Closed Bug 1107930 Opened 10 years ago Closed 10 years ago

crash in @0x0 | mozilla::layers::ContentHostIncremental::Composite(mozilla::layers::EffectChain&, float, mozilla::gfx::Matrix4x4 const&, mozilla::gfx::Filter const&, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const&, nsIntRegion const*)

Categories

(Core :: Graphics: Layers, defect)

ARM
Android
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 1098227
Tracking Status
fennec 36+ ---

People

(Reporter: aaronmt, Unassigned)

Details

(Keywords: crash, reproducible)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-335a193e-4b68-423d-a7cb-abb7d2141204.
=============================================================
I'm able to reproduce this crash on the latest Nightly

Steps:
1. go to http://www.flightradar24.com/data/flights/ua931/
2. scroll/zoom in the map area

Result: https://crash-stats.mozilla.com/report/index/de49b438-76fb-4fd6-9d3e-200762141209

Device:Samsung Galaxy Note 3 (4.4.2)
Keywords: reproducible
Hardware: All → ARM
tracking-fennec: --- → ?
Crash Signature: [@ @0x0 | mozilla::layers::ContentHostIncremental::Composite(mozilla::layers::EffectChain&, float, mozilla::gfx::Matrix4x4 const&, mozilla::gfx::Filter const&, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const&, nsIntRegion const*)] → [@ @0x0 | mozilla::layers::ContentHostIncremental::Composite(mozilla::layers::EffectChain&, float, mozilla::gfx::Matrix4x4 const&, mozilla::gfx::Filter const&, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const&, nsIntRegion const*)] [@ mozilla::l…
I can reproduce this locally with the STR in comment #1. Looking into it.
Assignee: nobody → snorp
tracking-fennec: ? → 37+
Stack from gdb:

#0  0x7dd77d04 in ConsumerAcquire (this=0x8c5a9890) at ../../dist/include/SharedSurface.h:106
#1  mozilla::layers::SharedSurfaceTextureHost::Lock (this=0x8c014280) at /Users/snorp/source/gecko-dev/gfx/layers/composite/TextureHost.cpp:981
#2  0x7dd5ea7e in mozilla::layers::ImageHost::Lock (this=0x8a60ff40) at /Users/snorp/source/gecko-dev/gfx/layers/composite/ImageHost.cpp:253
#3  0x7dd3fa5c in mozilla::layers::AutoLockCompositableHost::AutoLockCompositableHost (this=0x8adfd4a0, aHost=0x8a60ff40) at ../../dist/include/CompositableHost.h:283
#4  0x7dd63772 in mozilla::layers::ImageHost::Composite (this=0x8a60ff40, aEffectChain=..., aOpacity=1, aTransform=..., aFilter=@0x8adfd533: mozilla::gfx::GOOD, aClipRect=..., aVisibleRegion=0x0) at /Users/snorp/source/gecko-dev/gfx/layers/composite/ImageHost.cpp:88
#5  0x7dd66c50 in mozilla::layers::CanvasLayerComposite::RenderLayer (this=0x906f1000, aClipRect=...) at /Users/snorp/source/gecko-dev/gfx/layers/composite/CanvasLayerComposite.cpp:109
#6  0x7dd6ff52 in mozilla::layers::RenderLayers<mozilla::layers::ContainerLayerComposite> (aContainer=aContainer@entry=0x8b051800, aManager=aManager@entry=0x8afb7240, aClipRect=...) at /Users/snorp/source/gecko-dev/gfx/layers/composite/ContainerLayerComposite.cpp:371
#7  0x7dd70cb8 in mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerComposite> (aContainer=0x8b051800, aManager=0x8afb7240, aClipRect=...) at /Users/snorp/source/gecko-dev/gfx/layers/composite/ContainerLayerComposite.cpp:531
#8  0x7dd6ff52 in mozilla::layers::RenderLayers<mozilla::layers::ContainerLayerComposite> (aContainer=aContainer@entry=0x8dc3e800, aManager=aManager@entry=0x8afb7240, aClipRect=...) at /Users/snorp/source/gecko-dev/gfx/layers/composite/ContainerLayerComposite.cpp:371
#9  0x7dd70cb8 in mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerComposite> (aContainer=0x8dc3e800, aManager=0x8afb7240, aClipRect=...) at /Users/snorp/source/gecko-dev/gfx/layers/composite/ContainerLayerComposite.cpp:531
#10 0x7dd6ff52 in mozilla::layers::RenderLayers<mozilla::layers::ContainerLayerComposite> (aContainer=aContainer@entry=0x8c591000, aManager=aManager@entry=0x8afb7240, aClipRect=...) at /Users/snorp/source/gecko-dev/gfx/layers/composite/ContainerLayerComposite.cpp:371
#11 0x7dd70cb8 in mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerComposite> (aContainer=0x8c591000, aManager=0x8afb7240, aClipRect=...) at /Users/snorp/source/gecko-dev/gfx/layers/composite/ContainerLayerComposite.cpp:531
#12 0x7dd6b038 in mozilla::layers::LayerManagerComposite::Render (this=this@entry=0x8afb7240) at /Users/snorp/source/gecko-dev/gfx/layers/composite/LayerManagerComposite.cpp:723
#13 0x7dd6b32c in mozilla::layers::LayerManagerComposite::EndTransaction (this=0x8afb7240, aCallback=<optimized out>, aCallbackData=<optimized out>, aFlags=<optimized out>) at /Users/snorp/source/gecko-dev/gfx/layers/composite/LayerManagerComposite.cpp:309
#14 0x7dd6b400 in mozilla::layers::LayerManagerComposite::EndEmptyTransaction (this=0x8afb7240, aFlags=<optimized out>) at /Users/snorp/source/gecko-dev/gfx/layers/composite/LayerManagerComposite.cpp:256
#15 0x7dd7e5da in mozilla::layers::CompositorParent::CompositeToTarget (this=0x8a3f1000, aTarget=0x0, aRect=<optimized out>) at /Users/snorp/source/gecko-dev/gfx/layers/ipc/CompositorParent.cpp:905
#16 0x7d99fc4a in MessageLoop::RunTask (this=0x8adfdcb8, task=0x8a1027f0) at /Users/snorp/source/gecko-dev/ipc/chromium/src/base/message_loop.cc:361
#17 0x7d9a3ba8 in MessageLoop::DeferOrRunPendingTask (this=<optimized out>, pending_task=...) at /Users/snorp/source/gecko-dev/ipc/chromium/src/base/message_loop.cc:369
#18 0x7d9a4e90 in MessageLoop::DoWork (this=0x8adfdcb8) at /Users/snorp/source/gecko-dev/ipc/chromium/src/base/message_loop.cc:447
#19 0x7d99fd36 in base::MessagePumpDefault::Run (this=0x8acc3680, delegate=0x8adfdcb8) at /Users/snorp/source/gecko-dev/ipc/chromium/src/base/message_pump_default.cc:34
#20 0x7d9a1388 in MessageLoop::RunInternal (this=this@entry=0x8adfdcb8) at /Users/snorp/source/gecko-dev/ipc/chromium/src/base/message_loop.cc:233
#21 0x7d9a13a4 in RunHandler (this=0x8adfdcb8) at /Users/snorp/source/gecko-dev/ipc/chromium/src/base/message_loop.cc:226
#22 MessageLoop::Run (this=0x8adfdcb8) at /Users/snorp/source/gecko-dev/ipc/chromium/src/base/message_loop.cc:200
#23 0x7d9abf44 in base::Thread::ThreadMain (this=0x8ac8ceb0) at /Users/snorp/source/gecko-dev/ipc/chromium/src/base/thread.cc:170
#24 0x7d996f5c in ThreadFunc (closure=<optimized out>) at /Users/snorp/source/gecko-dev/ipc/chromium/src/base/platform_thread_posix.cc:39
#25 0x40060174 in __thread_entry () from /Users/snorp/source/jimdb-arm/lib/00850937d791b9ee/system/lib/libc.so
#26 0x4006030c in pthread_create () from /Users/snorp/source/jimdb-arm/lib/00850937d791b9ee/system/lib/libc.so
#27 0x00000000 in ?? ()

It looks like the SharedSurface has been freed, as inspecting it yields:

(gdb) p *this
$4 = {_vptr.SharedSurface = 0x5a5a5a5a, mType = 90, mAttachType = 90, mGL = 0x5a5a5a5a, mSize = {<mozilla::gfx::BaseSize<int, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> >> = {width = 1515870810, height = 1515870810}, <mozilla::gfx::UnknownUnits> = {<No data fields>}, <No data fields>}, mHasAlpha = 90, 
  mIsLocked = 90, mIsProducerAcquired = 90, mIsConsumerAcquired = 90, mOwningThread = {value = 0x5a5a5a5a}}
Jeff, it looks like something is yanking the SharedSurface out from under SharedSurfaceTextureHost/Client, can you look into this? It's easily reproducible with the STR in comment #1.
Assignee: snorp → jgilbert
Kairo mentioned that 36 is affected too.
Nightly on a Kindle Fire crashes like

Report ID
Report ID 	Date Submitted
bp-2c133268-7172-46f8-8ab8-11fbb2150102	01/01/15	18:19

Subscribing...
Er number 1 and 2 top crash and represents 18% of all crashes.
Milan, could you help on this? Thanks
Flags: needinfo?(milan)
Nicolas, any ideas on this one?  Do you have a device to reproduce?

I'm still nervous about AutoLockCompositableHost & ImageHost interplay, probably for no good reason...
Assignee: jgilbert → nobody
Flags: needinfo?(milan) → needinfo?(nical.bugzilla)
This is a lifetime issue with SurfaceStream dupe of bug 1098227 and a few other bugs.
Status: NEW → RESOLVED
Closed: 10 years ago
Flags: needinfo?(nical.bugzilla)
Resolution: --- → DUPLICATE
Clearing status and tracking. Dup bug 1098227 has the correct flags set.
You need to log in before you can comment on or make changes to this bug.