1521183 - Crash in VRSystemManagerExternal::PullState when VR process is killed.

Status: RESOLVED FIXED

(Core :: WebVR, defect)

Description

[Daosheng Mu[:daoshengmu]]

Reproduce steps:

1. Open FF and visit https://webvr.info/samples/04-simple-mirroring.html
2. Wear on a VR headset and click enter to enter the immersive mode.
3. Kill VR process in Process Explorer.

Then, it will break at VRSystemManagerExternal::PullState in GPU process. The reason I think it is race condition with "VR_SubmitFrame" thread. Even though the VR process has been shutdown, the VR_SubmitFrame is still working on its task. We should use CancelableRunnable task as https://dxr.mozilla.org/mozilla-central/rev/c2593a3058afdfeaac5c990e18794ee8257afe99/gfx/layers/ipc/CompositorVsyncScheduler.cpp#125. When VR process is killed, we need to cancel the current CancelableRunnable task.

Comment 1

[Daosheng Mu[:daoshengmu]]

The reason of this crash is because VRDisplay is set to nullptr and release its shmem, but mSubmitThread is still running. then we invalidate access the shmem.

Comment 2

[Daosheng Mu[:daoshengmu]]

Attachment: Bug 1521183 - Avoid access VR shmem when VR process is crashed accidentally.

Comment 3

[Daosheng Mu[:daoshengmu]]

We were accessing VRSystemManagerExternal in VRDisplayExternal, that makes us difficult to manage the program flow especially when VRSystemManagerExternal::Shutdown(). Once calling VRSystemManagerExternal::Shutdown(), We will destroy VRDisplayExternal and close Shmem, but they are still possible to be accessed by other threads if they still hold the VRDisplayExternal's refPtr.

[1] https://dxr.mozilla.org/mozilla-central/rev/7f816aa10a2053973c4e6977c5d6f6bf15f38820/gfx/vr/gfxVRExternal.cpp#420
[2] https://dxr.mozilla.org/mozilla-central/rev/7f816aa10a2053973c4e6977c5d6f6bf15f38820/gfx/vr/gfxVRExternal.cpp#406

Comment 4

[Daosheng Mu[:daoshengmu]]

Try looks good, https://treeherder.mozilla.org/#/jobs?repo=try&revision=5584967ea382d78c6e7d2cd4ddfc08460308eb0e

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/mozilla-central/rev/56c9aef4b07f
Avoid access VR shmem when VR process is crashed accidentally. r=kip

Comment 6

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/56c9aef4b07f

Comment 7

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/56c9aef4b07f

Comment 8

[Cristian Comorasu, QA [:ccomorasu], Releae Desktop QA - Please contact [e-mail]]

Due to hardware issues we could not verify this bug.