1305269 - Crash in mozilla::layers::PLayerParent::DestroySubtree

Status: RESOLVED DUPLICATE of bug 1314318

(Core :: Graphics: Layers, defect)

Description

[Marcia Knous [:marcia]]

[Tracking Requested - why for this release]: Nominating because it is a new crash in Beta that spiked and we should keep an eye on it.

This bug was filed from the Socorro interface and is 
report bp-e8604389-ac84-4e60-99b8-2041c2160924.
=============================================================

Seen while reviewing Beta crash stats: http://bit.ly/2cZPDua. #32 browser crash that appears in 49b2 and 50a2 but in very small volume.

Comment 1

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Currently this is ranked at #40 among Fx50 top crashers. If this goes up further, we might need to get someone from the dev team to investigate.

Comment 2

[Vincent Liu[:vliu]]

From looked into Signature, it shows the weird back trace. 

Frame 0:
mozilla::layers::PLayerParent::DestroySubtree(mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::ActorDestroyReason)

Frame 1:
mozilla::layers::PImageBridgeChild::DestroySubtree(mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::ActorDestroyReason)

1. PLayerParent was managed by PCompositorBridgeParent, so it should be destroyed by PCompositorBridgeParent! 
2. Another weird thing is Frame 1 and Frame 0 shouldn't happens in the same thread.
3. From the Crash Address(0xffffffffe5e5e5f1), it might be use-after-free case

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'mozilla::layers::PLayerParent::DestroySubtree':
 - nightly (version 52): 0 crashes from 2016-09-19.
 - aurora  (version 51): 0 crashes from 2016-09-19.
 - beta    (version 50): 355 crashes from 2016-09-20.
 - release (version 49): 0 crashes from 2016-09-05.
 - esr     (version 45): 25 crashes from 2016-06-01.

Crash volume on the last weeks (Week N is from 10-03 to 10-09):
            W. N-1  W. N-2
 - nightly       0       0
 - aurora        0       0
 - beta        266      89
 - release       0       0
 - esr           3       0

Affected platform: Windows

Crash rank on the last 7 days:
           Browser     Content   Plugin
 - nightly
 - aurora
 - beta    #44
 - release
 - esr     #2091

Comment 4

[Julien Cristau [:jcristau]]

Crash rate went back down, it's no longer significant, so not tracking for 50.  However, since this spiked a couple weeks ago it would still be nice to figure out what caused this; Vincent, did you make any progress?

Comment 5

[Vincent Liu[:vliu]]

No, I can't reproduce this problem in my local build.