1416782 - Crash in RtlEnterCriticalSection | mozilla::layers::PaintThread::AsyncPrepareBuffer

Status: RESOLVED FIXED

(Core :: Graphics, defect, P1)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-4ad2b659-b027-4ee7-90a0-3f3260171112.
=============================================================

Seen while looking at nightly crash stats - this crash started using 20171111100349: http://bit.ly/2zAmbXg.

Possible regression ranged based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=864174ac0707207f7fc698ed6c3c47c043e99395&tochange=8e788d9983b80c7cf6ed021f1536dd8a97941674

Bug 1399692? ni on :rhunt since he touched code in this area

Top 10 frames of crashing thread:

0 ntdll.dll RtlEnterCriticalSection 
1 xul.dll mozilla::layers::PaintThread::AsyncPrepareBuffer gfx/layers/PaintThread.cpp:260
2 xul.dll mozilla::detail::RunnableFunction<<lambda_fc57ee2b668bfe8afc9d03a6cee1a939> >::Run xpcom/threads/nsThreadUtils.h:529
3 xul.dll mozilla::SyncRunnable::Run xpcom/threads/SyncRunnable.h:112
4 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1037
5 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:513
6 xul.dll mozilla::ipc::MessagePumpForNonMainThreads::Run ipc/glue/MessagePump.cpp:364
7 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:319
8 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:299
9 xul.dll nsThread::ThreadFunc xpcom/threads/nsThread.cpp:425

=============================================================

Comment 1

[Ryan Hunt [:rhunt] (on leave until early May)]

Attachment: pt-sync-prepare.patch

Somehow it looks like sync omtp is enabled for this user. When this happens, cbc will be nullptr. AsyncPaintContents will check this before calling cbc->NotifyFinishedAsyncPaint. We should do the same for AsyncPrepareBuffer.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2e6eb350eb75
Don't use CompositorBridgeChild in PrepareBuffer if sync OMTP is enabled (bug 1416782, r=dvander)

Comment 3

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/2e6eb350eb75

Comment 4

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for Beta approval.

Comment 5

[Ryan Hunt [:rhunt] (on leave until early May)]

Comment on attachment 8927898 [details] [diff] [review]
pt-sync-prepare.patch

Approval Request Comment
[Feature/Bug causing the regression]: Users enabling an OMTP preference meant for development would cause a crash from a new feature that wasn't tested with the development pref enabled.
[User impact if declined]: Users enabling this development pref will crash
[Is this code covered by automated tests?]: No
[Has the fix been verified in Nightly?]: Yes
[Needs manual test from QE? If yes, steps to reproduce]: No
[List of other uplifts needed for the feature/fix]: None
[Is the change risky?]: No
[Why is the change risky/not risky?]: Just a null pointer check
[String changes made/needed]:

Comment 6

[Gerry Chang [:gchang]]

Comment on attachment 8927898 [details] [diff] [review]
pt-sync-prepare.patch

Fix a crash. Beta58+.

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/releases/mozilla-beta/rev/645141391be7