Closed Bug 1209724 Opened 4 years ago Closed 4 years ago

crash in mozilla::layers::FlushAllImagesSync

Categories

(Core :: Graphics, defect, critical)

42 Branch
x86
Windows NT
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla44
Tracking Status
firefox42 --- fixed
firefox43 --- fixed
firefox44 --- fixed

People

(Reporter: philipp, Assigned: nical)

References

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is 
report bp-3c987333-a0bd-4510-968a-3fef02150929.
=============================================================
Crashing Thread
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::layers::FlushAllImagesSync 	gfx/layers/ipc/ImageBridgeChild.cpp
1 	xul.dll 	RunnableFunction<void (*)(mozilla::layers::AllocShmemParams*, mozilla::ReentrantMonitor*, bool*), Tuple3<mozilla::layers::AllocShmemParams*, mozilla::ReentrantMonitor*, bool*> >::Run() 	ipc/chromium/src/base/task.h
2 	xul.dll 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
3 	xul.dll 	`anonymous namespace'::ThreadFunc(void*) 	ipc/chromium/src/base/platform_thread_win.cc
4 	kernel32.dll 	BaseThreadInitThunk

this graphics related crash signature is notably on the rise in 42 and subsequent builds. it is resposible for 05.% of crashes in beta currently and all gpu vendors are affected.

https://crash-stats.mozilla.com/search/?signature=%3Dmozilla%3A%3Alayers%3A%3AFlushAllImagesSync&_facets=version&_facets=user_comments&_facets=adapter_vendor_id&_facets=adapter_driver_version&_facets=app_notes&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-version
sImageBridgeChildSingleton is null. Nical is this related to bug 1208071?
Flags: needinfo?(nical.bugzilla)
(In reply to David Major [:dmajor] from comment #1)
> sImageBridgeChildSingleton is null. Nical is this related to bug 1208071?

This is definitely related to bug 1207220, maybe bug 1208071, but I am not quite sure. Anyway, we can paper over the issue by checking that the ImageBridge hasn't been destroyed between the moment we call FlushAllImages on some media thread and the moment the proxied function actually runs on the ImageBridgeThread.
I'll mark this one dependent on bug 1207220 because the stacks clearly show that textures are being kept alive too late in the shutdown, but I'll make a workaround in this bug (at least for beta).
Depends on: 1207220
Flags: needinfo?(nical.bugzilla)
Assignee: nobody → nical.bugzilla
Attachment #8667930 - Flags: review?(sotaro.ikeda.g)
Comment on attachment 8667930 [details] [diff] [review]
Paper over the issue by cancelling proxied functions to the ImageBridge thread if they arrive too late.

Looks good.
Attachment #8667930 - Flags: review?(sotaro.ikeda.g) → review+
Comment on attachment 8667930 [details] [diff] [review]
Paper over the issue by cancelling proxied functions to the ImageBridge thread if they arrive too late.

Approval Request Comment
[Feature/regressing bug #]:
[User impact if declined]: shutdown crashes
[Describe test coverage new/current, TreeHerder]: none
[Risks and why]: very low, we'd crash if we get into the added code paths anyway.
[String/UUID change made/needed]:
Attachment #8667930 - Flags: approval-mozilla-beta?
https://hg.mozilla.org/mozilla-central/rev/63cc71759a09
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla44
Comment on attachment 8667930 [details] [diff] [review]
Paper over the issue by cancelling proxied functions to the ImageBridge thread if they arrive too late.

Fix a crash, taking it.

[Triage Comment]
I guess we want that to aurora/43 too. Nical, please correct if I am wrong here.
Attachment #8667930 - Flags: approval-mozilla-beta?
Attachment #8667930 - Flags: approval-mozilla-beta+
Attachment #8667930 - Flags: approval-mozilla-aurora+
See Also: → 1223193
You need to log in before you can comment on or make changes to this bug.