1288569 - Crash in mozilla::layers::CompositorBridgeParent::ForceComposeToTarget

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect, critical)

Description

[Andrew McCreight [:mccr8] (PTO 9/16-9/23)]

This bug was filed from the Socorro interface and is 
report bp-bb3d5f3a-3f67-4b14-bd39-0058e2160720.
=============================================================

This looks like a new crash in the 7-20 build. It is a null deref. I see about 5 (#19 Windows), all from different install times.

Comment 1

[Sotaro Ikeda [:sotaro]]

There seems to be a case that ForceComposeToTarget() is called after CompositorBridgeParent shutdown.

Comment 2

[Sotaro Ikeda [:sotaro]]

Some functions in CompositorBridgeChild seems to check mCanSend before calling IPC function.

Comment 3

[Sotaro Ikeda [:sotaro]]

Attachment: patch - Add more mCanSend checks

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/13a135813767
Add more mCanSend checks r=nical

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/13a135813767

Comment 6

[Andrei Vaida [:avaida]]

This is still reproducible in low volume on Fx50, based on the last 2 months of crash data.

  SIGNATURE   | mozilla::layers::CompositorBridgeParent::ForceComposeToTarget
  ---------------------------------------------------------------------------
  CRASH STATS | http://tinyurl.com/jbsflcy
  ---------------------------------------------------------------------------
  OVERVIEW    | 0 crashes on nightly 52
	      | 0 crashes on nightly 51
	      | 0 crashes on aurora 51
	      | 12 crashes on nightly 50
	      | 5 crashes on aurora 50
	      | 1 crash on beta 50
  ---------------------------------------------------------------------------
  LAST CRASH  | 2016-09-27 (on 50.0b1)

Comment 7

[Milan Sreckovic [:milan] (needinfo for best results)]

The one I can find - https://crash-stats.mozilla.com/report/index/63a45750-b58e-4b1c-9925-e01be2160927 - seems to be in shutdown, related to plug-ins.  Sotaro, is it worth just putting a nullptr check in ForceComposeToTarget to deal with that case?

Comment 8

[Sotaro Ikeda [:sotaro]]

(In reply to Milan Sreckovic [:milan] from comment #7)
> The one I can find -
> https://crash-stats.mozilla.com/report/index/63a45750-b58e-4b1c-9925-
> e01be2160927 - seems to be in shutdown, related to plug-ins.  Sotaro, is it
> worth just putting a nullptr check in ForceComposeToTarget to deal with that
> case?

It seems better to fix CompositorBridgeChild::RecvCaptureAllPlugins() for now.

Comment 9

[Sotaro Ikeda [:sotaro]]

(In reply to Sotaro Ikeda [:sotaro] from comment #8)
> 
> It seems better to fix CompositorBridgeChild::RecvCaptureAllPlugins() for
> now.

Bug 1306211 is created for it.