1451302 - Crash in mozilla::layers::ComputeVisibleRegionForChildren

Status: RESOLVED WORKSFORME

(Core :: Graphics: Layers, defect, P2)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is
report bp-9dd21178-bb36-48d0-b03e-332520180314.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll mozilla::layers::ComputeVisibleRegionForChildren gfx/layers/composite/LayerManagerComposite.cpp:1524
1 xul.dll mozilla::layers::ComputeVisibleRegionForChildren gfx/layers/composite/LayerManagerComposite.cpp:1529
2 xul.dll mozilla::layers::RefLayerMLGPU::GetShadowVisibleRegion gfx/layers/mlgpu/ContainerLayerMLGPU.cpp:261
3 xul.dll mozilla::layers::ContainerLayer::DefaultComputeEffectiveTransforms gfx/layers/Layers.cpp:1245
4 xul.dll mozilla::layers::LayerManagerComposite::UpdateAndRender gfx/layers/composite/LayerManagerComposite.cpp:482
5 xul.dll mozilla::layers::LayerManagerComposite::EndTransaction gfx/layers/composite/LayerManagerComposite.cpp:463
6 xul.dll mozilla::layers::CompositorBridgeParent::CompositeToTarget gfx/layers/ipc/CompositorBridgeParent.cpp:1049
7 xul.dll mozilla::layers::CompositorVsyncScheduler::Composite gfx/layers/ipc/CompositorVsyncScheduler.cpp:280
8 xul.dll mozilla::detail::RunnableMethodImpl<mozilla::layers::CompositorVsyncScheduler*, void  xpcom/threads/nsThreadUtils.h:1193
9 xul.dll MessageLoop::DoWork ipc/chromium/src/base/message_loop.cc:535

=============================================================

crashes with this signature are starting to show up across platforms since firefox 57 with fairly low volume, perhaps related to bug 1381753.

Comment 1

[Stephanie Ouillon [:arroway] (needinfo me)]

Milan, could you assign somebody to investigate this sec-high bug?
Thx!

Comment 2

[Milan Sreckovic [:milan] (needinfo for best results)]

Bas, Nical, UAF in LayerManagerComposite, perhaps related to advanced layers?

Comment 3

[Milan Sreckovic [:milan] (needinfo for best results)]

Perhaps related to bug 1451297?  Probably a stretch.

Comment 4

[Bas Schouten (:bas.schouten)]

(In reply to Milan Sreckovic [:milan] from comment #3)
> Perhaps related to bug 1451297?  Probably a stretch.

Nical would know better, but since this is an actual UAF of a layer, and ImageBridge is the only place I know of where we handle layers off the main thread. It seems reasonable to expect ImageBridge to be related somehow.

Comment 5

[David Bolter [:davidb] (NeedInfo me for attention)]

Is this stalled? Any new ideas?

Comment 6

[Maire Reavy [:mreavy]]

Adding Jessie (new graphics engineering manager) to all sec-crit and sec-high graphics bugs

Comment 7

[Nicolas Silva [:nical]]

> Nical would know better, but since this is an actual UAF of a layer, and ImageBridge is the only place I know of where we handle layers off the main thread. It seems reasonable to expect ImageBridge to be related somehow.

On the parent process the image bridge lives on the compositor thread. In fact I don't know of anything that touches layers off the compositor thread. I had a quick look at the shutdown code in case something might accidentally trigger some destruction code from the main thread but I didn't see anything obvious there.

It might not be thread related but rather something about deinitializing a container layer that is still referred to by a ref layer. Looking at the other reports it doesn't seem to be specific to advanced layers.

Comment 8

[David Lawrence [:dkl]]

Removing employee no longer with company from CC list of private bugs.

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

Redirect a needinfo that is pending on an inactive user to the triage owner.
:bhood, since the bug has high priority and high severity, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 10

[Bob Hood [:bhood]]

Nical, I'm tagging you on this since you've been involved previously: Can we verify that this is still an issue with current code?

Comment 11

[Nicolas Silva [:nical]]

Looks like all of the crash reports are pre-webrender versions of firefox.

Comment 12

[BugBot [:suhaib / :marco/ :calixte]]

Since the bug is closed, the stalled keyword is now meaningless.
For more information, please visit auto_nag documentation.