1151848 - Child abort on send signature @ mozilla::hal_sandbox::PHalChild::SendGetCurrentScreenConfiguration(mozilla::hal::ScreenConfiguration *)

Status: RESOLVED FIXED

(Core :: DOM: Content Processes, defect)

Description

[Tracy Walker [:tracy]]

Broken out per bug 1092216 comment 9

Bug 1092216 Child abort on send signature breakdown:
----------------------------------------------------
21	9.8%	mozilla::hal_sandbox::PHalChild::SendGetCurrentScreenConfiguration(mozilla::hal::ScreenConfiguration *)

Comment 1

[Jonathan Howard]

Video DownloadHelper add-on is at least one culprit.
Just having it and flash enabled crashed a page for me. (i.e. just viewing page, not explicitly using add-on)
Restarted, tried on windows, no crash and crash no longer happened when back to linux.

Comment 3

[nyuszika7h]

(Continuing discussion from bug 1160748)

I would try to find the regression range, but I haven't been able to reproduce the issue on a clean profile so far. However, I just had another site [1] crash on me (same bug), and Video DownloadHelper wasn't enabled this time.

[1] http://www.imagemagick.org/Usage/resize/

Comment 4

[Jim Mathies [:jimm]]

Bug 1092216 Child abort on send signature breakdown:
----------------------------------------------------
275	95.5%	mozilla::hal_sandbox::PHalChild::SendGetCurrentScreenConfiguration(mozilla::hal::ScreenConfiguration *)
8	2.8%	mozilla::dom::TabChild::DoSendBlockingMessage(JSContext *,nsAString_internal const &,mozilla::dom::StructuredCloneData const &,JS::Handle<JSObject *>,nsIPrincipal *,nsTArray<nsString> *,bool)
2	0.7%	mozilla::dom::PStorageChild::SendPreload(nsCString const &,unsigned int const &,nsTArray<nsString> *,nsTArray<nsString> *,nsresult *)
1	0.3%	mozilla::dom::PContentChild::SendKeywordToURI(nsCString const &,nsString *,mozilla::ipc::OptionalInputStreamParams *,mozilla::ipc::OptionalURIParams *)
1	0.3%	mozilla::dom::PBrowserChild::SendGetDPI(float *)
1	0.3%	mozilla::dom::PContentChild::SendFindPlugins(unsigned int const &,nsTArray<mozilla::plugins::PluginTag> *,unsigned int *)

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: patch v1

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=57b83a23e908

Comment 7

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a65f85763513

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/a65f85763513

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 8625592 [details] [diff] [review]
patch v1

This is a topcrasher on Aurora, we should probably uplift it. The patch applies cleanly.

Approval Request Comment
[Feature/regressing bug #]: n/a
[User impact if declined]: More crashes using extensions.
[Describe test coverage new/current, TreeHerder]: The code has a mochitest (a crashtest, really) checked into trunk.
[Risks and why]: Low risk, uses mechanisms already in use elsewhere to solve a well-understood problem.
[String/UUID change made/needed]: n/a

Comment 10

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8625592 [details] [diff] [review]
patch v1

This fix seems stable as it has been in m-c for a few days now without any negative impact. Let's uplift to Aurora.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/2365179749ff