Closed Bug 1302410 Opened 4 years ago Closed 4 years ago
Crash in mozilla::gl::Surface
Factory::New Tex Client
This bug was filed from the Socorro interface and is report bp-a09f16a7-d3cf-4a91-836c-d1c8b2160912. ============================================================= Seen while looking at nightly crash stats: http://bit.ly/2cop1So Comments both reference "crashes everytime I go to VR Mod"
ni on Jeff since he seems to have worked in that area recently.
Michael, this looks like we need the pointer null-check. Please have a look about the crash flow and contact Morris if you have question.
Assignee: nobody → cleu
Priority: -- → P3
43 occurrences in the past week on Nightly, which is a moderate number. It would be nice to have a fix here, esp. if it's just a case of adding a null check.
And generally this has become more prevalent since Nov 29 or 30.
As a note, Kip and I hit this today when testing GPU Process termination in WebVR. 1) Load https://aframe.io/examples/showcase/helloworld/ or https://webvr.info/samples/03-vr-presentation.html 2) Enter WebVR 3) Kill the GPU Process 4) Exit WebVR or reload the page 5) Crash! Reports: bp-1d7c2441-a7fb-4226-9e53-8f7db2170123 bp-3cd8947b-359c-4520-8e0a-c09762170123
(In reply to Anthony Hughes (:ashughes) [GFX][QA][Mentor] from comment #5) > As a note, Kip and I hit this today when testing GPU Process termination in > WebVR. > > 1) Load https://aframe.io/examples/showcase/helloworld/ or > https://webvr.info/samples/03-vr-presentation.html > 2) Enter WebVR > 3) Kill the GPU Process > 4) Exit WebVR or reload the page > 5) Crash! > > Reports: > bp-1d7c2441-a7fb-4226-9e53-8f7db2170123 > bp-3cd8947b-359c-4520-8e0a-c09762170123 Hi Anthony, I cannot reproduce the crash by these steps, does it needs a VR headset attached? It seems to be mRecycleFreePool is not a valid pointer and we want to access it. Maybe we can just solve it by checking it and return nullptr if mRecycleFreePool is nullptr.
(In reply to Michael Leu[:lenzak800](UTC+8) from comment #6) > I cannot reproduce the crash by these steps, does it needs a VR headset attached? I believe it did, we were using an Occulus. Kip might be able to provide further context.
I tried to reproduce it by the steps from Comment 5, but I got a different result. It crashes at VRDisplayPresentation::DestroyLayers() when it asks VRLayerChild to send destroy messages at Content process. The VRLayerChild here should have been destroyed at VRManagerChild::DeallocPVRLayerChild() when Compositor process is killed. The VRLayerChild pointer at VRDisplayPresentation is a RefPtr, although it is deleted at somewhere, the VRLayerChild at VRDisplayPresentation's mLayers can't aware it has been deleted. I think it is a pointer dangling problem.
In Daosheng's testing, we cannot reproduce the crash this bug mentioned, but it seems that VR-related IPC part lacks some failure-notification mechanism when GPU process is terminated abnormally. Hi Kip, do you have any idea about it?
(In reply to Michael Leu[:Lenzak](UTC+8) from comment #9) > In Daosheng's testing, we cannot reproduce the crash this bug mentioned, but > it seems that VR-related IPC part lacks some failure-notification mechanism > when GPU process is terminated abnormally. > > Hi Kip, do you have any idea about it? Earlier experiments showed that we need to handle recovery of the GPU process better when it crashes during VR presentation. It is 100% reproducible the last time I checked: - Ensure GPU process is enabled - Open a WebVR site - Enter VR - Kill the GPU process while in VR Perhaps now with Daosheng's VR Puppet test interfaces, this might be reproduced without physical VR hardware present. Bug 1342430 could also be related. For that bug, I will attempt to fix it by avoiding to call any more Oculus API's during shutdown of the GPU process (such as submitting a black frame).
See Also: → 1342430
I think this issue should be the same root cause as bug 1343851 which was uplifted to esr52 8 days ago. And I didn't see new crashes after build 20170309030216. https://bugzilla.mozilla.org/show_bug.cgi?id=1343851#c27
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1343851
You need to log in before you can comment on or make changes to this bug.