1260517 - Crash in mozilla::layers::ShadowLayerForwarder::EndTransaction when GLContext is disabled

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[A. Wilcox [:awilfox]]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Build ID: 20160326005349

Steps to reproduce:

This crash occasionally happens on YouTube, but I can always reproduce it visiting http://www.usatoday.com/story/life/movies/2016/03/29/oscar-winning-former-child-star-patty-duke-dies-age-69/82382666/


With gfx.crash-guard.status.glcontext: 2, I do not have any crash.
With gfx.crash-guard.status.glcontext: 3, I have a crash every time.


Application Basics
------------------

Name: Firefox
Version: 45.0.1
Build ID: 20160326005349
User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Multiprocess Windows: 0/3 (default: false)
Safe Mode: false

Extensions
----------

Name: CacheViewer
Version: 0.8.6.3.1-let-fixed
Enabled: true
ID: {71328583-3CA7-4809-B4BA-570A85818FBB}

Name: FindBar Tweak
Version: 2.1.9
Enabled: true
ID: fbt@quicksaver

Name: Firebug
Version: 2.0.15
Enabled: true
ID: [e-mail]

Name: Flashblock
Version: 1.5.20
Enabled: true
ID: {3d7eb24f-2740-49df-8937-200b1cc08f8a}

Name: Google Music Scrobbler
Version: 0.8.6.8-beta
Enabled: true
ID: jid1-rbAJu4BHjMqTww@jetpack

Name: Modify Headers
Version: 0.7.1.1.1-signed
Enabled: true
ID: {b749fc7c-e949-447f-926c-3f4eed6accfe}

Name: SQLite Manager
Version: 0.8.3.1-signed
Enabled: true
ID: [e-mail]

Name: Tab Groups
Version: 1.0.2
Enabled: true
ID: tabgroups@quicksaver

Name: Test Pilot
Version: 1.2.3.1-signed
Enabled: true
ID: [e-mail]

Name: uBlock
Version: 0.9.5.0.1-let-fixed
Enabled: true
ID: {2b10c1c8-a11f-4bad-fe9c-1c11e82cac42}

Graphics
--------

Adapter Description: X.Org -- Gallium 0.4 on AMD JUNIPER (DRM 2.43.0, LLVM 3.7.0)
Asynchronous Pan/Zoom: none
Device ID: Gallium 0.4 on AMD JUNIPER (DRM 2.43.0, LLVM 3.7.0)
Driver Version: 3.0 Mesa 11.1.0
GPU Accelerated Windows: 3/3 OpenGL (OMTC)
Supports Hardware H264 Decoding: No; Compiled without MP4 support.
Vendor ID: X.Org
WebGL Renderer: X.Org -- Gallium 0.4 on AMD JUNIPER (DRM 2.43.0, LLVM 3.7.0)
windowLayerManagerRemote: true
AzureCanvasBackend: cairo
AzureContentBackend: cairo
AzureFallbackCanvasBackend: none
AzureSkiaAccelerated: 0
CairoUseXRender: 1

Important Modified Preferences
------------------------------

accessibility.typeaheadfind.casesensitive: 1
accessibility.typeaheadfind.flashBar: 0
browser.cache.disk.capacity: 358400
browser.cache.disk.filesystem_reported: 1
browser.cache.disk.hashstats_reported: 1
browser.cache.disk.smart_size_cached_value: 358400
browser.cache.disk.smart_size.first_run: false
browser.cache.disk.smart_size.use_old_max: false
browser.cache.frecency_experiment: 1
browser.download.importedFromSqlite: true
browser.fixup.domainwhitelist.184.174.122.171: true
browser.fixup.domainwhitelist.ai: true
browser.link.open_newwindow: 1
browser.places.smartBookmarksVersion: 7
browser.search.useDBForOrder: true
browser.sessionstore.upgradeBackup.latestBuildID: 20160326005349
browser.startup.homepage_override.buildID: 20160326005349
browser.startup.homepage_override.mstone: 45.0.1
browser.urlbar.doubleClickSelectsAll: false
browser.urlbar.formatting.enabled: false
browser.urlbar.trimURLs: false
dom.apps.reset-permissions: true
dom.mozApps.used: true
dom.w3c_touch_events.expose: false
extensions.lastAppVersion: 45.0.1
font.internaluseonly.changed: true
font.language.group: x-unicode
font.name.monospace.x-unicode: Source Code Pro
font.name.monospace.x-western: Source Code Pro
gfx.crash-guard.glcontext.appVersion: 45.0.1
gfx.crash-guard.glcontext.deviceID: Gallium 0.4 on AMD JUNIPER (DRM 2.43.0, LLVM 3.7.0)
gfx.crash-guard.glcontext.driverVersion: 3.0 Mesa 11.1.0
gfx.crash-guard.status.glcontext: 2
keyword.URL: https://duckduckgo.com/?q=
media.gmp-gmpopenh264.abi: x86_64-gcc3
media.gmp-gmpopenh264.enabled: true
media.gmp-gmpopenh264.lastUpdate: 1451990255
media.gmp-gmpopenh264.version: 1.5.3
media.gmp-manager.buildID: 20160326005349
media.gmp-manager.lastCheck: 1459276567
media.webrtc.debug.aec_log_dir: /tmp
media.webrtc.debug.log_file: /tmp/WebRTC.log
network.cookie.prefsMigrated: true
network.predictor.cleaned-up: true
places.database.lastMaintenance: 1459043110
places.history.expiration.transient_current_max_pages: 104858
plugin.disable_full_page_plugin_for_types: application/pdf
plugin.importedState: true
plugin.state.flash: 1
plugin.state.java: 0
plugin.state.silverlight: 2
plugins.notifyMissingFlash: false
privacy.cpd.cache: false
privacy.cpd.cookies: false
privacy.cpd.downloads: false
privacy.cpd.formdata: false
privacy.cpd.history: false
privacy.donottrackheader.enabled: true
privacy.sanitize.migrateFx3Prefs: true
security.disable_button.openCertManager: false
security.disable_button.openDeviceManager: false
security.warn_viewing_mixed: false
services.sync.declinedEngines:
storage.vacuum.last.index: 1
storage.vacuum.last.places.sqlite: 1458136319

Important Locked Preferences
----------------------------

JavaScript
----------

Incremental GC: true

Accessibility
-------------

Activated: false
Prevent Accessibility: 0

Library Versions
----------------

NSPR
Expected minimum version: 4.12
Version in use: 4.12

NSS
Expected minimum version: 3.23 Basic ECC
Version in use: 3.23 Basic ECC

NSSSMIME
Expected minimum version: 3.23 Basic ECC
Version in use: 3.23 Basic ECC

NSSSSL
Expected minimum version: 3.23 Basic ECC
Version in use: 3.23 Basic ECC

NSSUTIL
Expected minimum version: 3.23
Version in use: 3.23

Experimental Features
---------------------

Sandbox
-------

Seccomp-BPF (System Call Filtering): true
Seccomp Thread Synchronisation: true
User Namespaces: false
Media Plugin Sandboxing: true


Actual results:

Crash Annotation GraphicsCriticalError: |[0][GFX1-]: GLContext is disabled due to a previous crash.[GFX1-]: GLContext is disabled due to a previous crash.
Crash Annotation GraphicsCriticalError: |[0][GFX1-]: GLContext is disabled due to a previous crash.|[1][GFX1-]: GLContext is disabled due to a previous crash.[GFX1-]: GLContext is disabled due to a previous crash.
Crash Annotation GraphicsCriticalError: |[0][GFX1-]: GLContext is disabled due to a previous crash.|[1][GFX1-]: GLContext is disabled due to a previous crash.|[2][GFX1-]: GLContext is disabled due to a previous crash.[GFX1-]: GLContext is disabled due to a previous crash.
Crash Annotation GraphicsCriticalError: |[0][GFX1-]: GLContext is disabled due to a previous crash.|[1][GFX1-]: GLContext is disabled due to a previous crash.|[2][GFX1-]: GLContext is disabled due to a previous crash.|[3][GFX1-]: GLContext is disabled due to a previous crash.[GFX1-]: GLContext is disabled due to a previous crash.
Crash Annotation GraphicsCriticalError: |[0][GFX1-]: GLContext is disabled due to a previous crash.|[1][GFX1-]: GLContext is disabled due to a previous crash.|[2][GFX1-]: GLContext is disabled due to a previous crash.|[3][GFX1-]: GLContext is disabled due to a previous crash.|[4][GFX1-]: GLContext is disabled due to a previous crash.[GFX1-]: GLContext is disabled due to a previous crash.
Crash Annotation GraphicsCriticalError: |[0][GFX1-]: GLContext is disabled due to a previous crash.|[1][GFX1-]: GLContext is disabled due to a previous crash.|[2][GFX1-]: GLContext is disabled due to a previous crash.|[3][GFX1-]: GLContext is disabled due to a previous crash.|[4][GFX1-]: GLContext is disabled due to a previous crash.|[5][GFX1-]: GLContext is disabled due to a previous crash.[GFX1-]: GLContext is disabled due to a previous crash.
[16029] ###!!! ABORT: X_GLXDestroyPixmap: GLXBadPixmap; 643 requests ago: file /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/toolkit/xre/nsX11ErrorHandler.cpp, line 157
[16029] ###!!! ABORT: X_GLXDestroyPixmap: GLXBadPixmap; 643 requests ago: file /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/toolkit/xre/nsX11ErrorHandler.cpp, line 157

Thread 1 "firefox" received signal SIGSEGV, Segmentation fault.
mozalloc_abort (msg=<optimized out>) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/memory/mozalloc/mozalloc_abort.cpp:33
33      /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/memory/mozalloc/mozalloc_abort.cpp: No such file or directory.
(gdb) bt
#0  mozalloc_abort (msg=<optimized out>) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/memory/mozalloc/mozalloc_abort.cpp:33
#1  0x00007ffff2cfce27 in Abort (aMsg=0x0) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/xpcom/base/nsDebugImpl.cpp:452
#2  0x00007ffff2cfcd59 in NS_DebugBreak (aSeverity=<optimized out>, aStr=<optimized out>, aExpr=<optimized out>, aFile=<optimized out>, aLine=<optimized out>) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/xpcom/base/nsDebugImpl.cpp:404
#3  0x00007ffff49e80fb in X11Error (display=<optimized out>, event=<optimized out>) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/toolkit/xre/nsX11ErrorHandler.cpp:157
#4  0x00007fffec360d4d in _XError (dpy=dpy@entry=0x7ffff6cec000, rep=rep@entry=0x7fffbb6408b0) at /var/tmp/portage/x11-libs/libX11-1.6.3/work/libX11-1.6.3/src/XlibInt.c:1429
#5  0x00007fffec35dc97 in handle_error (dpy=0x7ffff6cec000, err=0x7fffbb6408b0, in_XReply=<optimized out>) at /var/tmp/portage/x11-libs/libX11-1.6.3/work/libX11-1.6.3/src/xcb_io.c:213
#6  0x00007fffec35dd55 in handle_response (dpy=dpy@entry=0x7ffff6cec000, response=0x7fffbb6408b0, in_XReply=in_XReply@entry=0) at /var/tmp/portage/x11-libs/libX11-1.6.3/work/libX11-1.6.3/src/xcb_io.c:325
#7  0x00007fffec35e705 in _XEventsQueued (dpy=0x7ffff6cec000, mode=<optimized out>) at /var/tmp/portage/x11-libs/libX11-1.6.3/work/libX11-1.6.3/src/xcb_io.c:364
#8  0x00007fffec34065a in XFlush (dpy=0x7ffff6cec000) at /var/tmp/portage/x11-libs/libX11-1.6.3/work/libX11-1.6.3/src/Flush.c:39
#9  0x00007ffff353a241 in mozilla::layers::ShadowLayerForwarder::EndTransaction (this=0x7fffcb964e80, aReplies=<optimized out>, aRegionToClear=..., aId=<optimized out>, aScheduleComposite=<optimized out>, aPaintSequenceNumber=<optimized out>, 
    aIsRepeatTransaction=<error reading variable: Cannot access memory at address 0xa>, aTransactionStart=..., aSent=<optimized out>) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/gfx/layers/ipc/ShadowLayers.cpp:530
#10 0x00007ffff34f9220 in mozilla::layers::ClientLayerManager::ForwardTransaction (this=0x7fffb801f780, aScheduleComposite=true) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/gfx/layers/client/ClientLayerManager.cpp:607
#11 0x00007ffff34f90a0 in mozilla::layers::ClientLayerManager::EndTransaction (this=0x7fffb801f780, aCallback=
    0x7ffff44808ba <mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*)>, aCallbackData=0x7fffffffbac0, aFlags=mozilla::layers::LayerManager::END_DEFAULT) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/gfx/layers/client/ClientLayerManager.cpp:326
#12 0x00007ffff44c4a86 in nsDisplayList::PaintRoot (this=<optimized out>, aBuilder=0x7fffffffbac0, aCtx=<optimized out>, aFlags=<optimized out>) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/layout/base/nsDisplayList.cpp:1753
#13 0x00007ffff44e636c in nsLayoutUtils::PaintFrame (aRenderingContext=0x0, aFrame=<optimized out>, aDirtyRegion=..., aBackstop=<optimized out>, aFlags=<optimized out>) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/layout/base/nsLayoutUtils.cpp:3389
#14 0x00007ffff45006d2 in PresShell::Paint (this=0x7fffb5d18c00, aViewToPaint=<optimized out>, aDirtyRegion=..., aFlags=1) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/layout/base/nsPresShell.cpp:6105
#15 0x00007ffff42f0324 in nsViewManager::ProcessPendingUpdatesPaint (this=0x7fffb5eae040, aWidget=0x7fffcd09f280) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/view/nsViewManager.cpp:467
#16 0x00007ffff42f0153 in nsViewManager::ProcessPendingUpdatesForView (this=0x7fffb5eae040, aView=<optimized out>, aFlushDirtyRegion=<optimized out>) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/view/nsViewManager.cpp:398
#17 0x00007ffff4469325 in nsRefreshDriver::Tick (this=0x7fffb5d12c00, aNowEpoch=<optimized out>, aNowTime=...) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/layout/base/nsRefreshDriver.cpp:1857
#18 0x00007ffff446aea2 in mozilla::RefreshDriverTimer::TickRefreshDrivers (this=0x0, aJsNow=1459276195004620, aNow=..., aDrivers=...) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/layout/base/nsRefreshDriver.cpp:236
#19 0x00007ffff446adbe in mozilla::RefreshDriverTimer::Tick (this=0x7fffd4e86ba0, jsnow=1459276195004620, now=...) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/layout/base/nsRefreshDriver.cpp:255
#20 0x00007ffff446b5f0 in nsRunnableMethodArguments<mozilla::TimeStamp>::apply<mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver, void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp)> (o=<optimized out>, this=<optimized out>, m=<optimized out>)
    at ../../dist/include/nsThreadUtils.h:676
#21 nsRunnableMethodImpl<void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(mozilla::TimeStamp), true, mozilla::TimeStamp>::Run (this=0xa) at ../../dist/include/nsThreadUtils.h:870
#22 0x00007ffff2d43915 in nsThread::ProcessNextEvent (this=0x7ffff6cc2940, aMayWait=<optimized out>, aResult=0x7fffffffc5ef) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/xpcom/threads/nsThread.cpp:972
#23 0x00007ffff2d61cf9 in NS_ProcessNextEvent (aThread=<optimized out>, aMayWait=false) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/xpcom/glue/nsThreadUtils.cpp:297
#24 0x00007ffff2fb9f79 in mozilla::ipc::MessagePump::Run (this=0x7fffe4118540, aDelegate=0x7ffff6c7f500) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/ipc/glue/MessagePump.cpp:95
#25 0x00007ffff2f78025 in MessageLoop::RunInternal (this=0xa) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/ipc/chromium/src/base/message_loop.cc:234
#26 MessageLoop::RunHandler (this=<optimized out>) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/ipc/chromium/src/base/message_loop.cc:227
#27 MessageLoop::Run (this=0xa) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/ipc/chromium/src/base/message_loop.cc:201
#28 0x00007ffff4305937 in nsBaseAppShell::Run (this=0x7fffdcf03b20) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/widget/nsBaseAppShell.cpp:156
#29 0x00007ffff49a98a2 in nsAppStartup::Run (this=0x7fffdcf3e3d0) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/toolkit/components/startup/nsAppStartup.cpp:281
#30 0x00007ffff49e3358 in XREMain::XRE_mainRun (this=<optimized out>) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/toolkit/xre/nsAppRunner.cpp:4296
#31 0x00007ffff49e361c in XREMain::XRE_main (this=0x7fffffffc8a8, argc=<optimized out>, argv=<optimized out>, aAppData=<optimized out>) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/toolkit/xre/nsAppRunner.cpp:4382
#32 0x00007ffff49e38cb in XRE_main (argc=-146204256, argv=0xa, aAppData=0x7ffff74919a0 <_IO_stdfile_2_lock>, aFlags=<optimized out>) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/toolkit/xre/nsAppRunner.cpp:4484
#33 0x0000000000404f57 in do_main (argc=<optimized out>, argv=<optimized out>, xreDirectory=<optimized out>) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/browser/app/nsBrowserApp.cpp:212
#34 main (argc=<optimized out>, argv=<optimized out>) at /var/tmp/portage/www-client/firefox-45.0.1/work/firefox-45.0.1/browser/app/nsBrowserApp.cpp:352


Expected results:

No crash.

I have a coredump from gdb that I can email if necessary, but as it most likely contains my private session information, I would prefer not to attach it publicly.

Comment 1

[u279076]

Crashes are still being reported for this on average 20 times a day.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'mozilla::layers::ShadowLayerForwarder::EndTransaction':
 - nightly(version 50):1 crash from 2016-06-06.
 - aurora (version 49):0 crashes from 2016-06-07.
 - beta   (version 48):29 crashes from 2016-06-06.
 - release(version 47):70 crashes from 2016-05-31.
 - esr    (version 45):3 crashes from 2016-04-07.

Crash volume on the last weeks:
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       0       0       0       0       1       0       0
 - aurora        0       0       0       0       0       0       0
 - beta          8       4       0       2       8       4       3
 - release      13       9       8       4      10      12      11
 - esr           0       0       1       0       0       0       1

Affected platforms: Windows, Mac OS X

Comment 3

[Peter Chang[:pchang]]

I saw lots of crashes from nightly 52 recently.

Firefox 	52.0a1 	246 	87.9% 	94
Firefox 	49.0.1 	12 	4.3% 	12

Comment 4

[Ethan Lin[:ethlin]]

Attachment: check ShadowManager

From the crash report[1], it looks like we got nullptr for GetTextureForwarder(). From code, it's possible to get nullptr from GetTextureForwarder() if mShadowManager is nullptr and we do the check just right after the crash line. So I think we may need to check HasShadowManager too before GetTextureForwarder().

[1] https://crash-stats.mozilla.org/report/index/d3c5600a-5603-49a8-b22e-eb1352161010#tab-details

Comment 5

[Nicolas Silva [:nical]]

Comment on attachment 8799617 [details] [diff] [review]
check ShadowManager

Review of attachment 8799617 [details] [diff] [review]:
-----------------------------------------------------------------

This is a bit redundant with a patch in bug 1088300 which handles the same crash higher up the stack (prevents ClientLayerManager from doing EndTransaction if ipc is not up and running).
This extra check can't hurt, but if you want to add it please put it at the very beginning of this method and add an assertion that crashes debug build (we really should not get in this state, and preferably handle it in at the LayerManager level, so let's make sure we notice when a debug build runs into this).

Comment 6

[Ethan Lin[:ethlin]]

Attachment: check HasShadowManager

I put move the HasShadowManager check and assertion at the beginning of the function and remove other redundant checks in that function.

Comment 7

[Nicolas Silva [:nical]]

Comment on attachment 8799693 [details] [diff] [review]
check HasShadowManager

Review of attachment 8799693 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/layers/ipc/ShadowLayers.cpp
@@ +570,5 @@
>  {
>    *aSent = false;
>  
> +  MOZ_ASSERT(HasShadowManager(), "no manager to forward to");
> +  if (!HasShadowManager()) {

Might as well check IPCOpen() here (which will check both HasShadowManager and mShadowManager->IPCOpen()), and further simplify the branches near SendUpdate.

Comment 8

[Ethan Lin[:ethlin]]

(In reply to Nicolas Silva [:nical] from comment #7)
> Comment on attachment 8799693 [details] [diff] [review]
> check HasShadowManager
> 
> Review of attachment 8799693 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> ::: gfx/layers/ipc/ShadowLayers.cpp
> @@ +570,5 @@
> >  {
> >    *aSent = false;
> >  
> > +  MOZ_ASSERT(HasShadowManager(), "no manager to forward to");
> > +  if (!HasShadowManager()) {
> 
> Might as well check IPCOpen() here (which will check both HasShadowManager
> and mShadowManager->IPCOpen()), and further simplify the branches near
> SendUpdate.

Okay!

Comment 9

[Ethan Lin[:ethlin]]

Attachment: check HasShadowManager (carry r+: nical)

Address nical's comment.

Comment 10

[Ethan Lin[:ethlin]]

try result:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=798fd8019969

Comment 11

[Ethan Lin[:ethlin]]

Attachment: check HasShadowManager (carry r+: nical)

Correct the patch.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/42ef5d8cd777
Check HasShadowManager in the ShadowLayerForwarder::EndTransaction. r=nical

Comment 13

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/42ef5d8cd777

Comment 14

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Hi Ethan, the data from Nightly looks promising, this crash seems gone since this patch landed. Should we uplift this to Beta50, Aurora51 (despite the low volume)?

Comment 15

[Ethan Lin[:ethlin]]

Per comment 5, the fix in bug 1088300 handles the same crash at the higher stack. If we'll uplift the patch in bug 1088300, I think we don't need to uplift this one.
nical, will you uplift bug 1088300 to beta/aurora? Do you think we should uplift this one too?

Comment 16

[Nicolas Silva [:nical]]

I asked for an uplift of bug bug 1088300 (thanks for the reminder), I don't have a string opinion about uplifting this one. It won't be necessary but the patch is super simple so there's no risk associated to it. As you prefer.

Comment 17

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'mozilla::layers::ShadowLayerForwarder::EndTransaction':
 - nightly (version 52): 492 crashes from 2016-09-19.
 - aurora  (version 51): 0 crashes from 2016-09-19.
 - beta    (version 50): 18 crashes from 2016-09-20.
 - release (version 49): 54 crashes from 2016-09-05.
 - esr     (version 45): 1 crash from 2016-07-25.

Crash volume on the last weeks (Week N is from 10-17 to 10-23):
            W. N-1  W. N-2  W. N-3  W. N-4
 - nightly     116     253     114       0
 - aurora        0       0       0       0
 - beta          1      11       6       0
 - release      19       8      15       7
 - esr           0       0       1       0

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly           #18
 - aurora
 - beta    #13369
 - release #2514     #4018
 - esr