Closed Bug 1319508 Opened 3 years ago Closed 3 years ago
Guard against dangling m
Parent pointer in Erase Layer State
Bug 1319508 - Ensure that we don't leave dangling pointers to CompositorBridgeParent in LayerTreeState instances.
58 bytes, text/x-review-board-request
In the QuantumRender build while trying to get reftests going we are running into a consistent crash. This seems to happen because of a race condition during shutdown. Specifically, the call at  triggers a call to EraseLayerState on the compositor thread . By the time this call runs, the corresponding CompositorBridgeParent has already been destroyed, leaving the mParent at  as a dangling pointer. Dereferencing that pointer then results in a crash. It seems that the shutdown sequence here is not particular well-defined, so the safest thing to do seems to be to make the LayerTreeState::mParent pointer a RefPtr rather than a raw pointer.  http://searchfox.org/mozilla-central/rev/59bb309e38b10aba63dea8505fb800e99fe821d6/layout/ipc/RenderFrameParent.cpp#228  http://searchfox.org/mozilla-central/rev/59bb309e38b10aba63dea8505fb800e99fe821d6/gfx/layers/ipc/CompositorBridgeParent.cpp#1568  http://searchfox.org/mozilla-central/rev/59bb309e38b10aba63dea8505fb800e99fe821d6/gfx/layers/ipc/CompositorBridgeParent.cpp#1548
Try push to make sure there's no leaks as a result: https://treeherder.mozilla.org/#/jobs?repo=try&revision=7c8a39e88e3194e2a750d005bbf223fb29b53644
Comment on attachment 8813356 [details] Bug 1319508 - Ensure that we don't leave dangling pointers to CompositorBridgeParent in LayerTreeState instances. https://reviewboard.mozilla.org/r/94778/#review95014
Attachment #8813356 - Flags: review?(dvander) → review+
Pushed by email@example.com: https://hg.mozilla.org/integration/autoland/rev/25c7f7eb112c Ensure that we don't leave dangling pointers to CompositorBridgeParent in LayerTreeState instances. r=dvander
You need to log in before you can comment on or make changes to this bug.