1213758 - Firefox 44.0a1 Crash [@ mozilla::layers::CompositorParent::UpdatePluginWindowState(unsigned __int64) ]

Status: RESOLVED FIXED

(Core :: General, defect)

Description

[Jonatan Svensson Glad]

Reporting on a top-crasher.

Comment 1

[Jim Mathies [:jimm]]

Attachment: patch

We access the layer tree state here on the compositor thread while in a composition call so lts data should be in good shape. However no lock is held on lts during this plugin update call and it looks like we can update this data from other threads.. hence the easily accessible lts lock. The crash isn't a null deref so it's not entirely clear what's going wrong, but acquiring the standard lts lock should hopefully fix it.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=eeaa0842d203

Comment 2

[Jim Mathies [:jimm]]

This lock is request during calls to CompositorParent::CompositeToTarget when the thread is down in a AutoResolveRefLayers, afaict this looks safe - 

http://mxr.mozilla.org/mozilla-central/source/gfx/layers/ipc/CompositorParent.cpp#1024

Comment 3

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/938c7a3c65e4

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/938c7a3c65e4

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/938c7a3c65e4

Comment 6

[Jim Mathies [:jimm]]

Looks good, last report was for the 20151019 build.

https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Alayers%3A%3ACompositorParent%3A%3AUpdatePluginWindowState#tab-reports

Comment 7

[Firefox Bug Husbandry Bot]

Moving from Core::Untriaged to Core::General https://bugzilla.mozilla.org/show_bug.cgi?id=1407598