1407283 - Crash in mozilla::layers::MaskOperation::Release

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect, P3)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-18de8926-1da7-4f50-96ef-e165f0171010.
=============================================================
Crashing Thread (21), Name: Compositor
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::layers::MaskOperation::Release() 	gfx/layers/mlgpu/MaskOperation.h:26
1 	xul.dll 	mozilla::layers::LayerMLGPU::PrepareToRender(mozilla::layers::FrameBuilder*, mozilla::gfx::IntRectTyped<mozilla::RenderTargetPixel> const&) 	gfx/layers/mlgpu/LayerMLGPU.cpp:57
2 	xul.dll 	mozilla::layers::FrameBuilder::AssignLayer(mozilla::layers::Layer*, mozilla::layers::RenderViewMLGPU*, mozilla::gfx::IntRectTyped<mozilla::RenderTargetPixel> const&, mozilla::Maybe<mozilla::gfx::PolygonTyped<mozilla::gfx::UnknownUnits> >&&) 	gfx/layers/mlgpu/FrameBuilder.cpp:127
3 	xul.dll 	mozilla::layers::FrameBuilder::ProcessChildList(mozilla::layers::ContainerLayer*, mozilla::layers::RenderViewMLGPU*, mozilla::gfx::IntRectTyped<mozilla::RenderTargetPixel> const&, mozilla::Maybe<mozilla::gfx::PolygonTyped<mozilla::gfx::UnknownUnits> > const&) 	gfx/layers/mlgpu/FrameBuilder.cpp:228
4 	xul.dll 	mozilla::layers::FrameBuilder::ProcessContainerLayer(mozilla::layers::ContainerLayer*, mozilla::layers::RenderViewMLGPU*, mozilla::gfx::IntRectTyped<mozilla::RenderTargetPixel> const&, mozilla::Maybe<mozilla::gfx::PolygonTyped<mozilla::gfx::UnknownUnits> >&) 	gfx/layers/mlgpu/FrameBuilder.cpp:172
5 	xul.dll 	mozilla::layers::FrameBuilder::AssignLayer(mozilla::layers::Layer*, mozilla::layers::RenderViewMLGPU*, mozilla::gfx::IntRectTyped<mozilla::RenderTargetPixel> const&, mozilla::Maybe<mozilla::gfx::PolygonTyped<mozilla::gfx::UnknownUnits> >&&) 	gfx/layers/mlgpu/FrameBuilder.cpp:122
6 	xul.dll 	mozilla::layers::FrameBuilder::Build() 	gfx/layers/mlgpu/FrameBuilder.cpp:72
7 	xul.dll 	mozilla::layers::LayerManagerMLGPU::RenderLayers() 	gfx/layers/mlgpu/LayerManagerMLGPU.cpp:351
8 	xul.dll 	mozilla::layers::LayerManagerMLGPU::Composite() 	gfx/layers/mlgpu/LayerManagerMLGPU.cpp:321
9 	xul.dll 	mozilla::layers::LayerManagerMLGPU::EndTransaction(mozilla::TimeStamp const&, mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/mlgpu/LayerManagerMLGPU.cpp:280
10 	xul.dll 	mozilla::layers::CompositorBridgeParent::CompositeToTarget(mozilla::gfx::DrawTarget*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const*) 	gfx/layers/ipc/CompositorBridgeParent.cpp:1041
11 	xul.dll 	mozilla::layers::CompositorVsyncScheduler::Composite(mozilla::TimeStamp) 	gfx/layers/ipc/CompositorVsyncScheduler.cpp:262
12 	xul.dll 	mozilla::detail::RunnableMethodImpl<mozilla::layers::CompositorVsyncScheduler* const, void ( mozilla::layers::CompositorVsyncScheduler::*)(mozilla::TimeStamp), 1, 1, mozilla::TimeStamp>::Run() 	xpcom/threads/nsThreadUtils.h:1192
13 	xul.dll 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc:535
14 	xul.dll 	base::MessagePumpForUI::DoRunLoop() 	ipc/chromium/src/base/message_pump_win.cc:210
15 	xul.dll 	base::MessagePumpWin::Run(base::MessagePump::Delegate*) 	ipc/chromium/src/base/message_pump_win.h:80
16 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:319
17 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:299
18 	xul.dll 	base::Thread::ThreadMain() 	ipc/chromium/src/base/thread.cc:181
19 	xul.dll 	`anonymous namespace'::ThreadFunc 	ipc/chromium/src/base/platform_thread_win.cc:28
20 	kernel32.dll 	BaseThreadInitThunk 	
21 	ntdll.dll 	RtlUserThreadStart 	
22 	kernel32.dll 	BasepReportFault 	
23 	kernel32.dll 	BasepReportFault

this crash signature is starting to show up a handful of times in 57.0b6.

Comment 1

[Milan Sreckovic [:milan] (needinfo for best results)]

Very low volume so far - David, any thoughts?  https://crash-stats.mozilla.com/report/index/2ee57806-3fec-4887-91ca-505550171011 is the one crash I could find in 58.
Bug 1381479 related?

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

It looks like a MaskOperation is being assigned to a Layer, and the previous MaskOperation is getting decref'd. It looks like the old one was already freed, or corrupted somehow, so we crash.

Unfortunately I can't see why this could happen... I don't see anything obvious that could cause an extra Release. Assigning myself to keep an eye on this.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

New signature: https://crash-stats.mozilla.com/report/index/c0fe7aac-eaf2-41a5-96cf-1d98e0180111

Comment 5

[Firefox Bug Husbandry Bot]

https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Move_fix-optionals

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.