1239698 - mozilla::ipc::FatalError crash in mozilla::dom::PScreenManagerChild::Read

Status: RESOLVED WORKSFORME

(Core :: IPC, defect)

Description

[Robert Kaiser]

This bug was filed from the Socorro interface and is 
report bp-060a01c9-1cf4-4a03-978d-090e52160107.
=============================================================

Top Stack Frames:
0 	mozglue.dll 	mozalloc_abort(char const* const) 	memory/mozalloc/mozalloc_abort.cpp
1 	xul.dll 	NS_DebugBreak 	xpcom/base/nsDebugImpl.cpp
2 	xul.dll 	mozilla::ipc::FatalError(char const*, char const*, unsigned long, bool) 	ipc/glue/ProtocolUtils.cpp
3 	xul.dll 	mozilla::dom::PScreenManagerChild::Read(mozilla::dom::ScreenDetails*, IPC::Message const*, void**) 	obj-firefox/ipc/ipdl/PScreenManagerChild.cpp
4 	xul.dll 	mozilla::dom::PScreenManagerChild::SendScreenForBrowser(mozilla::dom::IdType<mozilla::dom::TabParent> const&, mozilla::dom::ScreenDetails*, bool*) 	obj-firefox/ipc/ipdl/PScreenManagerChild.cpp
5 	xul.dll 	nsScreenManagerProxy::ScreenForNativeWidget(void*, nsIScreen**) 	widget/nsScreenManagerProxy.cpp
6 	xul.dll 	nsDeviceContext::FindScreen(nsIScreen**) 	gfx/src/nsDeviceContext.cpp
7 	xul.dll 	nsDeviceContext::ComputeFullAreaUsingScreen(nsRect*) 	gfx/src/nsDeviceContext.cpp
8 	xul.dll 	nsDeviceContext::GetDeviceSurfaceDimensions(int&, int&) 	gfx/src/nsDeviceContext.cpp
[...]

This has been one of the top 5 crashes on Developer Edition for a while, it's a crash in the content process.

Comment 1

[Jim Mathies [:jimm]]

Unfortunately we only record an error string if the fatal error happen in the parent -
 
http://hg.mozilla.org/releases/mozilla-aurora/annotate/7e1284abc473/ipc/glue/ProtocolUtils.cpp#l317

so no additional error info here.

Comment 2

[Robert Kaiser]

Can we get error strings like that to be sent in client crashes as well?

Comment 3

[George Wright (:gw280) (needinfo me!)]

Needinfoing myself for further investigation

Comment 4

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

bp-060a01c9-1cf4-4a03-978d-090e52160107 indicates line 557 of PScreenManagerChild.cpp; in my tree:

    556     if ((!(Read((&((v__)->id())), msg__, iter__)))) {
    557         FatalError("Error deserializing 'id' (uint32_t) member of 'ScreenDetails'");
    558         return false;
    559     }

We'd only fail to deserialize a uint32_t if there were an unexpected end of the message.  This might be related to the other sync IPC FatalError bugs?

Comment 5

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

I'll take this. I've been looking into a bunch of these IPC bugs. I suspect they're all CPOW-related.

Comment 6

[George Wright (:gw280) (needinfo me!)]

Clearing my needinfo. I was investigating this, but when I asked billm for info he decided to take it as he thinks it's related to the work he's doing :)

Comment 7

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

This appears to be fixed on nightly. We may need some backports though.