1405518 - Crash in mozilla::layers::ClientLayerManager::ForwardTransaction

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Nicholas Nethercote [inactive]]

This bug was filed from the Socorro interface and is 
report bp-53ac2d4e-cff2-4a97-8128-fe2290171003.
=============================================================

Moderately frequent bug: 37 occurrences of this in the past 7 days, but 54% of those are in Nightly 58; given Nightly's small userbase this means that it's *much* more common in Nightly, as if something changed recently.

The crashing addresses are all over the place: 0x18131655, 0xd, 0xffffffffffffffff.

Looks like the recent spike started in Nightly 20170929220356, which gives this regression window:

https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=946b9c995ec331f4f96360409fd8d2fc49e46838&tochange=57f68296c350469d73d788eb3695a898947b4acb

That window includes the first enabling of OMTP (bug 1403935), so that could be a factor. Bas, any ideas?

Comment 1

[Bas Schouten (:bas.schouten)]

It seems unlikely given the stack, but it's certainly hard to ignore given the data.. is there a drop after the 30th and a rise again after the 3rd?

Comment 2

[Milan Sreckovic [:milan] (needinfo for best results)]

Paint thread doesn't seem to be doing anything at the time of the crash.

Comment 3

[Nicholas Nethercote [inactive]]

(In reply to Bas Schouten (:bas.schouten) from comment #1)
> It seems unlikely given the stack, but it's certainly hard to ignore given
> the data.. is there a drop after the 30th and a rise again after the 3rd?

Here is a search for this signature in FF58, faceted by build id:
https://crash-stats.mozilla.com/search/?signature=~mozilla%3A%3Alayers%3A%3AClientLayerManager%3A%3AForwardTransaction&version=58.0a1&date=%3E%3D2017-09-27T23%3A45%3A00.000Z&date=%3C2017-10-04T23%3A45%3A00.000Z&_sort=-date&_facets=signature&_facets=build_id&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-build_id

The answer is: not really. No crashes on the 1st, but crashes on the 29th, 30th, and 2nd.

Comment 4

[Bas Schouten (:bas.schouten)]

(In reply to Nicholas Nethercote [:njn] from comment #3)
> (In reply to Bas Schouten (:bas.schouten) from comment #1)
> > It seems unlikely given the stack, but it's certainly hard to ignore given
> > the data.. is there a drop after the 30th and a rise again after the 3rd?
> 
> Here is a search for this signature in FF58, faceted by build id:
> https://crash-stats.mozilla.com/search/
> ?signature=~mozilla%3A%3Alayers%3A%3AClientLayerManager%3A%3AForwardTransacti
> on&version=58.0a1&date=%3E%3D2017-09-27T23%3A45%3A00.000Z&date=%3C2017-10-
> 04T23%3A45%3A00.000Z&_sort=-
> date&_facets=signature&_facets=build_id&_columns=date&_columns=signature&_col
> umns=product&_columns=version&_columns=build_id&_columns=platform#facet-
> build_id
> 
> The answer is: not really. No crashes on the 1st, but crashes on the 29th,
> 30th, and 2nd.

OMTP made it back in the night of the 2nd, so it may very well have made it into that build. So I'm going to bet this is a refcounting race. I have an idea.

Comment 5

[Bas Schouten (:bas.schouten)]

Yup, I'm practically certain I know the cause.

Comment 6

[Bas Schouten (:bas.schouten)]

Attachment: Bug 1405518: Make SyncObjectClient atomically refcounted as it may be accessed both on the paint and the main thread.

Review commit: https://reviewboard.mozilla.org/r/186758/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/186758/

Comment 7

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 8915551 [details]
Bug 1405518: Make SyncObjectClient atomically refcounted as it may be accessed both on the paint and the main thread.

https://reviewboard.mozilla.org/r/186758/#review191878

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/fb3f3e05a357
Make SyncObjectClient atomically refcounted as it may be accessed both on the paint and the main thread. r=dvander

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/fb3f3e05a357