1570230 - Crash in [@ mozilla::gfx::VRShMem::JoinShMem]

Status: RESOLVED FIXED

(Core :: WebVR, defect)

Description

[Calixte Denizet (:calixte)]

This bug is for crash report bp-0362e851-cb5f-4995-b725-5659b0190730.

Top 10 frames of crashing thread:

0 xul.dll mozilla::gfx::VRShMem::JoinShMem gfx/vr/VRShMem.cpp:279
1 xul.dll void mozilla::gfx::VRService::ServiceInitialize gfx/vr/service/VRService.cpp:151
2 xul.dll nsresult mozilla::detail::RunnableMethodImpl< xpcom/threads/nsThreadUtils.h:1176
3 xul.dll MessageLoop::DoWork ipc/chromium/src/base/message_loop.cc:523
4 xul.dll base::MessagePumpDefault::Run ipc/chromium/src/base/message_pump_default.cc:35
5 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:308
6 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:290
7 xul.dll base::Thread::ThreadMain ipc/chromium/src/base/thread.cc:192
8 xul.dll `anonymous namespace'::ThreadFunc ipc/chromium/src/base/platform_thread_win.cc:19
9 kernel32.dll BaseThreadInitThunk 

There are 18 crashes (from 10 installations) in nightly 70 starting with buildid 20190729213839. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1563233.

[1] https://hg.mozilla.org/mozilla-central/rev?node=d1b749a11195

Comment 1

[thomasmo]

Requesting access to crash dumps so that I can investigate the bug

Comment 2

[Daosheng Mu[:daoshengmu]]

That should be related with Bug 1570440.

Comment 3

[thomasmo]

Reliable repro steps:

1. turn off vr process in about:config
2. restart fx
3. navigate to https://webvr.info/samples/03-vr-presentation.html
4. enter vr (steamvr should start if not already running)
5. exit vr
6. navigate to https://www.bing.com/
7. wait for firefox.exe to no longer appear in steamvr status
8. navigate back to https://webvr.info/samples/03-vr-presentation.html
9. crash

Comment 4

[thomasmo]

Bug understood, testing and validating local fix

Comment 5

[thomasmo]

Attachment: Bug 1570230 - Crash in [@ mozilla::gfx::VRShMem::JoinShMem] Bug 1570440 - [Web content] Firefox Crashes on CNN.COM (Windows7)

This change addresses an issue where VRShMem can be in an invalid state when
there is no VR process available. In this case, the VRExternalShmem struct is
allocated on the heap rather than accessed via shared memory. When VRService
stops, it clears this pointer, but cannot re-access it when it restarts. Thus,
this results in a nullptr crash when a tab Enters, Exits, and Re-enters VR.

The fix is to distinguish between in-proc heap allocation vs cross-proc shared
memory so that VRService can decide to make the call to LeaveShMem in its Stop
function. This will keep the heap allocation alive across service restarts and
prevent the null crash.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/87890c29a8ea
Crash in [@ mozilla::gfx::VRShMem::JoinShMem] r=kip

Comment 7

[Narcis Beleuzu [:NarcisB]]

Backed out for crashes on mozilla::gfx::VRShMem::CreateShMem(bool)

Backout link: https://hg.mozilla.org/integration/autoland/rev/51738e0c713be935e60012e29d08b121289c3931
Log link: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=260453257&repo=autoland&lineNumber=3561

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6ed00c66b890
Crash in [@ mozilla::gfx::VRShMem::JoinShMem] r=kip

Comment 9

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/6ed00c66b890

Comment 12

[thomasmo]

Clearing needinfo, fix checked in