1302410 - Crash in mozilla::gl::SurfaceFactory::NewTexClient

Status: RESOLVED DUPLICATE of bug 1343851

(Core :: Graphics, defect, P3)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-a09f16a7-d3cf-4a91-836c-d1c8b2160912.
=============================================================

Seen while looking at nightly crash stats: http://bit.ly/2cop1So

Comments both reference "crashes everytime I go to VR Mod"

Comment 1

[Marcia Knous [:marcia]]

ni on Jeff since he seems to have worked in that area recently.

Comment 2

[Peter Chang[:pchang]]

Michael, this looks like we need the pointer null-check. Please have a look about the crash flow and contact Morris if you have question.

Comment 3

[Nicholas Nethercote [inactive]]

43 occurrences in the past week on Nightly, which is a moderate number. It would be nice to have a fix here, esp. if it's just a case of adding a null check.

Comment 4

[Nicholas Nethercote [inactive]]

And generally this has become more prevalent since Nov 29 or 30.

Comment 5

[u279076]

As a note, Kip and I hit this today when testing GPU Process termination in WebVR.

1) Load https://aframe.io/examples/showcase/helloworld/ or https://webvr.info/samples/03-vr-presentation.html
2) Enter WebVR
3) Kill the GPU Process
4) Exit WebVR or reload the page
5) Crash!

Reports:
bp-1d7c2441-a7fb-4226-9e53-8f7db2170123
bp-3cd8947b-359c-4520-8e0a-c09762170123

Comment 6

[Michael Leu[:Lenzak](UTC+8)]

(In reply to Anthony Hughes (:ashughes) [GFX][QA][Mentor] from comment #5)
> As a note, Kip and I hit this today when testing GPU Process termination in
> WebVR.
> 
> 1) Load https://aframe.io/examples/showcase/helloworld/ or
> https://webvr.info/samples/03-vr-presentation.html
> 2) Enter WebVR
> 3) Kill the GPU Process
> 4) Exit WebVR or reload the page
> 5) Crash!
> 
> Reports:
> bp-1d7c2441-a7fb-4226-9e53-8f7db2170123
> bp-3cd8947b-359c-4520-8e0a-c09762170123

Hi Anthony,

I cannot reproduce the crash by these steps, does it needs a VR headset attached?

It seems to be mRecycleFreePool is not a valid pointer and we want to access it.

Maybe we can just solve it by checking it and return nullptr if mRecycleFreePool is nullptr.

Comment 7

[u279076]

(In reply to Michael Leu[:lenzak800](UTC+8) from comment #6)
> I cannot reproduce the crash by these steps, does it needs a VR headset attached?

I believe it did, we were using an Occulus. Kip might be able to provide further context.

Comment 8

[Daosheng Mu[:daoshengmu]]

I tried to reproduce it by the steps from Comment 5, but I got a different result. It crashes at VRDisplayPresentation::DestroyLayers() when it asks VRLayerChild to send destroy messages at Content process. The VRLayerChild here should have been destroyed at VRManagerChild::DeallocPVRLayerChild() when Compositor process is killed. The VRLayerChild pointer at VRDisplayPresentation is a RefPtr, although it is deleted at somewhere, the VRLayerChild at VRDisplayPresentation's mLayers can't aware it has been deleted. I think it is a pointer dangling problem.

Comment 9

[Michael Leu[:Lenzak](UTC+8)]

In Daosheng's testing, we cannot reproduce the crash this bug mentioned, but it seems that VR-related IPC part lacks some failure-notification mechanism when GPU process is terminated abnormally.

Hi Kip, do you have any idea about it?

Comment 10

[:kip (Kearwood Gilbert)]

(In reply to Michael Leu[:Lenzak](UTC+8) from comment #9)
> In Daosheng's testing, we cannot reproduce the crash this bug mentioned, but
> it seems that VR-related IPC part lacks some failure-notification mechanism
> when GPU process is terminated abnormally.
> 
> Hi Kip, do you have any idea about it?
Earlier experiments showed that we need to handle recovery of the GPU process better when it crashes during VR presentation.  It is 100% reproducible the last time I checked:

- Ensure GPU process is enabled
- Open a WebVR site
- Enter VR
- Kill the GPU process while in VR

Perhaps now with Daosheng's VR Puppet test interfaces, this might be reproduced without physical VR hardware present.

Bug 1342430 could also be related.  For that bug, I will attempt to fix it by avoiding to call any more Oculus API's during shutdown of the GPU process (such as submitting a black frame).

Comment 11

[Julien Cristau [:jcristau]]

Mass wontfix for bugs affecting firefox 52.

Comment 12

[Peter Chang[:pchang]]

I think this issue should be the same root cause as bug 1343851 which was uplifted to esr52 8 days ago.
And I didn't see new crashes after build 20170309030216.

https://bugzilla.mozilla.org/show_bug.cgi?id=1343851#c27