1432472 - Crash in RtlEnterCriticalSection | mozilla::layers::CompositorBridgeChild::FlushAsyncPaints

Status: RESOLVED FIXED

(Core :: Graphics, defect, P3)

Description

[Andrew Osmond [:aosmond] (he/him)]

This bug was filed from the Socorro interface and is
report bp-0030f8b0-4a44-4682-b928-26d4c0180119.
=============================================================

Top 10 frames of crashing thread:

0 ntdll.dll RtlEnterCriticalSection 
1 xul.dll mozilla::layers::CompositorBridgeChild::FlushAsyncPaints gfx/layers/ipc/CompositorBridgeChild.cpp:1171
2 xul.dll mozilla::gfx::DeviceManagerDx::ResetDevices gfx/thebes/DeviceManagerDx.cpp:786
3 xul.dll gfxWindowsPlatform::UpdateRenderMode gfx/thebes/gfxWindowsPlatform.cpp:456
4 xul.dll mozilla::dom::ContentChild::RecvReinitRendering dom/ipc/ContentChild.cpp:1383
5 xul.dll mozilla::dom::PContentChild::OnMessageReceived ipc/ipdl/PContentChild.cpp:5498
6 xul.dll mozilla::ipc::MessageChannel::DispatchAsyncMessage ipc/glue/MessageChannel.cpp:2110
7 xul.dll mozilla::ipc::MessageChannel::DispatchMessageW ipc/glue/MessageChannel.cpp:2040
8 xul.dll mozilla::ipc::MessageChannel::RunMessage ipc/glue/MessageChannel.cpp:1886
9 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1919

=============================================================

sCompositorBridge appears to be null, even though it should have been set by the CompositorManagerChild::CreateContentCompositorBridge call in ContentChild::RecvReinitRendering.

Comment 1

[Andrew Osmond [:aosmond] (he/him)]

There is another variant of this crash with the same signature, e.g.:

https://crash-stats.mozilla.com/report/index/0d6d20d1-4fe3-464f-bd38-0f44c0180122#tab-details

ContentChild::RecvReinitRenderingForDeviceReset is called instead of ContentChild::RecvReinitRendering. This doesn't have the guarantee for sCompositorBridge to be non-null.

Comment 2

[Andrew Osmond [:aosmond] (he/him)]

Looks like there is *another* variant, e.g.:

https://crash-stats.mozilla.com/report/index/dfd69680-698e-4511-9013-8ba010180121

This doesn't involve the GPU process, so it happens on Mac too (in theory Linux?).

Comment 3

[Andrew Osmond [:aosmond] (he/him)]

Attachment: 0001-Bug-1432472-Do-not-assume-CompositorBridgeChild-is-a.patch, v1

try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=29dcf2105bf87a5f50d8cb7025d1989a28e26474

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/b7004af91c5b
Do not assume CompositorBridgeChild is available for FlushAsyncPaints. r=rhunt

Comment 5

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/b7004af91c5b

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Please request Beta approval on this when you get a chance.

Comment 7

[Andrew Osmond [:aosmond] (he/him)]

Until I understand what is going on with bug 1433646, I'd rather not uplift to beta. It *seems* correlated although I'm not entirely sure how.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Given that it's late in the cycle and this looks pretty low-frequency, should we just let this fix ride 60?

Comment 9

[Andrew Osmond [:aosmond] (he/him)]

(In reply to Narcis Beleuzu [:NarcisB] from comment #5)
> https://hg.mozilla.org/mozilla-central/rev/b7004af91c5b

Yes. I fixed bug 1433646, and I have some speculation on why it caused those crashes, but I'm not confident enough in that reasoning to push them.