Closed Bug 1288569 Opened 3 years ago Closed 3 years ago

Crash in mozilla::layers::CompositorBridgeParent::ForceComposeToTarget

Categories

(Core :: Graphics: Layers, defect, critical)

x86
Windows 10
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla50
Tracking Status
firefox47 --- unaffected
firefox48 --- unaffected
firefox49 --- unaffected
firefox50 --- fixed
firefox51 --- unaffected
firefox52 --- unaffected

People

(Reporter: mccr8, Assigned: sotaro)

References

Details

(Keywords: crash, regression, Whiteboard: [gfx-noted])

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is 
report bp-bb3d5f3a-3f67-4b14-bd39-0058e2160720.
=============================================================

This looks like a new crash in the 7-20 build. It is a null deref. I see about 5 (#19 Windows), all from different install times.
There seems to be a case that ForceComposeToTarget() is called after CompositorBridgeParent shutdown.
Some functions in CompositorBridgeChild seems to check mCanSend before calling IPC function.
Attachment #8773577 - Flags: review?(nical.bugzilla)
Assignee: nobody → sotaro.ikeda.g
Whiteboard: [gfx-noted]
Attachment #8773577 - Flags: review?(nical.bugzilla) → review+
https://hg.mozilla.org/mozilla-central/rev/13a135813767
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla50
This is still reproducible in low volume on Fx50, based on the last 2 months of crash data.

  SIGNATURE   | mozilla::layers::CompositorBridgeParent::ForceComposeToTarget
  ---------------------------------------------------------------------------
  CRASH STATS | http://tinyurl.com/jbsflcy
  ---------------------------------------------------------------------------
  OVERVIEW    | 0 crashes on nightly 52
	      | 0 crashes on nightly 51
	      | 0 crashes on aurora 51
	      | 12 crashes on nightly 50
	      | 5 crashes on aurora 50
	      | 1 crash on beta 50
  ---------------------------------------------------------------------------
  LAST CRASH  | 2016-09-27 (on 50.0b1)
The one I can find - https://crash-stats.mozilla.com/report/index/63a45750-b58e-4b1c-9925-e01be2160927 - seems to be in shutdown, related to plug-ins.  Sotaro, is it worth just putting a nullptr check in ForceComposeToTarget to deal with that case?
Flags: needinfo?(sotaro.ikeda.g)
(In reply to Milan Sreckovic [:milan] from comment #7)
> The one I can find -
> https://crash-stats.mozilla.com/report/index/63a45750-b58e-4b1c-9925-
> e01be2160927 - seems to be in shutdown, related to plug-ins.  Sotaro, is it
> worth just putting a nullptr check in ForceComposeToTarget to deal with that
> case?

It seems better to fix CompositorBridgeChild::RecvCaptureAllPlugins() for now.
Flags: needinfo?(sotaro.ikeda.g)
Depends on: 1306211
(In reply to Sotaro Ikeda [:sotaro] from comment #8)
> 
> It seems better to fix CompositorBridgeChild::RecvCaptureAllPlugins() for
> now.

Bug 1306211 is created for it.
You need to log in before you can comment on or make changes to this bug.