1505061 - Android crash in mozilla::ipc::ByteBuf::operator=

Status: RESOLVED WORKSFORME

(Core :: Audio/Video, defect, P3)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-4ca58306-bf30-491a-bd96-1bfcb0181106.
=============================================================

Seen while looking at nightly crash data 20181025100245: . Small volume crash which appears to have started using 20181025100245. 16 crashes/11 installs so far. No comments or correlations, but one URL looked to be someone watching live tv.

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=c29f681979ee3d1ec49a3f2563a1030cf5b8ac94&tochange=3cc04ee79005058d817daf66da7963dfac3f0a3a 

Top 10 frames of crashing thread:

0 libxul.so mozilla::ipc::ByteBuf::operator= android-ndk/sources/cxx-stl/llvm-libc++/include/type_traits:4458
1 libxul.so void nsPurpleBuffer::VisitEntries<SnowWhiteKiller> xpcom/base/nsCycleCollector.cpp:1143
2 libxul.so nsCycleCollector::FreeSnowWhiteWithBudget xpcom/base/nsCycleCollector.cpp:2980
3 libxul.so AsyncFreeSnowWhite::Run js/xpconnect/src/XPCJSRuntime.cpp:139
4 libxul.so IdleRunnableWrapper::Run xpcom/threads/nsThreadUtils.cpp:354
5 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1246
6 libxul.so NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:530
7 libxul.so mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:97
8 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:325
9 libxul.so nsBaseAppShell::Run widget/nsBaseAppShell.cpp:158

=============================================================

Comment 1

[Marcia Knous [:marcia]]

16 crashes/18 installations so far.

Comment 2

[Marcia Knous [:marcia]]

One of the crashes does have this as Moz Crash Reason: MOZ_RELEASE_ASSERT(run->mMagic == 0x384adf93)

Comment 3

[Andrew McCreight [:mccr8]]

Based on the range in comment 0, this may be another signature change from enabling LTO on Android.

Comment 4

[Andrew McCreight [:mccr8]]

The weird thing is that I don't see where ByteBuf::operator= is used outside of CrossProcessPaint. Ryan, would you expect that code to be run on Android?

Comment 5

[Andrew McCreight [:mccr8]]

I'm not sure which cycle collected class might have a dtor that would assign a ByteBuf.

Comment 6

[Mike Hommey [:glandium]]

LTO was backed out a while ago, so recent builds can't be having this problem because of this (and the buildid in the linked crash report is fairly recent)

Comment 7

[Andrew McCreight [:mccr8]]

Ah, I interpreted some comment you made as meaning that it had been relanded. Sorry.

Comment 8

[Mike Hommey [:glandium]]

It had relanded, and was re-backed out.

Comment 9

[Ryan Hunt [:rhunt]]

CrossProcessPaint should not be used on any platform currently. It's just a backend implementation that needs a better frontend API, and then users converted to use it.

Comment 10

[Marcia Knous [:marcia]]

Some URLs:

*https://open.spotify.com/queue 
*netflix.com

Comment 11

[Marcia Knous [:marcia]]

Google Pixel Device is in the mix, I will try to get some more URLs but given the fact this is consistently happening on nightly and we have 29 crashes in the last 7 days, we should probably at least try to reproduce.

Comment 12

[Marcia Knous [:marcia]]

Another URL: https://www.forbes.com/sites/jasonbloomberg/2018/11/25/bernie-madoff-move-over-stablecoins-have-you-beat/amp/?__twitter_impression=true

Comment 13

[Marcia Knous [:marcia]]

18 crashes/13 installs in the last 7 days on 65. Only one new URL: https://medium.com/topic/visual-design 

It appears this also affects the firefox reality product - 7 crashes/6 installs there as well.

Comment 14

[Marcia Knous [:marcia]]

Marking 66 as affected based on crash stats.

Comment 15

[Marcia Knous [:marcia]]

Number 4 top browser crash on nightly, adding keyword. Some additional URLs show this seems to be happening more when playing media:

*https://www.tvnow.de/serien/gzsz-1/2018-12/episode-6657-tuner-braucht-ablenkung-1333773
*https://www.netflix.com/

Comment 16

[Kevin Brosnan [Ex-Mozilla]]

All the URLs seem to be media playback moving to Core.

Comment 17

[Ryan VanderMeulen [:RyanVM]]

Not seeing this on Beta65, so calling it fix-optional there. Will still consider an uplift if there's a low-risk patch ready in time.

Comment 18

[Chris Peterson [:cpeterson]]

We don't need to track this crash for GV.

Comment 19

[Marcia Knous [:marcia]]

While this was a top crash at one time, the volume had dwindled. According to crash stats, it also affects the Firefox Reality product.

Comment 20

[Marcia Knous [:marcia]]

Clearing ni for Ioana as there is nothing to investigate at this point.

Comment 21

[Marcia Knous [:marcia]]

No crashes in 68 release. Closing this one out as WFM.