Closed Bug 1293772 Opened 3 years ago Closed 3 years ago

Crash in mozilla::layers::TextureClient::Lock

Categories

(Core :: Graphics: Layers, defect, critical)

50 Branch
Unspecified
All
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla51
Tracking Status
firefox50 --- fixed
firefox51 --- fixed

People

(Reporter: marco, Assigned: nical)

References

Details

(Keywords: crash, topcrash, topcrash-win)

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is 
report bp-e1dfc6bf-f396-48fb-9cc8-457c02160809.
=============================================================

This is currently a top crasher on Aurora 50.0a2. 100% of affected users have the addon "colorPicker" installed (version 3.0.1-signed.1-signed).
I'm able to reproduce the crash by installing the colorPicker addon from AMO (https://addons.mozilla.org/it/firefox/addon/colorpicker/), so it isn't specific to Windows.

https://crash-stats.mozilla.com/report/index/68195a0f-b0dc-42e1-b491-1c4c32160809
OS: Windows → All
Is this somehow related to bug 1285271?

It seems really similar to bug 1284705.
Flags: needinfo?(nical.bugzilla)
See Also: → 1284705
Assignee: nobody → nical.bugzilla
Flags: needinfo?(nical.bugzilla)
This seems to be caused by the addon outliving its window, and trying to access the canas texture after the window is destroyed. When the window is destroyed, the PCompositorChild is destroyed and the texture's shared data is destroyed too since it rely on PCompositorChild to share its data.
This kinda yucks. We've managed to make sure users of TextureClient don't try to use them after shutdown in the platform, but I guess we don't have a reliable way to enforce that once we expose shared textures to addons through canvas. This can be simply worked around with a bunch of null checks in TextureClient.
Attachment #8779685 - Flags: review?(jnicol)
Attachment #8779685 - Flags: review?(jnicol) → review+
"Chexk" should be "Check" in commit message
(In reply to Jamie Nicol [:jnicol] from comment #5)
> "Chexk" should be "Check" in commit message

woops!
Pushed by nsilva@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/38e387b1bd41
Check that the TextureClient is not internally shut down in Lock, Unlock and BorrowDrawTarget. r=jnicol
https://hg.mozilla.org/mozilla-central/rev/38e387b1bd41
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla51
Do you know if versions < 50 are affected? Do you think we can/should uplift this?
Flags: needinfo?(nical.bugzilla)
(In reply to Marco Castelluccio [:marco] from comment #9)
> Do you know if versions < 50 are affected? Do you think we can/should uplift
> this?

We need to uplift to 50. 49 and below should be good.
Flags: needinfo?(nical.bugzilla)
Comment on attachment 8779685 [details] [diff] [review]
color-picker-crash

Approval Request Comment
[Feature/regressing bug #]:
[User impact if declined]: Crashes related to addons that use Canvas 2D.
[Describe test coverage new/current, TreeHerder]: None.
[Risks and why]: low risk, just a bunch of null checks.
[String/UUID change made/needed]: None.
Attachment #8779685 - Flags: approval-mozilla-aurora?
Comment on attachment 8779685 [details] [diff] [review]
color-picker-crash

This crash didn't have much volume on Nightly to get validated there, given the scope of the changes here, let's uplift to Aurora50.
Attachment #8779685 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Crash volume for signature 'mozilla::layers::TextureClient::Lock':
 - nightly (version 51): 4 crashes from 2016-08-01.
 - aurora  (version 50): 240 crashes from 2016-08-01.
 - beta    (version 49): 2 crashes from 2016-08-02.
 - release (version 48): 1 crash from 2016-07-25.
 - esr     (version 45): 0 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       0       1       3
 - aurora       20     172      45
 - beta          0       1       0
 - release       0       1       0
 - esr           0       0       0

Affected platforms: Windows, Linux

Crash rank on the last 7 days:
           Browser     Content   Plugin
 - nightly
 - aurora  #257
 - beta    #13590
 - release
 - esr
You need to log in before you can comment on or make changes to this bug.