Closed Bug 1268169 Opened 8 years ago Closed 8 years ago

OSX debug e10s mochitest-gl permacrashing [@ mozilla::layers::FixedSizeSmallShmemSectionAllocator::ShrinkShmemSectionHeap()]

Categories

(Core :: Graphics: Layers, defect)

48 Branch
Unspecified
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla49
Tracking Status
e10s + ---
firefox47 --- unaffected
firefox48 --- fixed
firefox49 --- fixed

People

(Reporter: RyanVM, Assigned: nical)

References

(Blocks 1 open bug)

Details

(Keywords: crash)

Attachments

(1 file, 1 obsolete file)

+++ This bug was initially created as a clone of Bug #1267455 +++

This got lost in the fray when bug 1267455 was filed, but it's still sticking around even after the assert was removed. Looking back at the history on Ash, M(gl) was always crashing like this without the assert, so I guess it's not a surprising result.

https://treeherder.mozilla.org/logviewer.html#?job_id=171654&repo=ash

09:37:58     INFO -  TEST-INFO | Main app process: exit 0
09:37:58     INFO -  runtests.py | Application ran for: 0:00:22.784779
09:37:58     INFO -  zombiecheck | Reading PID log: /var/folders/sw/56y5nypd5nvd19g5t_5x1crw00000w/T/tmpdq2S95pidlog
09:37:58     INFO -  mozcrash Copy/paste: /builds/slave/test/build/macosx64-minidump_stackwalk /var/folders/sw/56y5nypd5nvd19g5t_5x1crw00000w/T/tmp1lEQ08.mozrunner/minidumps/24D33B98-BE40-48F0-B318-581BF016B4BE.dmp /builds/slave/test/build/symbols
09:38:10     INFO -  mozcrash Saved minidump as /builds/slave/test/build/blobber_upload_dir/24D33B98-BE40-48F0-B318-581BF016B4BE.dmp
09:38:10     INFO -  mozcrash Saved app info as /builds/slave/test/build/blobber_upload_dir/24D33B98-BE40-48F0-B318-581BF016B4BE.extra
09:38:10  WARNING -  PROCESS-CRASH | Main app process exited normally | application crashed [@ mozilla::layers::FixedSizeSmallShmemSectionAllocator::ShrinkShmemSectionHeap()]
09:38:10     INFO -  Crash dump filename: /var/folders/sw/56y5nypd5nvd19g5t_5x1crw00000w/T/tmp1lEQ08.mozrunner/minidumps/24D33B98-BE40-48F0-B318-581BF016B4BE.dmp
09:38:10     INFO -  Operating system: Mac OS X
09:38:10     INFO -                    10.10.5 14F27
09:38:10     INFO -  CPU: amd64
09:38:10     INFO -       family 6 model 69 stepping 1
09:38:10     INFO -       4 CPUs
09:38:10     INFO -  Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
09:38:10     INFO -  Crash address: 0xebfe004
09:38:10     INFO -  Process uptime: 21 seconds
09:38:10     INFO -  Thread 0 (crashed)
09:38:10     INFO -   0  XUL!mozilla::layers::FixedSizeSmallShmemSectionAllocator::ShrinkShmemSectionHeap() [Atomics.h:ab0044bfa1df : 416 + 0x0]
09:38:10     INFO -      rax = 0x000000010ebfe000   rdx = 0x0000000106e00118
09:38:10     INFO -      rcx = 0x000000011be01680   rbx = 0x000000011bcf2d80
09:38:10     INFO -      rsi = 0x000000011be016c8   rdi = 0x000000011bcf2d80
09:38:10     INFO -      rbp = 0x00007fff5fbfcaa0   rsp = 0x00007fff5fbfca70
09:38:10     INFO -       r8 = 0x29002583ee6d50f4    r9 = 0xfffffffffffff000
09:38:10     INFO -      r10 = 0x0000000106e00119   r11 = 0x0000000000002008
09:38:10     INFO -      r12 = 0x0000000000000000   r13 = 0x00000001127f5940
09:38:10     INFO -      r14 = 0x0000000000000000   r15 = 0x00000001050b3e33
09:38:10     INFO -      rip = 0x00000001013a3c6c
09:38:10     INFO -      Found by: given as instruction pointer in context
09:38:10     INFO -   1  XUL!mozilla::layers::ShadowLayerForwarder::~ShadowLayerForwarder() [ShadowLayers.cpp:ab0044bfa1df : 219 + 0x8]
09:38:10     INFO -      rbx = 0x000000011bef2c10   rbp = 0x00007fff5fbfcad0
09:38:10     INFO -      rsp = 0x00007fff5fbfcab0   r12 = 0x000000010e828000
09:38:10     INFO -      r13 = 0x00007fff5fbfd320   r14 = 0x00000001127f5940
09:38:10     INFO -      r15 = 0x000000011b8c1bf0   rip = 0x00000001013a493e
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -   2  XUL!mozilla::layers::ShadowLayerForwarder::~ShadowLayerForwarder() [ShadowLayers.cpp:ab0044bfa1df : 378 + 0x5]
09:38:10     INFO -      rbx = 0x000000011b8c1bf0   rbp = 0x00007fff5fbfcaf0
09:38:10     INFO -      rsp = 0x00007fff5fbfcae0   r12 = 0x000000010e828000
09:38:10     INFO -      r13 = 0x00007fff5fbfd320   r14 = 0x000000011b8c1bf0
09:38:10     INFO -      r15 = 0x000000011b8c1c08   rip = 0x00000001013a4eae
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -   3  XUL!mozilla::AtomicRefCountedWithFinalize<mozilla::layers::ISurfaceAllocator>::Release() [AtomicRefCountedWithFinalize.h:ab0044bfa1df : 148 + 0xe]
09:38:10     INFO -      rbx = 0x000000011b8c1bf8   rbp = 0x00007fff5fbfce40
09:38:10     INFO -      rsp = 0x00007fff5fbfcb00   r12 = 0x000000010e828000
09:38:10     INFO -      r13 = 0x00007fff5fbfd320   r14 = 0x000000011b8c1bf0
09:38:10     INFO -      r15 = 0x000000011b8c1c08   rip = 0x0000000101295e76
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -   4  XUL!mozilla::layers::TextureClient::~TextureClient() [RefPtr.h:ab0044bfa1df : 39 + 0x9]
09:38:10     INFO -      rbx = 0x000000010ef563a0   rbp = 0x00007fff5fbfce60
09:38:10     INFO -      rsp = 0x00007fff5fbfce50   r12 = 0x000000010e828000
09:38:10     INFO -      r13 = 0x00007fff5fbfd320   r14 = 0x0000000134bcddf0
09:38:10     INFO -      r15 = 0x000000010ef563b8   rip = 0x000000010133a9e5
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -   5  XUL!mozilla::layers::SharedSurfaceTextureClient::~SharedSurfaceTextureClient() [TextureClientSharedSurface.cpp:ab0044bfa1df : 159 + 0x8]
09:38:10     INFO -      rbx = 0x000000010ef563a0   rbp = 0x00007fff5fbfce80
09:38:10     INFO -      rsp = 0x00007fff5fbfce70   r12 = 0x000000010e828000
09:38:10     INFO -      r13 = 0x00007fff5fbfd320   r14 = 0x0000000134bcddf0
09:38:10     INFO -      r15 = 0x000000010ef563b8   rip = 0x0000000101340c6d
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -   6  XUL!mozilla::AtomicRefCountedWithFinalize<mozilla::layers::TextureClient>::Release() [AtomicRefCountedWithFinalize.h:ab0044bfa1df : 148 + 0xe]
09:38:10     INFO -      rbx = 0x000000010ef563a8   rbp = 0x00007fff5fbfd1d0
09:38:10     INFO -      rsp = 0x00007fff5fbfce90   r12 = 0x000000010e828000
09:38:10     INFO -      r13 = 0x00007fff5fbfd320   r14 = 0x000000010ef563a0
09:38:10     INFO -      r15 = 0x000000010ef563b8   rip = 0x0000000101296486
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -   7  XUL!mozilla::gl::GLScreenBuffer::~GLScreenBuffer() [RefPtr.h:ab0044bfa1df : 39 + 0x9]
09:38:10     INFO -      rbx = 0x0000000123c142b0   rbp = 0x00007fff5fbfd1f0
09:38:10     INFO -      rsp = 0x00007fff5fbfd1e0   r12 = 0x000000010e828000
09:38:10     INFO -      r13 = 0x00007fff5fbfd320   r14 = 0x00000000000000f4
09:38:10     INFO -      r15 = 0x0000000134ba7000   rip = 0x000000010128c2b4
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -   8  XUL!mozilla::gl::GLScreenBuffer::~GLScreenBuffer() [GLScreenBuffer.cpp:ab0044bfa1df : 148 + 0x5]
09:38:10     INFO -      rbx = 0x0000000123c142b0   rbp = 0x00007fff5fbfd210
09:38:10     INFO -      rsp = 0x00007fff5fbfd200   r12 = 0x000000010e828000
09:38:10     INFO -      r13 = 0x00007fff5fbfd320   r14 = 0x00000000000000f4
09:38:10     INFO -      r15 = 0x0000000134ba7000   rip = 0x000000010128c2fe
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -   9  XUL!mozilla::gl::GLContext::MarkDestroyed() [UniquePtr.h:ab0044bfa1df : 528 + 0x6]
09:38:10     INFO -      rbx = 0x0000000134fe3000   rbp = 0x00007fff5fbfd230
09:38:10     INFO -      rsp = 0x00007fff5fbfd220   r12 = 0x000000010e828000
09:38:10     INFO -      r13 = 0x00007fff5fbfd320   r14 = 0x00000000000000f4
09:38:10     INFO -      r15 = 0x0000000134ba7000   rip = 0x000000010127faf5
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -  10  XUL!mozilla::gl::GLContextCGL::~GLContextCGL() [GLContextProviderCGL.mm:ab0044bfa1df : 83 + 0x5]
09:38:10     INFO -      rbx = 0x0000000134fe3000   rbp = 0x00007fff5fbfd250
09:38:10     INFO -      rsp = 0x00007fff5fbfd240   r12 = 0x000000010e828000
09:38:10     INFO -      r13 = 0x00007fff5fbfd320   r14 = 0x00000000000000f4
09:38:10     INFO -      r15 = 0x0000000134ba7000   rip = 0x000000010129f479
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -  11  XUL!mozilla::WebGLContext::~WebGLContext() [WebGLContext.cpp:ab0044bfa1df : 205 + 0x8]
09:38:10     INFO -      rbx = 0x0000000134ba7000   rbp = 0x00007fff5fbfd280
09:38:10     INFO -      rsp = 0x00007fff5fbfd260   r12 = 0x000000010e828000
09:38:10     INFO -      r13 = 0x00007fff5fbfd320   r14 = 0x00000000000000f4
09:38:10     INFO -      r15 = 0x0000000134ba7000   rip = 0x00000001023c46cf
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -  12  XUL!mozilla::WebGL1Context::~WebGL1Context() [WebGL1Context.cpp:ab0044bfa1df : 27 + 0x5]
09:38:10     INFO -      rbx = 0x0000000134ba7000   rbp = 0x00007fff5fbfd2a0
09:38:10     INFO -      rsp = 0x00007fff5fbfd290   r12 = 0x000000010e828000
09:38:10     INFO -      r13 = 0x00007fff5fbfd320   r14 = 0x00000000000000f4
09:38:10     INFO -      r15 = 0x00007fff5fbfd320   rip = 0x00000001023a88ae
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -  13  XUL!SnowWhiteKiller::~SnowWhiteKiller() [nsCycleCollector.cpp:ab0044bfa1df : 2675 + 0x6]
09:38:10     INFO -      rbx = 0x00000001123d46f8   rbp = 0x00007fff5fbfd2f0
09:38:10     INFO -      rsp = 0x00007fff5fbfd2b0   r12 = 0x000000010e828000
09:38:10     INFO -      r13 = 0x00007fff5fbfd320   r14 = 0x00000000000000f4
09:38:10     INFO -      r15 = 0x00007fff5fbfd320   rip = 0x000000010046e8d8
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -  14  XUL!nsCycleCollector::FreeSnowWhite(bool) [nsCycleCollector.cpp:ab0044bfa1df : 2668 + 0x8]
09:38:10     INFO -      rbx = 0x0000000000000001   rbp = 0x00007fff5fbfd370
09:38:10     INFO -      rsp = 0x00007fff5fbfd300   r12 = 0x00007fff5fbfd320
09:38:10     INFO -      r13 = 0x000000010ed3e000   r14 = 0x000000010e8280f0
09:38:10     INFO -      r15 = 0x00007fff5fbfd300   rip = 0x0000000100462ccd
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -  15  XUL!nsCycleCollector::BeginCollection(ccType, nsICycleCollectorListener*) [nsCycleCollector.cpp:ab0044bfa1df : 3822 + 0xd]
09:38:10     INFO -      rbx = 0x000000010e828001   rbp = 0x00007fff5fbfd3c0
09:38:10     INFO -      rsp = 0x00007fff5fbfd380   r12 = 0x0000000000000000
09:38:10     INFO -      r13 = 0x000000010e828000   r14 = 0x0000000000000002
09:38:10     INFO -      r15 = 0x000000010e8280c0   rip = 0x0000000100466157
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -  16  XUL!nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*, bool) [nsCycleCollector.cpp:ab0044bfa1df : 3647 + 0xf]
09:38:10     INFO -      rbx = 0x000000010e828000   rbp = 0x00007fff5fbfd440
09:38:10     INFO -      rsp = 0x00007fff5fbfd3d0   r12 = 0x00007fff5fbfd450
09:38:10     INFO -      r13 = 0x00007fff5fbfd401   r14 = 0x0000000100465e4c
09:38:10     INFO -      r15 = 0x0000000000000000   rip = 0x0000000100465b51
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -  17  XUL!nsCycleCollector::ShutdownCollect() [nsCycleCollector.cpp:ab0044bfa1df : 3588 + 0x12]
09:38:10     INFO -      rbx = 0x00007fff5fbfd450   rbp = 0x00007fff5fbfd480
09:38:10     INFO -      rsp = 0x00007fff5fbfd450   r12 = 0x0000000106f83cd0
09:38:10     INFO -      r13 = 0x00007fff5fbfd4d8   r14 = 0x000000010e828000
09:38:10     INFO -      r15 = 0x00007fff5fbfd4c8   rip = 0x00000001004659a2
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -  18  XUL!nsCycleCollector_shutdown() [nsCycleCollector.cpp:ab0044bfa1df : 4198 + 0x5]
09:38:10     INFO -      rbx = 0x0000000106f12890   rbp = 0x00007fff5fbfd4b0
09:38:10     INFO -      rsp = 0x00007fff5fbfd490   r12 = 0x0000000106f83cd0
09:38:10     INFO -      r13 = 0x00007fff5fbfd4d8   r14 = 0x00007fff5fbfd4d7
09:38:10     INFO -      r15 = 0x00007fff5fbfd4c8   rip = 0x00000001004687e0
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -  19  XUL!mozilla::ShutdownXPCOM(nsIServiceManager*) [XPCOMInit.cpp:ab0044bfa1df : 968 + 0x5]
09:38:10     INFO -      rbx = 0x0000000000000000   rbp = 0x00007fff5fbfd520
09:38:10     INFO -      rsp = 0x00007fff5fbfd4c0   r12 = 0x0000000106f83cd0
09:38:10     INFO -      r13 = 0x00007fff5fbfd4d8   r14 = 0x00007fff5fbfd4d7
09:38:10     INFO -      r15 = 0x00007fff5fbfd4c8   rip = 0x0000000100521487
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -  20  XUL!XRE_TermEmbedding [nsEmbedFunctions.cpp:ab0044bfa1df : 209 + 0x5]
09:38:10     INFO -      rbx = 0x000000010675d7c8   rbp = 0x00007fff5fbfd540
09:38:10     INFO -      rsp = 0x00007fff5fbfd530   r12 = 0x0000000106f341f0
09:38:10     INFO -      r13 = 0x0000000100000000   r14 = 0x0000000106f8c000
09:38:10     INFO -      r15 = 0x0000000000000000   rip = 0x0000000103c4d551
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -  21  XUL!mozilla::ipc::ScopedXREEmbed::Stop() [ScopedXREEmbed.cpp:ab0044bfa1df : 115 + 0x5]
09:38:10     INFO -      rbx = 0x0000000106f8ca70   rbp = 0x00007fff5fbfd560
09:38:10     INFO -      rsp = 0x00007fff5fbfd550   r12 = 0x0000000106f341f0
09:38:10     INFO -      r13 = 0x0000000100000000   r14 = 0x0000000106f8c000
09:38:10     INFO -      r15 = 0x0000000000000000   rip = 0x0000000100a6d4e3
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -  22  XUL!XRE_InitChildProcess [nsEmbedFunctions.cpp:ab0044bfa1df : 641 + 0x9]
09:38:10     INFO -      rbx = 0x0000000000000010   rbp = 0x00007fff5fbfead0
09:38:10     INFO -      rsp = 0x00007fff5fbfd570   r12 = 0x0000000106f341f0
09:38:10     INFO -      r13 = 0x0000000100000000   r14 = 0x0000000106f8c000
09:38:10     INFO -      r15 = 0x0000000000000000   rip = 0x0000000103c4e098
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -  23  plugin-container!content_process_main(int, char**) [plugin-container.cpp:ab0044bfa1df : 237 + 0xe]
09:38:10     INFO -      rbx = 0x0000000106f069c0   rbp = 0x00007fff5fbfeb10
09:38:10     INFO -      rsp = 0x00007fff5fbfeae0   r12 = 0x000000000000000a
09:38:10     INFO -      r13 = 0x0000000000000000   r14 = 0x0000000000000000
09:38:10     INFO -      r15 = 0x00007fff5fbfeb38   rip = 0x0000000100003e66
09:38:10     INFO -      Found by: call frame info
09:38:10     INFO -  24  plugin-container!start + 0x34
09:38:10     INFO -      rbx = 0x0000000000000000   rbp = 0x00007fff5fbfeb28
09:38:10     INFO -      rsp = 0x00007fff5fbfeb20   r12 = 0x0000000000000000
09:38:10     INFO -      r13 = 0x0000000000000000   r14 = 0x0000000000000000
09:38:10     INFO -      r15 = 0x0000000000000000   rip = 0x0000000100000c84
09:38:10     INFO -      Found by: call frame info
Blocks: e10s-tests
Severity: normal → critical
tracking-e10s: --- → ?
OS: Unspecified → Mac OS X
This is happening because a cycle collected WebGL canvas element is outiliving gfx and IPDL at shutdown. The canvas maintains a texture alive which maintains the FixedSizeShmemAllocator alive and when the latter dies it tries to go through its Shmems and do stuff, but IPDL has already deinitialized the shmems when shut down a little earlier.
Assignee: nobody → nical.bugzilla
This should do. Early-return in the ShmemSectionAllocator if shutdown has already happened and add a few extra sanity checks to be on the safe side.
Attachment #8746511 - Flags: review?(bugmail.mozilla)
Comment on attachment 8746511 [details] [diff] [review]
Don't access a ShmemSection's memory after shutdown

Review of attachment 8746511 [details] [diff] [review]:
-----------------------------------------------------------------

Sorry, but I don't feel like I know this code well enough to really give a meaningful review, is there somebody else who could review it?
Attachment #8746511 - Flags: review?(bugmail.mozilla) → review?(bas)
Comment on attachment 8746511 [details] [diff] [review]
Don't access a ShmemSection's memory after shutdown

Review of attachment 8746511 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/layers/ipc/ShadowLayers.cpp
@@ +227,5 @@
>    MOZ_ASSERT(aSize == sSupportedBlockSize);
>    MOZ_ASSERT(aShmemSection);
>  
> +  if (!IPCOpen()) {
> +    gfxCriticalError() << "Attempt to allocate a ShmemSections after shutdown.";

nit: typo

@@ +344,5 @@
>    size_t i = 0;
>    while (i < mUsedShmems.size()) {
> +    ShmemSectionHeapHeader* header = mUsedShmems[i].IsReadable()
> +                                   ? mUsedShmems[i].get<ShmemSectionHeapHeader>()
> +                                   : nullptr;

What's the purpose of this bit? Since it should only be reached if the IPC bridge is still open?
Attachment #8746511 - Flags: review?(bas)
(In reply to Bas Schouten (:bas.schouten) from comment #4)
> Comment on attachment 8746511 [details] [diff] [review]
> Don't access a ShmemSection's memory after shutdown
> @@ +344,5 @@
> >    size_t i = 0;
> >    while (i < mUsedShmems.size()) {
> > +    ShmemSectionHeapHeader* header = mUsedShmems[i].IsReadable()
> > +                                   ? mUsedShmems[i].get<ShmemSectionHeapHeader>()
> > +                                   : nullptr;
> 
> What's the purpose of this bit? Since it should only be reached if the IPC
> bridge is still open?

That's just extra paranoid sanity checks that I could remove from the patch if they bother you. I Don't know for sure if they can fail when IPC is not shut down, but if they do it'd be pretty bad since we are about to write into random memory, so might as well check...
Attached patch v2Splinter Review
Same patch with comments addressed.
Attachment #8746511 - Attachment is obsolete: true
Attachment #8748179 - Flags: review?(bas)
Comment on attachment 8748179 [details] [diff] [review]
v2

Review of attachment 8748179 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/layers/ipc/ShadowLayers.cpp
@@ +337,5 @@
>  {
> +  if (!IPCOpen()) {
> +    mUsedShmems.clear();
> +    return;
> +  }

nit: add whitespace
Attachment #8748179 - Flags: review?(bas) → review+
If this gets backed out for whatever reason please update the r=kats to r=Bas before relanding :)
https://hg.mozilla.org/mozilla-central/rev/7027dba69da4
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla49
Confirmed green on Ash :). Can we get an Aurora/Beta approval?
Flags: needinfo?(nical.bugzilla)
(In reply to Kartikaya Gupta (email:kats@mozilla.com) from comment #9)
> If this gets backed out for whatever reason please update the r=kats to
> r=Bas before relanding :)

Oops, sorry!
Flags: needinfo?(nical.bugzilla)
Comment on attachment 8748179 [details] [diff] [review]
v2

Approval Request Comment
[Feature/regressing bug #]:
[User impact if declined]: some shutdown crashes
[Describe test coverage new/current, TreeHerder]: none.
[Risks and why]: low, the patch is simple and hasn't caused any issue on nightly.
[String/UUID change made/needed]: none.
Attachment #8748179 - Flags: approval-mozilla-beta?
Attachment #8748179 - Flags: approval-mozilla-aurora?
Comment on attachment 8748179 [details] [diff] [review]
v2

Crash fix, verified by automated tests, Aurora48+, Beta47+
Attachment #8748179 - Flags: approval-mozilla-beta?
Attachment #8748179 - Flags: approval-mozilla-beta+
Attachment #8748179 - Flags: approval-mozilla-aurora?
Attachment #8748179 - Flags: approval-mozilla-aurora+
I'm hitting conflicts applying this to beta.
Flags: needinfo?(nical.bugzilla)
(In reply to Wes Kocher (:KWierso) from comment #15)
> I'm hitting conflicts applying this to beta.

Actually, I don't think that this crash exists on beta because the changes that introduced the issue are not there, and the way the code works on beta already has equivalent checks to the ones this patch adds.
Flags: needinfo?(nical.bugzilla)
You need to log in before you can comment on or make changes to this bug.