1209724 - crash in mozilla::layers::FlushAllImagesSync

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-3c987333-a0bd-4510-968a-3fef02150929.
=============================================================
Crashing Thread
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::layers::FlushAllImagesSync 	gfx/layers/ipc/ImageBridgeChild.cpp
1 	xul.dll 	RunnableFunction<void (*)(mozilla::layers::AllocShmemParams*, mozilla::ReentrantMonitor*, bool*), Tuple3<mozilla::layers::AllocShmemParams*, mozilla::ReentrantMonitor*, bool*> >::Run() 	ipc/chromium/src/base/task.h
2 	xul.dll 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
3 	xul.dll 	`anonymous namespace'::ThreadFunc(void*) 	ipc/chromium/src/base/platform_thread_win.cc
4 	kernel32.dll 	BaseThreadInitThunk

this graphics related crash signature is notably on the rise in 42 and subsequent builds. it is resposible for 05.% of crashes in beta currently and all gpu vendors are affected.

https://crash-stats.mozilla.com/search/?signature=%3Dmozilla%3A%3Alayers%3A%3AFlushAllImagesSync&_facets=version&_facets=user_comments&_facets=adapter_vendor_id&_facets=adapter_driver_version&_facets=app_notes&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-version

Comment 1

[(Away)]

sImageBridgeChildSingleton is null. Nical is this related to bug 1208071?

Comment 2

[Nicolas Silva [:nical]]

(In reply to David Major [:dmajor] from comment #1)
> sImageBridgeChildSingleton is null. Nical is this related to bug 1208071?

This is definitely related to bug 1207220, maybe bug 1208071, but I am not quite sure. Anyway, we can paper over the issue by checking that the ImageBridge hasn't been destroyed between the moment we call FlushAllImages on some media thread and the moment the proxied function actually runs on the ImageBridgeThread.
I'll mark this one dependent on bug 1207220 because the stacks clearly show that textures are being kept alive too late in the shutdown, but I'll make a workaround in this bug (at least for beta).

Comment 3

[Nicolas Silva [:nical]]

Attachment: Paper over the issue by cancelling proxied functions to the ImageBridge thread if they arrive too late.

Comment 4

[Sotaro Ikeda [:sotaro]]

Comment on attachment 8667930 [details] [diff] [review]
Paper over the issue by cancelling proxied functions to the ImageBridge thread if they arrive too late.

Looks good.

Comment 5

[Nicolas Silva [:nical]]

Comment on attachment 8667930 [details] [diff] [review]
Paper over the issue by cancelling proxied functions to the ImageBridge thread if they arrive too late.

Approval Request Comment
[Feature/regressing bug #]:
[User impact if declined]: shutdown crashes
[Describe test coverage new/current, TreeHerder]: none
[Risks and why]: very low, we'd crash if we get into the added code paths anyway.
[String/UUID change made/needed]:

Comment 6

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/63cc71759a09

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/63cc71759a09

Comment 8

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8667930 [details] [diff] [review]
Paper over the issue by cancelling proxied functions to the ImageBridge thread if they arrive too late.

Fix a crash, taking it.

[Triage Comment]
I guess we want that to aurora/43 too. Nical, please correct if I am wrong here.

Comment 9

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/6b451428f550

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-beta/rev/e882f256d464