1051557 - crash in mozilla::layers::TileClient::GetBackBuffer(nsIntRegion const&, gfxContentType, mozilla::layers::SurfaceMode, bool*, bool, mozilla::RefPtr<mozilla::layers::TextureClient>*)

Status: RESOLVED WORKSFORME

(Core :: Graphics: Layers, defect)

Description

[Aaron Train [:aaronmt]]

This bug was filed from the Socorro interface and is 
report bp-787575c3-9973-46df-8e5f-8566d2140808.
=============================================================

Comment 1

[Martijn Wargers (dead)]

I got this on trunk while mirorring a tab on the Chromecast and then browsing a bit.

Comment 2

[Aaron Train [:aaronmt]]

Comments: 

Scrolling on NYTimes website and casting tab to Chromecast

Happened while mirroring tab to Chromecast.

Just testing out the mirroring capabilities and it crashed.

Flickr.com crashed after requesting desktop site while casting tab to Chromecast

Comment 3

[Kartikaya Gupta (email:[e-mail])]

I got this crash as well while looking at a profile in Cleopatra in fennec on my nexus 4.

https://crash-stats.mozilla.com/report/index/e9f71e1b-466e-473c-9a5b-4d2dd2140824

Looking at the code it looks like SimpleTextureClientPool can return nullptr from GetTextureClient and that will cause a crash when TileClient tries to use the backbuffer. This might be an OOM situation in which case we actually can't do very much but might also be a bug causing runaway allocations, so somebody should probably investigate it.

Comment 4

[Kartikaya Gupta (email:[e-mail])]

Actually we are recursing in EndTransaction an unreasonable number of times. We should repro with the tiling logging enabled to see why.

Comment 5

[Milan Sreckovic [:milan] (needinfo for best results)]

Kats, can you reproduce with the tiling logging?  Nical, anything stand out from the report?

Comment 6

[Nicolas Silva [:nical]]

Not much, mBackBuffer is null because TextureClientPool::GetTextureClient() returned nullptr which means there was no tile to recycle and CreateTextureClientForDrawing returned nullptr which typically happens when we run out of memory.

Comment 7

[Milan Sreckovic [:milan] (needinfo for best results)]

I wonder if the extra warnings (debug only, see bug 1104837) in tile pools would trigger in this workflow? It needs at least 11/27 build to try though...

Comment 8

[Milan Sreckovic [:milan] (needinfo for best results)]

Also, this code changed somewhat in 35/36, wonder if it still reproduces.

Comment 9

[Kartikaya Gupta (email:[e-mail])]

I was unable to reproduce on http://people.mozilla.org/~bgirard/cleopatra/#report=14e4dbcb001de34d2982636816d3deda25cbf70e which is the URL I crashed on last time. I spent some time panning/zooming around and switching different tabs and so on, but no crash. Stock nightly Fennec build.

Comment 10

[Kartikaya Gupta (email:[e-mail])]

According to crash-stats there haven't been any crashes with this signature in the last 28 days (assuming I looked that up correctly). Resolving WFM for now, but reopen if it comes up again.