Closed Bug 1651720 Opened 4 years ago Closed 3 years ago

Crash in [@ mozilla::layers::WebRenderCommandBuilder::Destroy] on macOS

Categories

(Core :: Graphics: WebRender, defect, P3)

Desktop
macOS
defect

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox-esr68 --- unaffected
firefox-esr78 --- disabled
firefox78 --- disabled
firefox79 --- disabled
firefox80 --- disabled

People

(Reporter: sefeng, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: crash)

Crash Data

This bug is for crash report bp-d4993484-c5d7-4bb2-89b6-4dd090200707.

Top 10 frames of crashing thread:

0 XUL mozilla::layers::WebRenderCommandBuilder::Destroy gfx/layers/wr/WebRenderCommandBuilder.cpp:1524
1 XUL mozilla::layers::WebRenderLayerManager::DoDestroy gfx/layers/wr/WebRenderLayerManager.cpp:111
2 XUL mozilla::layers::CompositorBridgeChild::Destroy gfx/layers/ipc/CompositorBridgeChild.cpp:158
3 XUL mozilla::layers::InProcessCompositorSession::Shutdown gfx/ipc/InProcessCompositorSession.cpp:89
4 XUL nsBaseWidget::DestroyCompositor widget/nsBaseWidget.cpp:313
5 XUL nsChildView::~nsChildView widget/cocoa/nsChildView.mm:262
6 XUL nsChildView::~nsChildView widget/cocoa/nsChildView.mm:241
7 XUL <name omitted> widget/nsBaseWidget.cpp:146
8 XUL nsCocoaWindow::~nsCocoaWindow widget/cocoa/nsCocoaWindow.mm:220
9 XUL nsCocoaWindow::~nsCocoaWindow widget/cocoa/nsCocoaWindow.mm:194

We got two crashes on July 6th Nightly from 2 different installations. looks like the cause was dereferencing a null pointer

Low frequency, @jrmuizel: I don't see an obvious spot in https://searchfox.org/mozilla-central/source/gfx/layers/wr/WebRenderCommandBuilder.cpp#2607 that could cause this crash. Can you take a quick keek at this issue?

Severity: -- → S3
Flags: needinfo?(jmuizelaar)
OS: Unspecified → All
Priority: -- → P3
Hardware: Unspecified → Desktop
Flags: needinfo?(jmuizelaar)
Summary: Crash in [@ mozilla::layers::WebRenderCommandBuilder::Destroy] → Crash in [@ mozilla::layers::WebRenderCommandBuilder::Destroy] on MacOS
Summary: Crash in [@ mozilla::layers::WebRenderCommandBuilder::Destroy] on MacOS → Crash in [@ mozilla::layers::WebRenderCommandBuilder::Destroy] on macOS

The raw crash reason for these crashes is MOZ_RELEASE_ASSERT(mWebRenderUserDatas.Count() == 0) so they're all happening here.

See Also: → 1635769

Why doesn't the stack point at that location?

Flags: needinfo?(gsvelto)

Since this is Rust code the most likely reason is inlining. Unfortunately we don't have a way to deal with inlined frames yet in crash stacks.

Flags: needinfo?(gsvelto)

(In reply to Gabriele Svelto [:gsvelto] from comment #4)

Since this is Rust code the most likely reason is inlining. Unfortunately we don't have a way to deal with inlined frames yet in crash stacks.

It's not Rust code but I guess inlining still applies.

Duh, yeah. I've seen WebRender on the stack and my mind immediately assumed Rust. But yeah, it applies to C++ too, the effect tends to be worse on Rust because we usually have more inlining there.

Status: NEW → RESOLVED
Closed: 3 years ago
Flags: needinfo?(jmathies)
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.