1241484 - crash in mozilla::layers::TextureChild::WaitForCompositorRecycle | mozilla::layers::CanvasClientSharedSurface::Updated

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Ada [:adalucinet]]

This bug was filed from the Socorro interface and is 
report bp-b47d4745-f19a-43aa-83dc-317a02160121.
=============================================================
Reproducible with 44.0RC build 2 (Build ID: 20160120154102), 44 beta 9 (Build ID: 20160114165817), latest Aurora 45.0a2 and Nightly 46.0a1 (from 2016-01-20) *only* with e10s disabled
Affected platforms: Mac OS X 10.9.5, Windows 8.1 64-bit and Windows 10 32-bit

Steps to reproduce:
1. Launch Firefox.
2. In a new tab, navigate to https://www.google.com/maps/
3. Drag the tab from step 2 in a new window
4. Drag it back to the main window.

Additional notes:
1. Reproduced also with a different signature: bp-ad2f8d08-350a-4d44-b6b5-9972e2160121
2. Unable to reproduce under Ubuntu 14.04 32-bit	
3. Crash signature for Mac OS X: bp-f2e8e462-e39e-40dd-b479-929032160121
4. Also reproducible with 43.0a1 from 2015-09-01 → bp-ce987fe8-ca42-4822-a700-1e32d2160121; will investigate further for the regression range.
5. More reports: https://crash-stats.mozilla.com/signature/?signature=mozilla%3A%3Alayers%3A%3ATextureChild%3A%3AWaitForCompositorRecycle+|+mozilla%3A%3Alayers%3A%3ACanvasClientSharedSurface%3A%3AUpdated&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&page=1#reports

Comment 1

[u279076]

I think these are all different issues. The stacks are all very different and the data shows different starting points. Please confirm which of these you can reproduce these in Firefox 43.0.4 and file separate bug reports for each.

Comment 2

[Ada [:adalucinet]]

(In reply to Anthony Hughes, QA Mentor (:ashughes) from comment #1)
> I think these are all different issues. The stacks are all very different
> and the data shows different starting points. Please confirm which of these
> you can reproduce these in Firefox 43.0.4 and file separate bug reports for
> each.

Sure - filed separate reports as it follows:
* For the signature from Additional notes 1, logged bug 1241861
* For the Mac OS X crash - Additional notes 3 - there was already bug 1217128 - fixed by bug 1207220 on 45 and 46 branch and wontfix for 44; but with latest Aurora 45.0a2 and Nightly 46.0a1 encountered bug 1241875
* With latest Aurora 45.0a2, under Windows 7 64-bit, also encountered shutdown crash bug 1241876.

fyi: additional results are available via https://goo.gl/oKwWGM

Comment 3

[Alice0775 White]

Reproducible: 100% always with new profile (disabled e10s)

Steps to reproduce:
1. Launch Firefox with *newly* created profile and *disable* e10s and restart
2. In a new tab, open https://www.google.com/maps/
3. Drag the tab from step 2 in a new window
4. Drag it back to the main window.
(optionally)
5. Repeat Stap 3 and 4 if necessary
6. Quit browser

Actual Results:
Crash
41 bp-160edb50-24d3-44f7-893a-05ed22160123
42 bp-a2d5b1dc-2e8b-4240-8b6d-eeaec2160123
43 bp-6c3df9f0-c897-4d0f-bbbd-90e5a2160123
44.0rc build2 bp-addc241a-d86b-4cc0-94f9-38ec22160123
45.0a2 bp-9d676557-add7-4539-94fa-4e4072160123 (*crash when quit brower)
46.0a1 bp-bacc1bab-314f-4df1-b923-934652160123 (*crash when quit brower)

Expected Results:
Not crash

Regression window:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c7720cbbe62e&tochange=c4d1692d88ee

Regressed by: c4d1692d88ee	Jeff Gilbert — Bug 1144906 - Add accel E10S backend for WebGL compositing. - r=jrmuizel,mattwoodrow,nical,sotaro

Comment 4

[Alice0775 White]

45.0a1 bp-1b632fe5-1864-4d71-87c1-49b492160123
46.0a2 bp-8e13c38d-881f-4467-aab9-f80762160123

Comment 5

[Matt Woodrow (:mattwoodrow)]

Attachment: Null check mActor

This was a little non-obvious. LTCG has allowed the compiler to inline TextureClient::WaitForCompositorRecycle.

We null check mFront in CanvasClientSharedSurface::Updated(), but we don't null check mActor in TextureClient::WaitForCompositorRecycle.

This allows us to get into TextureChild::WaitForCompositorRecycle with this==nullptr.

Comment 6

[Nicolas Silva [:nical]]

Comment on attachment 8712007 [details] [diff] [review]
Null check mActor

Review of attachment 8712007 [details] [diff] [review]:
-----------------------------------------------------------------

Nice catch

Comment 7

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b5ce638ed18b

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/b5ce638ed18b

Comment 9

[Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)]

Carryover regression triage: fixed in 47, too late for 46.

Comment 10

[Kelsey Gilbert [:jgilbert]]

As part of bug 1224199:
https://hg.mozilla.org/releases/mozilla-esr45/rev/e762153577ab

Comment 11

[Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)]

Thanks Jeff. This should be in today's esr build and release next week.