1237246 - Gecko crashes in ProtocolUtils.cpp

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Thomas Zimmermann [:tzimmermann] [:tdz]]

Gecko crashes on Firefox OS when switching from login screen to home screen.

m-c rev: 278584:9d6ffc7a08b6

STR:

  - build FxOS with debugging enabled
  - flash and boot
  - switch to home screen

Result

  - Gecko crashes with an IPC error

Expected:

  - Home screen is shown

Stack:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 305.842]
0xb304bc20 in mozilla::ipc::FatalError (aProtocolName=0xb50f6e45 "PLayerTransactionParent", aMsg=<optimized out>, aOtherPid=<optimized out>, aIsParent=<optimized out>)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/glue/ProtocolUtils.cpp:329
329         MOZ_CRASH("IPC FatalError in the parent process!");
(gdb) bt
#0  0xb304bc20 in mozilla::ipc::FatalError (aProtocolName=0xb50f6e45 "PLayerTransactionParent", aMsg=<optimized out>, aOtherPid=<optimized out>, aIsParent=<optimized out>)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/glue/ProtocolUtils.cpp:329
#1  0xb30c18c0 in Read (iter__=0xae1ffb78, msg__=0xae1ffca4, v__=0xa1dd64f8, this=0xa2888000) at PLayerTransactionParent.cpp:4812
#2  mozilla::layers::PLayerTransactionParent::Read (this=0xa2888000, v__=0xa1dd64f8, msg__=0xae1ffca4, iter__=0xae1ffb78) at PLayerTransactionParent.cpp:4798
#3  0xb30c1956 in mozilla::layers::PLayerTransactionParent::Read (this=0xa2888000, v__=0xa1dd64f8, msg__=0xae1ffca4, iter__=0xae1ffb78) at PLayerTransactionParent.cpp:1301
#4  0xb30d0b92 in mozilla::layers::PLayerTransactionParent::Read (this=0xa2888000, v__=0xae1ffb80, msg__=0xae1ffca4, iter__=0xae1ffb78) at PLayerTransactionParent.cpp:2833
#5  0xb30d7206 in mozilla::layers::PLayerTransactionParent::OnMessageReceived (this=0xa2888000, msg__=...) at PLayerTransactionParent.cpp:648
#6  0xb3202f7e in mozilla::layers::PCompositorParent::OnMessageReceived (this=0xa2538c00, msg__=...) at PCompositorParent.cpp:515
#7  0xb304e196 in mozilla::ipc::MessageChannel::DispatchAsyncMessage (this=0xa2538c38, aMsg=...)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/glue/MessageChannel.cpp:1384
#8  0xb30518ee in mozilla::ipc::MessageChannel::DispatchMessage (this=0xa2538c38, aMsg=...)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/glue/MessageChannel.cpp:1304
#9  0xb305790e in mozilla::ipc::MessageChannel::OnMaybeDequeueOne (this=0xa2538c38)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/glue/MessageChannel.cpp:1275
#10 0xb2e13d7e in details::CallMethod<, FdWatcher, void (FdWatcher::*)()>(mozilla::IndexSequence<>, FdWatcher*, void (FdWatcher::*)(), mozilla::Tuple<>&) (obj=<optimized out>, 
    method=(void (FdWatcher::*)(FdWatcher * const)) 0xb305789d <mozilla::ipc::MessageChannel::OnMaybeDequeueOne()>, arg=...)
    at ../../../../hg.mozilla.org/mozilla-central/ipc/chromium/src/base/task.h:28
#11 0xb2e13da2 in DispatchTupleToMethod<FdWatcher, void (FdWatcher::*)()> (arg=<optimized out>, method=
    (void (FdWatcher::*)(FdWatcher * const)) 0xb305789d <mozilla::ipc::MessageChannel::OnMaybeDequeueOne()>, obj=0xa2538c38)
    at ../../../../hg.mozilla.org/mozilla-central/ipc/chromium/src/base/task.h:46
#12 RunnableMethod<FdWatcher, void (FdWatcher::*)(), mozilla::Tuple<> >::Run() (this=<optimized out>)
    at ../../../../hg.mozilla.org/mozilla-central/ipc/chromium/src/base/task.h:307
#13 0xb304a268 in Run (this=<optimized out>) at ../../dist/include/mozilla/ipc/MessageChannel.h:472
#14 mozilla::ipc::MessageChannel::DequeueTask::Run (this=<optimized out>) at ../../dist/include/mozilla/ipc/MessageChannel.h:489
#15 0xb3033ec0 in MessageLoop::RunTask (this=0xae1ffdf0, task=0xa85d0fe0)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/message_loop.cc:364
#16 0xb3036d66 in MessageLoop::DeferOrRunPendingTask (this=<optimized out>, pending_task=<optimized out>)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/message_loop.cc:372
#17 0xb3038c38 in DoWork (this=<optimized out>) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/message_loop.cc:459
#18 MessageLoop::DoWork (this=0xae1ffdf0) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/message_loop.cc:438
#19 0xb30347c4 in base::MessagePumpDefault::Run (this=0xae7ef9a0, delegate=0xae1ffdf0)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/message_pump_default.cc:34
#20 0xb3034740 in MessageLoop::RunInternal (this=0xae1ffdf0) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/message_loop.cc:234
#21 0xb303475a in RunHandler (this=0xae1ffdf0) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/message_loop.cc:227
#22 MessageLoop::Run (this=0xae1ffdf0) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/message_loop.cc:201
#23 0xb303a9da in base::Thread::ThreadMain (this=0xae7d67c0) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/thread.cc:172
#24 0xb3038f1c in ThreadFunc (closure=<optimized out>) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/platform_thread_posix.cc:36
#25 0xb6e36ba4 in __thread_entry (func=0xb3038f15 <ThreadFunc(void*)>, arg=0xae7d67c0, tls=0xae1fff00) at bionic/libc/bionic/pthread_create.cpp:92
#26 0xb6e36d20 in pthread_create (thread_out=0xae7d67c8, attr=<optimized out>, start_routine=0x78, arg=0xae7d67c0) at bionic/libc/bionic/pthread_create.cpp:201
#27 0x00000000 in ?? ()

Comment 1

[Thomas Zimmermann [:tzimmermann] [:tdz]]

Seems to be a graphics problem. From the file names, it could be related to bug 1221056.

Comment 2

[Nicolas Silva [:nical]]

Yes, looks like it's a dupe of bug 1221056 but the stack trace here is very helpful, thanks! Bug 1221056 just got backed out from central so we should be fine now, and I think I have a fix for this. Strange that the tests running on the emulators didn't catch this, though.

Comment 4

[Nicolas Silva [:nical]]

See bug 1221056.