crash in VR when OMTC is disabled

NEW
Unassigned

Status

()

2 years ago
2 years ago

People

(Reporter: stransky, Unassigned)

Tracking

({crash})

Trunk
x86_64
Linux
crash
Points:
---

Firefox Tracking Flags

(firefox52 wontfix)

Details

(Whiteboard: [webvr][gfx-noted])

(Reporter)

Description

2 years ago
When disabled OMTC, e10s and runs without hw acceleration, Firefox crashes because sVRManagerChildSingleton is not initialized. sVRManagerChildSingleton is set up only when OMTC is enabled.

bt:
#0  0x00007fffe2c53e9e in mozilla::gfx::VRManagerChild::Get() ()
    at /home/komat/tmp676-trunk-gtk3/src/gfx/vr/ipc/VRManagerChild.cpp:78
#1  0x00007fffe4a9f6e1 in mozilla::dom::VREventObserver::VREventObserver(nsGlobalWindow*) (this=0x7fffacfbcc48, aGlobalWindow=0x7fffbf053000) at /home/komat/tmp676-trunk-gtk3/src/dom/vr/VREventObserver.cpp:27
#2  0x00007fffe2ddab6d in nsGlobalWindow::EnableVRUpdates() (this=0x7fffbf053000)
    at /home/komat/tmp676-trunk-gtk3/src/dom/base/nsGlobalWindow.cpp:10056
#3  0x00007fffe2de7e02 in nsGlobalWindow::NotifyVREventListenerAdded() (this=0x7fffbf053000)
    at /home/komat/tmp676-trunk-gtk3/src/dom/base/nsGlobalWindow.cpp:13551
#4  0x00007fffe2ead4c2 in mozilla::dom::Navigator::GetActiveVRDisplays(nsTArray<RefPtr<mozilla::dom::VRDisplay> >&) const (this=0x7fffb1620980, aDisplays=nsTArray<RefPtr<mozilla::dom::VRDisplay> > &)
    at /home/komat/tmp676-trunk-gtk3/src/dom/base/Navigator.cpp:1740
#5  0x00007fffe330b6b5 in mozilla::dom::NavigatorBinding::get_activeVRDisplays(JSContext*, JS::Handle<JSObject*>, mozilla::dom::Navigator*, JSJitGetterCallArgs) (cx=0x7fffd3352000, obj=(JSObject * const) 0x7fffbd573380 [object Navigator], self=0x7fffb1620980, args=$jsval((JSObject *) 0x7fffaefdc340 [object Function "get activeVRDisplays"]))
    at /home/komat/tmp676-trunk-gtk3/src/objdir/dom/bindings/NavigatorBinding.cpp:1845
#6  0x00007fffe3cb4b81 in mozilla::dom::GenericBindingGetter(JSContext*, unsigned int, JS::Value*) (cx=0x7fffd3352000, argc=0, vp=0x7fffffff8aa8) at /home/komat/tmp676-trunk-gtk3/src/dom/bindings/BindingUtils.cpp:2791
#7  0x00007fffe70354e0 in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) (cx=0x7fffd3352000, native=0x7fffe3cb494f <mozilla::dom::GenericBindingGetter(JSContext*, unsigned int, JS::Value*)>, args=...)
    at /home/komat/tmp676-trunk-gtk3/src/js/src/jscntxtinlines.h:239
#8  0x00007fffe7049b41 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (cx=0x7fffd3352000, args=..., construct=js::NO_CONSTRUCT) at /home/komat/tmp676-trunk-gtk3/src/js/src/vm/Interpreter.cpp:458
#9  0x00007fffe7049e6d in InternalCall(JSContext*, js::AnyInvokeArgs const&) (cx=0x7fffd3352000, args=...)
    at /home/komat/tmp676-trunk-gtk3/src/js/src/vm/Interpreter.cpp:503
#10 0x00007fffe7049f04 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) (cx=0x7fffd3352000, fval=$jsval((JSObject *) 0x7fffaefdc340 [object Function "get activeVRDisplays"]), thisv=$jsval((JSObject *) 0x7fffbd573380 [object Navigator]), args=..., rval=JSVAL_VOID)
    at /home/komat/tmp676-trunk-gtk3/src/js/src/vm/Interpreter.cpp:522
#11 0x00007fffe704a7bc in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) (cx=0x7fffd3352000, thisv=$jsval((JSObject *) 0x7fffbd573380 [object Navigator]), getter=$jsval((JSObject *) 0x7fffaefdc340 [object Function "get activeVRDisplays"]), rval=JSVAL_VOID)
    at /home/komat/tmp676-trunk-gtk3/src/js/src/vm/Interpreter.cpp:636
#12 0x00007fffe7088651 in CallGetter(JSContext*, JS::HandleObject, JS::HandleValue, js::HandleShape, JS::MutableHandleValue) (cx=0x7fffd3352000, obj=(JSObject * const) 0x7fffba3e5e20 [object NavigatorPrototype] delegate, receiver=$jsval((JSObject *) 0x7fffbd573380 [object Navigator]), shape=0x7fffaefda5b8, vp=JSVAL_VOID)
    at /home/komat/tmp676-trunk-gtk3/src/js/src/vm/NativeObject.cpp:1791
[...]
(Reporter)

Comment 1

2 years ago
The affected site is www.seznam.cz which is a local majority search engine and news provider.
Note: Disabled OMTC isn't a supported configuration anymore.  The only reason we still have the ability to disable it is for some internal testing.  That preference name already got changed once, and will likely go away soon.

This crash could be related to a problem even outside of non-OMTC scenario, so I'm not arguing against investigation of the cause, but wanted to point out the non-supported aspect of this.
(Reporter)

Comment 3

2 years ago
The cause is that the VR is initialized only from mozilla::gfx::GPUProcessManager::CreateTopLevelCompositor() which is not called when OMTC is disabled.

Init path for OMTC:
#0  0x00007fffe2eceb86 in mozilla::gfx::VRManagerChild::InitSameProcess() ()
    at /home/komat/tmp676-trunk-gtk3/src/gfx/vr/ipc/VRManagerChild.cpp:119
#1  0x00007fffe2ebde2c in mozilla::gfx::GPUProcessManager::EnsureVRManager() (this=0x7fffc5f2c9e0)
    at /home/komat/tmp676-trunk-gtk3/src/gfx/ipc/GPUProcessManager.cpp:205
#2  0x00007fffe2ebe56f in mozilla::gfx::GPUProcessManager::CreateTopLevelCompositor(nsBaseWidget*, mozilla::layers::ClientLayerManager*, mozilla::gfx::ScaleFactor<mozilla::CSSPixel, mozilla::LayoutDevicePixel>, bool, bool, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&) (this=0x7fffc5f2c9e0, aWidget=0x7fffbb056000, aLayerManager=0x7fffb7a76d60, aScale=..., aUseAPZ=false, aUseExternalSurfaceSize=false, aSurfaceSize=...)
    at /home/komat/tmp676-trunk-gtk3/src/gfx/ipc/GPUProcessManager.cpp:409
#3  0x00007fffe4daf13b in nsBaseWidget::CreateCompositor(int, int) (this=0x7fffbb056000, aWidth=1073, aHeight=632)
    at /home/komat/tmp676-trunk-gtk3/src/widget/nsBaseWidget.cpp:1308
#4  0x00007fffe4dada2a in nsBaseWidget::CreateCompositor() (this=0x7fffbb056000)
    at /home/komat/tmp676-trunk-gtk3/src/widget/nsBaseWidget.cpp:950
#5  0x00007fffe4daf741 in nsBaseWidget::GetLayerManager(mozilla::layers::PLayerTransactionChild*, mozilla::layers::LayersBackend, nsIWidget::LayerManagerPersistence) (this=0x7fffbb056000, aShadowManager=0x0, aBackendHint=mozilla::layers::LayersBackend::LAYERS_NONE, aPersistence=nsIWidget::LAYER_MANAGER_CURRENT)
    at /home/komat/tmp676-trunk-gtk3/src/widget/nsBaseWidget.cpp:1403
#6  0x00007fffe4e10d96 in nsWindow::GetLayerManager(mozilla::layers::PLayerTransactionChild*, mozilla::layers::LayersBackend, nsIWidget::LayerManagerPersistence) (this=0x7fffbb056000, aShadowManager=0x0, aBackendHint=mozilla::layers::LayersBackend::LAYERS_NONE, aPersistence=nsIWidget::LAYER_MANAGER_CURRENT) at /home/komat/tmp676-trunk-gtk3/src/widget/gtk/nsWindow.cpp:6727
#7  0x00007fffe2ffb35b in nsIWidget::GetLayerManager() (this=0x7fffbb056000)
    at /home/komat/tmp676-trunk-gtk3/src/widget/nsIWidget.h:1244
#8  0x00007fffe527a85f in PresShell::Paint(nsView*, nsRegion const&, unsigned int) (this=0x7fffbb0e7c00,
    aViewToPaint=0x7fffbb0d5100, aDirtyRegion=..., aFlags=1)
    at /home/komat/tmp676-trunk-gtk3/src/layout/base/nsPresShell.cpp:6287
(Reporter)

Comment 4

2 years ago
I agree it's not critical, I hit that bug on Firefox Wayland port where OMTC is not functional yet.
As far as I can tell this is non-OMTC only and I don't see a way this causes a problem in OMTC enabled builds. So I'm not sure whether we want to invest in fixing this ourselves or whether we expect the Wayland port folks to implement work-around since they're working with an unsupported config.
Whiteboard: [webvr] → [webvr][gfx-noted]
Component: Graphics → WebVR
Too late for firefox 52, mass-wontfix.
status-firefox52: affected → wontfix
You need to log in before you can comment on or make changes to this bug.