1388332 - Crash when destroying Decoder with an unconfigured SurfacePipe after shutdown

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect, P3)

Description

[Andrew Osmond [:aosmond] (he/him)]

While making changes to animation decoding, I found a rare crash where an AnimationSurfaceProvider was freed indirectly by the cycle collector after shutdown has occurred. The Decoder owned by the AnimationSurfaceProvider had yet to begin actual decoding, so AnimationSurfaceProvider::mDecoder::mPipe was yet to be configured. The default state of a SurfacePipe is to contain NullSurfaceSink as its lone filter, which does nothing when called. It is special because it is a singleton (to avoid constant create/destroy for little purpose) and we avoid calling delete on the pointer by checking if the mPipe::mHead matches NullSurfaceSink::Singleton(). If shutdown already happened, NullSurfaceSink::Singleton() now returns null which doesn't match what we kept, which causes us to try freeing (again) the NullSurfaceSink.

I think the solution here should be to eliminate NullSurfaceSink entirely. mPipe::mHead can default to nullptr -- when we call any SurfacePipe operations, we should assert mHead is not null, because this is really a logic error in our state machines rather than a situation we need to support.

Stack trace:

#0  0x00007f3ce6f5d2ed in nanosleep () at ../sysdeps/unix/syscall-template.S:84
#1  0x00007f3ce6f5d23a in __sleep (seconds=0) at ../sysdeps/posix/sleep.c:55
#2  0x00007f3cd9253b41 in ah_crap_handler(int) (signum=signum@entry=11) at /moz/gecko-dev/toolkit/xre/nsSigHandlers.cpp:102
#3  0x00007f3cd9253b77 in child_ah_crap_handler(int) (signum=11) at /moz/gecko-dev/toolkit/xre/nsSigHandlers.cpp:114
#4  0x00007f3cd9b0767c in js::UnixExceptionHandler(int, siginfo_t*, void*) (signum=11, info=0x7ffd194781b0, context=0x7ffd19478080)
    at /moz/gecko-dev/js/src/ds/MemoryProtectionExceptionHandler.cpp:267
#5  0x00007f3cd9ee611a in WasmFaultHandler<(Signal)0>(int, siginfo_t*, void*) (signum=11, info=0x7ffd194781b0, context=0x7ffd19478080)
    at /moz/gecko-dev/js/src/wasm/WasmSignalHandlers.cpp:1402
#6  0x00007f3ce7d14670 in <signal handler called> () at /lib/x86_64-linux-gnu/libpthread.so.0
#7  0x00007f3cd593418d in mozilla::DefaultDelete<mozilla::image::SurfaceFilter>::operator()(mozilla::image::SurfaceFilter*) const (aPtr=0x7f3cc99252a0, this=<optimized out>) at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/UniquePtr.h:528
#8  0x00007f3cd593418d in mozilla::UniquePtr<mozilla::image::SurfaceFilter, mozilla::DefaultDelete<mozilla::image::SurfaceFilter> >::reset(mozilla::image::SurfaceFilter*) (aPtr=0x0, this=0x7f3ca2f136f0) at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/UniquePtr.h:343
#9  0x00007f3cd593418d in mozilla::UniquePtr<mozilla::image::SurfaceFilter, mozilla::DefaultDelete<mozilla::image::SurfaceFilter> >::~UniquePtr() (this=0x7f3ca2f136f0, __in_chrg=<optimized out>) at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/UniquePtr.h:288
#10 0x00007f3cd593418d in mozilla::image::SurfacePipe::~SurfacePipe() (this=0x7f3ca2f136f0, __in_chrg=<optimized out>)
    at /moz/gecko-dev/image/SurfacePipe.h:583
#11 0x00007f3cd591c698 in mozilla::image::nsGIFDecoder2::~nsGIFDecoder2() (this=0x7f3ca2f0f000, __in_chrg=<optimized out>)
    at /moz/gecko-dev/image/decoders/nsGIFDecoder2.cpp:96
#12 0x00007f3cd591c753 in mozilla::image::nsGIFDecoder2::~nsGIFDecoder2() (this=0x7f3ca2f0f000, __in_chrg=<optimized out>)
    at /moz/gecko-dev/image/decoders/nsGIFDecoder2.cpp:99
#13 0x00007f3cd58c76ec in mozilla::image::Decoder::Release() (this=0x7f3ca2f0f000) at /moz/gecko-dev/image/Decoder.h:95
#14 0x00007f3cd58c2552 in mozilla::RefPtrTraits<mozilla::image::Decoder>::Release(mozilla::image::Decoder*) (aPtr=<optimized out>)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:40
#15 0x00007f3cd58c2552 in RefPtr<mozilla::image::Decoder>::ConstRemovingRefPtrTraits<mozilla::image::Decoder>::Release(mozilla::image::Decoder*) (aPtr=<optimized out>) at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:395
#16 0x00007f3cd58c2552 in RefPtr<mozilla::image::Decoder>::~RefPtr() (this=0x7f3caf8abe70, __in_chrg=<optimized out>)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:78
#17 0x00007f3cd58c2552 in mozilla::image::AnimationSurfaceProvider::~AnimationSurfaceProvider() (this=0x7f3caf8abdc0, __in_chrg=<optimized out>)
    at /moz/gecko-dev/image/AnimationSurfaceProvider.cpp:50
#18 0x00007f3cd58c2659 in mozilla::image::AnimationSurfaceProvider::~AnimationSurfaceProvider() (this=this@entry=0x7f3caf8abdc0, __in_chrg=<optimized out>)
    at /moz/gecko-dev/image/AnimationSurfaceProvider.cpp:53
#19 0x00007f3cd58cb754 in mozilla::image::AnimationSurfaceProvider::Release() (this=0x7f3caf8abdc0) at /moz/gecko-dev/image/AnimationSurfaceProvider.h:31
#20 0x00007f3cd58fb468 in mozilla::RefPtrTraits<mozilla::image::ISurfaceProvider>::Release(mozilla::image::ISurfaceProvider*) (aPtr=<optimized out>)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:40
#21 0x00007f3cd58fb468 in RefPtr<mozilla::image::ISurfaceProvider>::ConstRemovingRefPtrTraits<mozilla::image::ISurfaceProvider>::Release(mozilla::image::ISurfaceProvider*) (aPtr=<optimized out>) at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:395
#22 0x00007f3cd58fb468 in RefPtr<mozilla::image::ISurfaceProvider>::~RefPtr() (this=0x7f3cafbea5b0, __in_chrg=<optimized out>)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:78
#23 0x00007f3cd58fb468 in mozilla::NotNull<RefPtr<mozilla::image::ISurfaceProvider> >::~NotNull() (this=0x7f3cafbea5b0, __in_chrg=<optimized out>)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/NotNull.h:102
#24 0x00007f3cd58fb468 in mozilla::image::CachedSurface::~CachedSurface() (this=0x7f3cafbea5a0, __in_chrg=<optimized out>)
    at /moz/gecko-dev/image/SurfaceCache.cpp:125
#25 0x00007f3cd58fb468 in mozilla::image::CachedSurface::Release() (this=0x7f3cafbea5a0) at /moz/gecko-dev/image/SurfaceCache.cpp:128
#26 0x00007f3cd590b66e in mozilla::RefPtrTraits<mozilla::image::CachedSurface>::Release(mozilla::image::CachedSurface*) (aPtr=<optimized out>)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:40
#27 0x00007f3cd590b66e in RefPtr<mozilla::image::CachedSurface>::ConstRemovingRefPtrTraits<mozilla::image::CachedSurface>::Release(mozilla::image::CachedSurface*) (aPtr=<optimized out>) at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:395
#28 0x00007f3cd590b66e in RefPtr<mozilla::image::CachedSurface>::~RefPtr() (this=0x7f3ca5017b78, __in_chrg=<optimized out>)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:78
#29 0x00007f3cd590b66e in nsBaseHashtableET<nsGenericHashKey<mozilla::image::SurfaceKey>, RefPtr<mozilla::image::CachedSurface> >::~nsBaseHashtableET() (this=0x7f3ca5017b40, __in_chrg=<optimized out>) at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/nsBaseHashtable.h:431
#30 0x00007f3cd590b68a in nsTHashtable<nsBaseHashtableET<nsGenericHashKey<mozilla::image::SurfaceKey>, RefPtr<mozilla::image::CachedSurface> > >::s_ClearEntry(PLDHashTable*, PLDHashEntryHdr*) (aTable=<optimized out>, aEntry=<optimized out>) at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/nsTHashtable.h:448
#31 0x00007f3cd4440e8c in PLDHashTable::~PLDHashTable() (this=0x7f3c9eb6fc88, __in_chrg=<optimized out>) at /moz/gecko-dev/xpcom/ds/PLDHashTable.cpp:318
#32 0x00007f3cd58ff07b in nsTHashtable<nsBaseHashtableET<nsGenericHashKey<mozilla::image::SurfaceKey>, RefPtr<mozilla::image::CachedSurface> > >::~nsTHashtable() (this=this@entry=0x7f3c9eb6fc88, __in_chrg=<optimized out>) at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/nsTHashtable.h:391
#33 0x00007f3cd58ff0f6 in nsBaseHashtable<nsGenericHashKey<mozilla::image::SurfaceKey>, RefPtr<mozilla::image::CachedSurface>, mozilla::image::CachedSurface*>::~nsBaseHashtable() (this=0x7f3c9eb6fc88, __in_chrg=<optimized out>) at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/nsBaseHashtable.h:52
#34 0x00007f3cd58ff0f6 in nsRefPtrHashtable<nsGenericHashKey<mozilla::image::SurfaceKey>, mozilla::image::CachedSurface>::~nsRefPtrHashtable() (this=0x7f3c9eb6fc88, __in_chrg=<optimized out>) at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/nsRefPtrHashtable.h:23
#35 0x00007f3cd58ff0f6 in mozilla::image::ImageSurfaceCache::~ImageSurfaceCache() (this=0x7f3c9eb6fc80, __in_chrg=<optimized out>)
    at /moz/gecko-dev/image/SurfaceCache.cpp:237
#36 0x00007f3cd58ff0f6 in mozilla::image::ImageSurfaceCache::Release() (this=this@entry=0x7f3c9eb6fc80) at /moz/gecko-dev/image/SurfaceCache.cpp:242
#37 0x00007f3cd58e57d6 in mozilla::RefPtrTraits<mozilla::image::ImageSurfaceCache>::Release(mozilla::image::ImageSurfaceCache*) (aPtr=0x7f3c9eb6fc80)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:40
#38 0x00007f3cd58e57d6 in RefPtr<mozilla::image::ImageSurfaceCache>::ConstRemovingRefPtrTraits<mozilla::image::ImageSurfaceCache>::Release(mozilla::image::ImageSurfaceCache*) (aPtr=0x7f3c9eb6fc80) at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:395
#39 0x00007f3cd58e57d6 in RefPtr<mozilla::image::ImageSurfaceCache>::~RefPtr() (this=0x7ffd194787c0, __in_chrg=<optimized out>)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:78
#40 0x00007f3cd58e57d6 in mozilla::image::SurfaceCacheImpl::RemoveImage(mozilla::image::Image*, mozilla::BaseAutoLock<mozilla::StaticMutex> const&) (aAutoLock=..., aImageKey=0x7f3cadbcdf10, this=<optimized out>) at /moz/gecko-dev/image/SurfaceCache.cpp:727
#41 0x00007f3cd58e57d6 in mozilla::image::SurfaceCache::RemoveImage(mozilla::image::Image*) (aImageKey=aImageKey@entry=0x7f3cadbcdf10)
    at /moz/gecko-dev/image/SurfaceCache.cpp:1132
#42 0x00007f3cd58e5ab9 in mozilla::image::RasterImage::~RasterImage() (this=0x7f3cadbcdf10, __in_chrg=<optimized out>)
    at /moz/gecko-dev/image/RasterImage.cpp:106
#43 0x00007f3cd58e6075 in mozilla::image::RasterImage::~RasterImage() (this=this@entry=0x7f3cadbcdf10, __in_chrg=<optimized out>)
    at /moz/gecko-dev/image/RasterImage.cpp:113
#44 0x00007f3cd58e6109 in mozilla::image::RasterImage::Release() (this=0x7f3cadbcdf10) at /moz/gecko-dev/image/RasterImage.cpp:66
#45 0x00007f3cd58e03d8 in mozilla::RefPtrTraits<mozilla::image::Image>::Release(mozilla::image::Image*) (aPtr=<optimized out>)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:40
#46 0x00007f3cd58e03d8 in RefPtr<mozilla::image::Image>::ConstRemovingRefPtrTraits<mozilla::image::Image>::Release(mozilla::image::Image*) (aPtr=<optimized out>) at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:395
#47 0x00007f3cd58e03d8 in RefPtr<mozilla::image::Image>::~RefPtr() (this=0x7f3cabe925b0, __in_chrg=<optimized out>)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:78
#48 0x00007f3cd58e03d8 in imgRequest::~imgRequest() (this=0x7f3cabe92420, __in_chrg=<optimized out>) at /moz/gecko-dev/image/imgRequest.cpp:76
#49 0x00007f3cd58e0645 in imgRequest::~imgRequest() (this=this@entry=0x7f3cabe92420, __in_chrg=<optimized out>) at /moz/gecko-dev/image/imgRequest.cpp:88
#50 0x00007f3cd58e06d9 in imgRequest::Release() (this=0x7f3cabe92420) at /moz/gecko-dev/image/imgRequest.cpp:47
#51 0x00007f3cd591728e in mozilla::RefPtrTraits<imgRequest>::Release(imgRequest*) (aPtr=<optimized out>)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:40
#52 0x00007f3cd591728e in RefPtr<imgRequest>::ConstRemovingRefPtrTraits<imgRequest>::Release(imgRequest*) (aPtr=<optimized out>)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:395
#53 0x00007f3cd591728e in RefPtr<imgRequest>::~RefPtr() (this=0x7f3cb14b5d28, __in_chrg=<optimized out>)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:78
#54 0x00007f3cd591728e in RequestBehaviour::~RequestBehaviour() (this=0x7f3cb14b5d20, __in_chrg=<optimized out>)
    at /moz/gecko-dev/image/imgRequestProxy.cpp:40
#55 0x00007f3cd591728e in RequestBehaviour::~RequestBehaviour() (this=0x7f3cb14b5d20, __in_chrg=<optimized out>)
    at /moz/gecko-dev/image/imgRequestProxy.cpp:40
#56 0x00007f3cd5910699 in mozilla::DefaultDelete<ProxyBehaviour>::operator()(ProxyBehaviour*) const (aPtr=<optimized out>, this=<optimized out>)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/UniquePtr.h:528
#57 0x00007f3cd5910699 in mozilla::UniquePtr<ProxyBehaviour, mozilla::DefaultDelete<ProxyBehaviour> >::reset(ProxyBehaviour*) (aPtr=0x0, this=0x7f3cabd3dcc0)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/UniquePtr.h:343
#58 0x00007f3cd5910699 in mozilla::UniquePtr<ProxyBehaviour, mozilla::DefaultDelete<ProxyBehaviour> >::~UniquePtr() (this=0x7f3cabd3dcc0, __in_chrg=<optimized out>) at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/UniquePtr.h:288
#59 0x00007f3cd5910699 in imgRequestProxy::~imgRequestProxy() (this=0x7f3cabd3dc80, __in_chrg=<optimized out>)
    at /moz/gecko-dev/image/imgRequestProxy.cpp:130
#60 0x00007f3cd5910c3d in imgRequestProxy::~imgRequestProxy() (this=0x7f3cabd3dc80, __in_chrg=<optimized out>)
    at /moz/gecko-dev/image/imgRequestProxy.cpp:176
#61 0x00007f3cd590c204 in imgRequestProxy::Release() (this=0x7f3cabd3dc80) at /moz/gecko-dev/image/imgRequestProxy.cpp:99
#62 0x00007f3cd5a36778 in mozilla::RefPtrTraits<imgRequestProxy>::Release(imgRequestProxy*) (aPtr=<optimized out>)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:40
#63 0x00007f3cd5a36778 in RefPtr<imgRequestProxy>::ConstRemovingRefPtrTraits<imgRequestProxy>::Release(imgRequestProxy*) (aPtr=<optimized out>)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:395
#64 0x00007f3cd5a36778 in RefPtr<imgRequestProxy>::assign_assuming_AddRef(imgRequestProxy*) (aNewPtr=0x0, this=0x7f3cad83dd10)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:65
#65 0x00007f3cd5a36778 in RefPtr<imgRequestProxy>::operator=(decltype(nullptr)) (this=0x7f3cad83dd10)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:166
#66 0x00007f3cd5a36778 in nsImageLoadingContent::ClearCurrentRequest(nsresult, mozilla::Maybe<mozilla::OnNonvisible> const&) (this=this@entry=0x7f3cad83dcf8, aReason=aReason@entry=-2142568446, aNonvisibleAction=...) at /moz/gecko-dev/dom/base/nsImageLoadingContent.cpp:1525
#67 0x00007f3cd5a369c5 in nsImageLoadingContent::DestroyImageLoadingContent() (this=this@entry=0x7f3cad83dcf8)
    at /moz/gecko-dev/dom/base/nsImageLoadingContent.cpp:116
#68 0x00007f3cd6acb4fa in mozilla::dom::HTMLImageElement::~HTMLImageElement() (this=0x7f3cad83dc70, __in_chrg=<optimized out>)
    at /moz/gecko-dev/dom/html/HTMLImageElement.cpp:132
#69 0x00007f3cd6acb5c9 in mozilla::dom::HTMLImageElement::~HTMLImageElement() (this=0x7f3cad83dc70, __in_chrg=<optimized out>)
    at /moz/gecko-dev/dom/html/HTMLImageElement.cpp:133
#70 0x00007f3cd5a761f3 in mozilla::dom::FragmentOrElement::DeleteCycleCollectable() (this=<optimized out>)
    at /moz/gecko-dev/dom/base/FragmentOrElement.cpp:2147
#71 0x00007f3cd5aac08c in mozilla::dom::FragmentOrElement::cycleCollection::DeleteCycleCollectable(void*) (this=<optimized out>, p=<optimized out>)
    at /moz/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/dom/FragmentOrElement.h:195
#72 0x00007f3cd4421827 in SnowWhiteKiller::~SnowWhiteKiller() (this=0x7ffd19478b90, __in_chrg=<optimized out>)
    at /moz/gecko-dev/xpcom/base/nsCycleCollector.cpp:2658
#73 0x00007f3cd44189da in nsCycleCollector::FreeSnowWhite(bool) (this=this@entry=0x7f3ce6a4fec0, aUntilNoSWInPurpleBuffer=aUntilNoSWInPurpleBuffer@entry=true) at /moz/gecko-dev/xpcom/base/nsCycleCollector.cpp:2839
#74 0x00007f3cd441b961 in nsCycleCollector::BeginCollection(ccType, nsICycleCollectorListener*) (this=this@entry=0x7f3ce6a4fec0, aCCType=aCCType@entry=ShutdownCC, aManualListener=aManualListener@entry=0x0) at /moz/gecko-dev/xpcom/base/nsCycleCollector.cpp:3850
#75 0x00007f3cd441cb38 in nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*, bool) (this=this@entry=0x7f3ce6a4fec0, aCCType=aCCType@entry=ShutdownCC, aBudget=..., aManualListener=aManualListener@entry=0x0, aPreferShorterSlices=aPreferShorterSlices@entry=false)
    at /moz/gecko-dev/xpcom/base/nsCycleCollector.cpp:3671
#76 0x00007f3cd441cd55 in nsCycleCollector::ShutdownCollect() (this=this@entry=0x7f3ce6a4fec0) at /moz/gecko-dev/xpcom/base/nsCycleCollector.cpp:3612
#77 0x00007f3cd441cdd7 in nsCycleCollector::Shutdown(bool) (this=0x7f3ce6a4fec0, aDoCollect=aDoCollect@entry=true)
    at /moz/gecko-dev/xpcom/base/nsCycleCollector.cpp:3907
#78 0x00007f3cd441ce91 in nsCycleCollector_shutdown(bool) (aDoCollect=aDoCollect@entry=true) at /moz/gecko-dev/xpcom/base/nsCycleCollector.cpp:4266
#79 0x00007f3cd44ef463 in mozilla::ShutdownXPCOM(nsIServiceManager*) (aServMgr=<optimized out>, aServMgr@entry=0x0)
    at /moz/gecko-dev/xpcom/build/XPCOMInit.cpp:987
#80 0x00007f3cd44ef680 in NS_ShutdownXPCOM(nsIServiceManager*) (aServMgr=aServMgr@entry=0x0) at /moz/gecko-dev/xpcom/build/XPCOMInit.cpp:824
#81 0x00007f3cd9250a6f in XRE_TermEmbedding() () at /moz/gecko-dev/toolkit/xre/nsEmbedFunctions.cpp:224
#82 0x00007f3cd4b2e19c in mozilla::ipc::ScopedXREEmbed::Stop() (this=0x7f3ce6a26a58) at /moz/gecko-dev/ipc/glue/ScopedXREEmbed.cpp:117
#83 0x00007f3cd72863c4 in mozilla::dom::ContentProcess::CleanUp() (this=<optimized out>) at /moz/gecko-dev/dom/ipc/ContentProcess.cpp:262
#84 0x00007f3cd9251f00 in XRE_InitChildProcess(int, char**, XREChildData const*) (aArgc=13, aArgv=0x7ffd194792b8, aChildData=<optimized out>)
    at /moz/gecko-dev/toolkit/xre/nsEmbedFunctions.cpp:703
#85 0x00007f3cd925fa3f in mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) (this=<optimized out>, argc=<optimized out>, argv=<optimized out>, aChildData=<optimized out>) at /moz/gecko-dev/toolkit/xre/Bootstrap.cpp:65
#86 0x0000560ae8256f3a in content_process_main(mozilla::Bootstrap*, int, char**) (bootstrap=0x7f3ce6abb0a8, argc=15, argv=0x7ffd194792b8)
    at /moz/gecko-dev/browser/app/../../ipc/contentproc/plugin-container.cpp:64
#87 0x0000560ae8257277 in main(int, char**, char**) (argc=16, argv=0x7ffd194792b8, envp=0x7ffd19479340) at /moz/gecko-dev/browser/app/nsBrowserApp.cpp:285

Comment 1

[Andrew Osmond [:aosmond] (he/him)]

Attachment: Fix a shutdown crash when destroying image decoders before initializing its SurfacePipe., v1

try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=9d6c4daffad7ba7d178d601f39d5a99b8dab37a8

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/125b73295e1e
Fix a shutdown crash when destroying image decoders before initializing its SurfacePipe. r=tnikkel

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/125b73295e1e