Closed Bug 1432472 Opened 2 years ago Closed 2 years ago

Crash in RtlEnterCriticalSection | mozilla::layers::CompositorBridgeChild::FlushAsyncPaints

Categories

(Core :: Graphics, defect, P3, critical)

Unspecified
All
defect

Tracking

()

RESOLVED FIXED
mozilla60
Tracking Status
firefox-esr52 --- unaffected
firefox58 --- wontfix
firefox59 --- wontfix
firefox60 --- fixed

People

(Reporter: aosmond, Assigned: aosmond)

Details

(Keywords: crash, Whiteboard: [gfx-noted])

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is
report bp-0030f8b0-4a44-4682-b928-26d4c0180119.
=============================================================

Top 10 frames of crashing thread:

0 ntdll.dll RtlEnterCriticalSection 
1 xul.dll mozilla::layers::CompositorBridgeChild::FlushAsyncPaints gfx/layers/ipc/CompositorBridgeChild.cpp:1171
2 xul.dll mozilla::gfx::DeviceManagerDx::ResetDevices gfx/thebes/DeviceManagerDx.cpp:786
3 xul.dll gfxWindowsPlatform::UpdateRenderMode gfx/thebes/gfxWindowsPlatform.cpp:456
4 xul.dll mozilla::dom::ContentChild::RecvReinitRendering dom/ipc/ContentChild.cpp:1383
5 xul.dll mozilla::dom::PContentChild::OnMessageReceived ipc/ipdl/PContentChild.cpp:5498
6 xul.dll mozilla::ipc::MessageChannel::DispatchAsyncMessage ipc/glue/MessageChannel.cpp:2110
7 xul.dll mozilla::ipc::MessageChannel::DispatchMessageW ipc/glue/MessageChannel.cpp:2040
8 xul.dll mozilla::ipc::MessageChannel::RunMessage ipc/glue/MessageChannel.cpp:1886
9 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1919

=============================================================

sCompositorBridge appears to be null, even though it should have been set by the CompositorManagerChild::CreateContentCompositorBridge call in ContentChild::RecvReinitRendering.
Assignee: nobody → aosmond
Status: NEW → ASSIGNED
There is another variant of this crash with the same signature, e.g.:

https://crash-stats.mozilla.com/report/index/0d6d20d1-4fe3-464f-bd38-0f44c0180122#tab-details

ContentChild::RecvReinitRenderingForDeviceReset is called instead of ContentChild::RecvReinitRendering. This doesn't have the guarantee for sCompositorBridge to be non-null.
OS: Windows 8 → Windows
Priority: -- → P3
Whiteboard: [gfx-noted]
Looks like there is *another* variant, e.g.:

https://crash-stats.mozilla.com/report/index/dfd69680-698e-4511-9013-8ba010180121

This doesn't involve the GPU process, so it happens on Mac too (in theory Linux?).
Crash Signature: [@ RtlEnterCriticalSection | mozilla::layers::CompositorBridgeChild::FlushAsyncPaints] → [@ RtlEnterCriticalSection | mozilla::layers::CompositorBridgeChild::FlushAsyncPaints] [@ RtlEnterCriticalSection | mozilla::detail::MutexImpl::lock | mozilla::layers::CompositorBridgeChild::FlushAsyncPaints] [@ pthread_mutex_lock | mozilla::detail::Mut…
OS: Windows → All
Attachment #8944818 - Flags: review?(rhunt) → review+
Pushed by aosmond@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/b7004af91c5b
Do not assume CompositorBridgeChild is available for FlushAsyncPaints. r=rhunt
https://hg.mozilla.org/mozilla-central/rev/b7004af91c5b
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla60
Please request Beta approval on this when you get a chance.
Flags: needinfo?(aosmond)
Until I understand what is going on with bug 1433646, I'd rather not uplift to beta. It *seems* correlated although I'm not entirely sure how.
Flags: needinfo?(aosmond)
Given that it's late in the cycle and this looks pretty low-frequency, should we just let this fix ride 60?
Flags: needinfo?(aosmond)
(In reply to Narcis Beleuzu [:NarcisB] from comment #5)
> https://hg.mozilla.org/mozilla-central/rev/b7004af91c5b

Yes. I fixed bug 1433646, and I have some speculation on why it caused those crashes, but I'm not confident enough in that reasoning to push them.
Flags: needinfo?(aosmond)
You need to log in before you can comment on or make changes to this bug.