Closed Bug 1443187 Opened 2 years ago Closed 2 years ago

Crash in mozilla::layers::APZCTreeManager::NotifyLayerTreeAdopted


(Core :: Panning and Zooming, defect, P3, critical)

Windows 10



Tracking Status
firefox-esr52 --- unaffected
firefox58 --- unaffected
firefox59 --- unaffected
firefox60 --- fixed


(Reporter: marcia, Assigned: kats)



(Keywords: crash, regression, Whiteboard: [gfx-noted])

Crash Data


(1 file)

This bug was filed from the Socorro interface and is
report bp-87d321dc-94eb-4051-a4a7-2fcfa0180304.

Seen while reviewing nightly crash data - crashes started using 20180303100406:

Possible regression range based on Build ID:

Bug 1441916 landed in that timeframe.

Top 10 frames of crashing thread:

0 xul.dll mozilla::layers::APZCTreeManager::NotifyLayerTreeAdopted gfx/layers/apz/src/APZCTreeManager.cpp:275
1 xul.dll mozilla::layers::CompositorBridgeParent::RecvAdoptChild gfx/layers/ipc/CompositorBridgeParent.cpp:1716
2 xul.dll mozilla::layers::PCompositorBridgeParent::OnMessageReceived ipc/ipdl/PCompositorBridgeParent.cpp:761
3 xul.dll mozilla::layers::PCompositorManagerParent::OnMessageReceived ipc/ipdl/PCompositorManagerParent.cpp:121
4 xul.dll mozilla::ipc::MessageChannel::DispatchAsyncMessage ipc/glue/MessageChannel.cpp:2133
5 xul.dll mozilla::ipc::MessageChannel::DispatchMessageW ipc/glue/MessageChannel.cpp:2063
6 xul.dll mozilla::ipc::MessageChannel::RunMessage ipc/glue/MessageChannel.cpp:1909
7 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1942
8 xul.dll MessageLoop::DoWork ipc/chromium/src/base/
9 xul.dll base::MessagePumpForUI::DoRunLoop ipc/chromium/src/base/

Flags: needinfo?(bugmail)
Assignee: nobody → bugmail
Blocks: 1441916
Flags: needinfo?(bugmail)
The crash seems to be because a layer tree is getting "adopted" but it doesn't have an oldApzSampler. The comment at [1] implies that it's possible for a document which has no presentation (and therefore no layer tree) to trigger an "adoption" message. In this case there would be no "old" APZSampler. So I guess we should handle that case more gracefully.

Priority: -- → P3
Whiteboard: [gfx-noted]
Comment on attachment 8956464 [details]
Bug 1443187 - Avoid crashing if a previously-uncomposited layer tree gets adopted.

::: gfx/layers/ipc/CompositorBridgeParent.cpp
(Diff revision 1)
>    }
> -  // We don't support moving a child from a APZ-enabled compositor to a
> -  // APZ-disabled compostior. The mOptions assertion above should already
> -  // ensure this, since APZ-ness is one of the things in mOptions.
> -  MOZ_ASSERT((oldApzSampler != nullptr) == (mApzSampler != nullptr));

Can we keep in place a weaker version of this assertion, like:

  if (oldApzSampler) {
Attachment #8956464 - Flags: review?(botond) → review+
(In reply to Botond Ballo [:botond] from comment #4)
> Can we keep in place a weaker version of this assertion, like:
>   if (oldApzSampler) {
>     MOZ_ASSERT(mApzSampler);
>   }

Sure, that seems reasonable.
Pushed by
Avoid crashing if a previously-uncomposited layer tree gets adopted. r=botond
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla60
You need to log in before you can comment on or make changes to this bug.