SharedFrameMetricsData::SharedFrameMetricsData 	/home/geeksphone/FOS/peak/gecko/gfx/layers/ipc/CompositorChild.cpp:221
2 	libxul.so 	mozilla::layers::CompositorChild::RecvSharedCompositorFrameMetrics(base::FileDescriptor const&, base::FileDescriptor const&, unsigned int const&) 	/home/geeksphone/FOS/peak/gecko/gfx/layers/ipc/CompositorChild.cpp:191
3 	libxul.so 	mozilla::layers::PCompositorChild::OnMessageReceived(IPC::Message const&) 	/home/geeksphone/FOS/peak/objdir-gecko/ipc/ipdl/PCompositorChild.cpp:806
4 	libxul.so 	mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) 	/home/geeksphone/FOS/peak/gecko/ipc/glue/MessageChannel.cpp:1152
5 	libxul.so 	mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message const&) 	/home/geeksphone/FOS/peak/gecko/ipc/glue/MessageChannel.cpp:1066
6 	libxul.so 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	/home/geeksphone/FOS/peak/gecko/ipc/glue/MessageChannel.cpp:1049
7 	libxul.so 	RunnableMethod<FdWatcher, void (FdWatcher::*)(), Tuple0>::Run() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/tuple.h:383
8 	libxul.so 	mozilla::ipc::MessageChannel::DequeueTask::Run() 	/home/geeksphone/FOS/peak/objdir-gecko/ipc/glue/../../dist/include/mozilla/ipc/MessageChannel.h:385
9 	libxul.so 	MessageLoop::RunTask(Task*) 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc:357
10 	libxul.so 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc:365
11 	libxul.so 	MessageLoop::DoWork() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc:443
12 	libxul.so 	mozilla::ipc::DoWorkRunnable::Run() 	/home/geeksphone/FOS/peak/gecko/ipc/glue/MessagePump.cpp:228
13 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	/home/geeksphone/FOS/peak/gecko/xpcom/threads/nsThread.cpp:766
14 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	/home/geeksphone/FOS/peak/gecko/xpcom/glue/nsThreadUtils.cpp:263
15 	libxul.so 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	/home/geeksphone/FOS/peak/gecko/ipc/glue/MessagePump.cpp:95
16 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	/home/geeksphone/FOS/peak/gecko/ipc/glue/MessagePump.cpp:283
17 	libxul.so 	MessageLoop::RunInternal() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc:229
18 	libxul.so 	MessageLoop::Run() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc:222
19 	libxul.so 	nsBaseAppShell::Run() 	/home/geeksphone/FOS/peak/gecko/widget/xpwidgets/nsBaseAppShell.cpp:164
20 	libxul.so 	XRE_RunAppShell 	/home/geeksphone/FOS/peak/gecko/toolkit/xre/nsEmbedFunctions.cpp:692
21 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	/home/geeksphone/FOS/peak/gecko/ipc/glue/MessagePump.cpp:253
22 	libxul.so 	MessageLoop::RunInternal() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc:229
23 	libxul.so 	MessageLoop::Run() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc:222
24 	libxul.so 	XRE_InitChildProcess 	/home/geeksphone/FOS/peak/gecko/toolkit/xre/nsEmbedFunctions.cpp:529
25 	plugin-container 	main 	/home/geeksphone/FOS/peak/gecko/ipc/app/MozillaRuntimeMain.cpp:149
26 	libc.so 	__libc_init 	/home/geeksphone/FOS/keon_nightly/bionic/libc/bionic/libc_init_dynamic.c:114


Sample crash at :  	app://verticalhome.gaiamobile.org/manifest.webapp - 
More crashes : https://crash-stats.mozilla.com/report/list?product=B2G&range_unit=days&range_value=28&signature=mozilla%3A%3ACrossProcessMutex%3A%3ACrossProcessMutex#tab-reports
Crash on Peak only 
crash reports started in buildid : 20140702211235 
Happens in 32.a2 and 33.a1

Comment 1

[u279076]

Might deserve a different bug report but this started to escalate by a factor of 10 on August 3rd in Android. From the data it would appear as though this is driven solely by Fennec 48.

The stack looks different so this may indeed be a different bug:
0 	libxul.so 	mozilla::CrossProcessMutex::CrossProcessMutex 	ipc/glue/CrossProcessMutex_posix.cpp:63
1 	libxul.so 	mozilla::layers::AsyncPanZoomController::ShareCompositorFrameMetrics 	gfx/layers/apz/src/AsyncPanZoomController.cpp:3747
2 	libxul.so 	mozilla::layers::AsyncPanZoomController::NotifyLayersUpdated 	gfx/layers/apz/src/AsyncPanZoomController.cpp:3267
3 	libxul.so 	mozilla::layers::APZCTreeManager::PrepareNodeForLayer 	gfx/layers/apz/src/APZCTreeManager.cpp:463
4 	libxul.so 	mozilla::layers::APZCTreeManager::UpdateHitTestingTree 	gfx/layers/apz/src/APZCTreeManager.cpp:571
5 	libxul.so 	mozilla::layers::APZCTreeManager::UpdateHitTestingTree 	gfx/layers/apz/src/APZCTreeManager.cpp:602
6 	libxul.so 	mozilla::layers::APZCTreeManager::UpdateHitTestingTree 	gfx/layers/apz/src/APZCTreeManager.cpp:602
7 	libxul.so 	mozilla::layers::APZCTreeManager::UpdateHitTestingTree 	gfx/layers/apz/src/APZCTreeManager.cpp:602
8 	libxul.so 	mozilla::layers::APZCTreeManager::UpdateHitTestingTree 	gfx/layers/apz/src/APZCTreeManager.cpp:182
9 	libxul.so 	mozilla::layers::CompositorBridgeParent::ShadowLayersUpdated 	gfx/layers/ipc/CompositorBridgeParent.cpp:1398
10 	libxul.so 	mozilla::layers::LayerTransactionParent::RecvUpdate 	gfx/layers/ipc/LayerTransactionParent.cpp:633
11 	libxul.so 	mozilla::layers::LayerTransactionParent::RecvUpdateNoSwap 	gfx/layers/ipc/LayerTransactionParent.cpp:207
12 	libxul.so 	mozilla::layers::PLayerTransactionParent::OnMessageReceived 	obj-firefox/ipc/ipdl/PLayerTransactionParent.cpp:538
13 	libxul.so 	mozilla::layers::PCompositorBridgeParent::OnMessageReceived 	obj-firefox/ipc/ipdl/PCompositorBridgeParent.cpp:521
14 	libxul.so 	mozilla::ipc::MessageChannel::DispatchAsyncMessage 	ipc/glue/MessageChannel.cpp:1654
15 	libxul.so 	mozilla::ipc::MessageChannel::DispatchMessage 	ipc/glue/MessageChannel.cpp:1592
16 	libxul.so 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne 	ipc/glue/MessageChannel.cpp:1559
17 	libxul.so 	MessageLoop::RunTask 	ipc/chromium/src/base/message_loop.cc:349
18 	libxul.so 	MessageLoop::DeferOrRunPendingTask 	ipc/chromium/src/base/message_loop.cc:357
19 	libxul.so 	MessageLoop::DoWork 	ipc/chromium/src/base/message_loop.cc:444
20 	libxul.so 	base::MessagePumpDefault::Run 	ipc/chromium/src/base/message_pump_default.cc:34
21 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:223
22 	libxul.so 	base::Thread::ThreadMain 	ipc/chromium/src/base/thread.cc:174
23 	libxul.so 	ThreadFunc 	ipc/chromium/src/base/platform_thread_posix.cc:36
Ø 24 	libc.so 	libc.so@0x13ef7 	
Ø 25 	libc.so 	libc.so@0x13ed7 	
Ø 26 	libc.so 	libc.so@0x13ed7 	
Ø 27 	libc.so 	libc.so@0x11f2b 	

Kevin, what do you think?

Comment 2

[Kevin Brosnan [Ex-Mozilla]]

I would lean towards a new bug. The top of the signature is the same but everything else is different. Maybe we should close out this bug as we don't have b2g crash data any more.

Comment 3

[u279076]

Thanks Kevin. I have filed bug 1297148 and will close this one.