Closed Bug 1293772 Opened 3 years ago Closed 3 years ago
Crash in mozilla::layers::Texture
This bug was filed from the Socorro interface and is report bp-e1dfc6bf-f396-48fb-9cc8-457c02160809. ============================================================= This is currently a top crasher on Aurora 50.0a2. 100% of affected users have the addon "colorPicker" installed (version 3.0.1-signed.1-signed).
I'm able to reproduce the crash by installing the colorPicker addon from AMO (https://addons.mozilla.org/it/firefox/addon/colorpicker/), so it isn't specific to Windows. https://crash-stats.mozilla.com/report/index/68195a0f-b0dc-42e1-b491-1c4c32160809
Is this somehow related to bug 1285271? It seems really similar to bug 1284705.
Assignee: nobody → nical.bugzilla
This seems to be caused by the addon outliving its window, and trying to access the canas texture after the window is destroyed. When the window is destroyed, the PCompositorChild is destroyed and the texture's shared data is destroyed too since it rely on PCompositorChild to share its data. This kinda yucks. We've managed to make sure users of TextureClient don't try to use them after shutdown in the platform, but I guess we don't have a reliable way to enforce that once we expose shared textures to addons through canvas. This can be simply worked around with a bunch of null checks in TextureClient.
Attachment #8779685 - Flags: review?(jnicol) → review+
"Chexk" should be "Check" in commit message
(In reply to Jamie Nicol [:jnicol] from comment #5) > "Chexk" should be "Check" in commit message woops!
Pushed by firstname.lastname@example.org: https://hg.mozilla.org/integration/mozilla-inbound/rev/38e387b1bd41 Check that the TextureClient is not internally shut down in Lock, Unlock and BorrowDrawTarget. r=jnicol
Do you know if versions < 50 are affected? Do you think we can/should uplift this?
(In reply to Marco Castelluccio [:marco] from comment #9) > Do you know if versions < 50 are affected? Do you think we can/should uplift > this? We need to uplift to 50. 49 and below should be good.
Comment on attachment 8779685 [details] [diff] [review] color-picker-crash Approval Request Comment [Feature/regressing bug #]: [User impact if declined]: Crashes related to addons that use Canvas 2D. [Describe test coverage new/current, TreeHerder]: None. [Risks and why]: low risk, just a bunch of null checks. [String/UUID change made/needed]: None.
Attachment #8779685 - Flags: approval-mozilla-aurora?
Comment on attachment 8779685 [details] [diff] [review] color-picker-crash This crash didn't have much volume on Nightly to get validated there, given the scope of the changes here, let's uplift to Aurora50.
Attachment #8779685 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Crash volume for signature 'mozilla::layers::TextureClient::Lock': - nightly (version 51): 4 crashes from 2016-08-01. - aurora (version 50): 240 crashes from 2016-08-01. - beta (version 49): 2 crashes from 2016-08-02. - release (version 48): 1 crash from 2016-07-25. - esr (version 45): 0 crashes from 2016-05-02. Crash volume on the last weeks (Week N is from 08-22 to 08-28): W. N-1 W. N-2 W. N-3 - nightly 0 1 3 - aurora 20 172 45 - beta 0 1 0 - release 0 1 0 - esr 0 0 0 Affected platforms: Windows, Linux Crash rank on the last 7 days: Browser Content Plugin - nightly - aurora #257 - beta #13590 - release - esr
You need to log in before you can comment on or make changes to this bug.