1150535 - most-of-the-time intermittent glterrain crash on Mac at 0x0 | mozilla::layers::SharedSurfaceTextureHost::Lock() when OMT Animations are enabled

Status: RESOLVED WORKSFORME

(Core :: Graphics: Layers, defect)

Description

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

When off-main-thread Animations are enabled, we see a crash most-of-the-time on Mac talos glterrain runs at 0x0 | mozilla::layers::SharedSurfaceTextureHost::Lock().

This blocks enabling off-main-thread animations, at least on Mac.

https://treeherder.mozilla.org/logviewer.html#?job_id=8386163&repo=mozilla-inbound
https://treeherder.mozilla.org/logviewer.html#?job_id=8386168&repo=mozilla-inbound
https://treeherder.mozilla.org/logviewer.html#?job_id=8387254&repo=mozilla-inbound
https://treeherder.mozilla.org/logviewer.html#?job_id=8389514&repo=mozilla-inbound
(oddly happened about 75% of the time in the first few pushes with OMT animations on, but then much less in the next few pushes) 


22:16:29 INFO - PROCESS-CRASH | glterrain | application crashed [@ 0x0]
22:16:29 INFO - Crash dump filename: /var/folders/fd/fh___tdj14n15by4ct164knh00000w/T/tmpoVAaFb/profile/minidumps/D9B9122F-B895-473A-96A1-366D0D8B1D5C.dmp
22:16:29 INFO - Operating system: Mac OS X
22:16:29 INFO - 10.10.2 14C109
22:16:29 INFO - CPU: amd64
22:16:29 INFO - family 6 model 42 stepping 7
22:16:29 INFO - 8 CPUs
22:16:29 INFO - Crash reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
22:16:29 INFO - Crash address: 0x0
22:16:29 INFO - Thread 32 (crashed)
22:16:29 INFO - 0 0x0
22:16:29 INFO - rbx = 0x0000000117626740 r12 = 0x0000000116b37a50
22:16:29 INFO - r13 = 0x0000000113d0302f r14 = 0x00000001135840e0
22:16:29 INFO - r15 = 0x000000011581f548 rip = 0x0000000000000000
22:16:29 INFO - rsp = 0x0000000113d02f18 rbp = 0x0000000113d02f30
22:16:29 INFO - Found by: given as instruction pointer in context
22:16:29 INFO - 1 XUL!mozilla::layers::SharedSurfaceTextureHost::Lock() [SharedSurface.h:288ad0365a5e : 107 + 0x8]
22:16:29 INFO - rip = 0x0000000101b0ff27 rsp = 0x0000000113d02f20
22:16:29 INFO - rbp = 0x0000000113d02f30
22:16:29 INFO - Found by: stack scanning
22:16:29 INFO - 2 XUL!mozilla::layers::ImageHost::Lock() [ImageHost.cpp:288ad0365a5e : 257 + 0x5]
22:16:29 INFO - rbx = 0x0000000116b37a50 r14 = 0x0000000116b37a00
22:16:29 INFO - rip = 0x0000000101afb48c rsp = 0x0000000113d02f40
22:16:29 INFO - rbp = 0x0000000113d02f50
22:16:29 INFO - Found by: call frame info
22:16:29 INFO - 3 XUL!mozilla::layers::ImageHost::Composite(mozilla::layers::EffectChain&, float, mozilla::gfx::Matrix4x4 const&, mozilla::gfx::Filter const&, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const&, nsIntRegion const*) [CompositableHost.h:288ad0365a5e : 244 + 0xc]
22:16:29 INFO - rbx = 0x000000011581f400 r14 = 0x0000000116b37a50
22:16:29 INFO - rip = 0x0000000101afab8d rsp = 0x0000000113d02f60
22:16:29 INFO - rbp = 0x0000000113d03010
22:16:29 INFO - Found by: call frame info
22:16:29 INFO - 4 XUL!mozilla::layers::CanvasLayerComposite::RenderLayer(nsIntRect const&) [CanvasLayerComposite.cpp:288ad0365a5e : 108 + 0x17]
22:16:29 INFO - rbx = 0x000000011581f400 r12 = 0x000000011581f660
22:16:29 INFO - r13 = 0x0000000113d03330 r14 = 0x0000000116b37a50
22:16:29 INFO - r15 = 0x0000000101afab20 rip = 0x0000000101af5a68
22:16:29 INFO - rsp = 0x0000000113d03020 rbp = 0x0000000113d03090
22:16:29 INFO - Found by: call frame info
22:16:29 INFO - 5 XUL!void mozilla::layers::RenderLayers<mozilla::layers::ContainerLayerComposite>(mozilla::layers::ContainerLayerComposite*, mozilla::layers::LayerManagerComposite*, mozilla::gfx::IntRectTyped<mozilla::RenderTargetPixel> const&) [ContainerLayerComposite.cpp:288ad0365a5e : 375 + 0xb]
22:16:29 INFO - rbx = 0x0000000000000000 r12 = 0x000000011581f660
22:16:29 INFO - r13 = 0x0000000113d03330 r14 = 0x0000000124c72a58
22:16:29 INFO - r15 = 0x000000011581f400 rip = 0x0000000101b02106
22:16:29 INFO - rsp = 0x0000000113d030a0 rbp = 0x0000000113d032f0
22:16:29 INFO - Found by: call frame info

Comment 1

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

This seems to have gone away on a more recent try run:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=b2cbef54b94e

Compare to earlier in the week:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=89a61f8da78d