1707464 - Crash in [@ mozilla::wr::TransactionBuilder::TransactionBuilder]

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/a16c319e-98db-4834-83b6-449440210425

Reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

Top 10 frames of crashing thread:

0 XUL mozilla::wr::TransactionBuilder::TransactionBuilder gfx/webrender_bindings/WebRenderAPI.cpp:241
1 XUL mozilla::layers::AsyncImagePipelineManager::ApplyAsyncImageForPipeline gfx/layers/wr/AsyncImagePipelineManager.cpp:477
2 XUL mozilla::layers::WebRenderBridgeParent::ProcessWebRenderParentCommands gfx/layers/wr/WebRenderBridgeParent.cpp:1479
3 XUL mozilla::layers::WebRenderBridgeParent::RecvSetDisplayList gfx/layers/wr/WebRenderBridgeParent.cpp:1224
4 XUL mozilla::layers::PWebRenderBridgeParent::OnMessageReceived ipc/ipdl/PWebRenderBridgeParent.cpp:403
5 XUL mozilla::layers::PCompositorManagerParent::OnMessageReceived ipc/ipdl/PCompositorManagerParent.cpp:200
6 XUL mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:2076
7 XUL mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1955
8 XUL nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1153
9 XUL mozilla::ipc::MessagePumpForNonMainThreads::Run ipc/glue/MessagePump.cpp:300

macOS-specific NULL pointer dereference. It seems that aApi here is NULL.

Comment 1

[Dzmitry Malyshau [:kvark]]

Appears similar to bug 1701587
Andrew, any idea why the API would be NULL for the ApplyAsyncImageForPipeline?
Marking S3 because of the crash volume, but adding to gfx-triage to see if it rings any bells, and maybe we can find somebody to look at it.

Comment 2

[Sotaro Ikeda [:sotaro]]

deleted

Comment 3

[Sotaro Ikeda [:sotaro]]

One possibility could be EraseLayerState() call from CompositorBridgeParent::DeallocateLayerTreeId().

Comment 4

[Sotaro Ikeda [:sotaro]]

Bug 1710347 is created for comment 3.

Comment 5

[Wayne Mery (:wsmwk)]

Signature is stone dead starting in Firefox 90, consistent with fixing bug 1710347 in version 90.
https://crash-stats.mozilla.org/signature/?signature=mozilla%3A%3Awr%3A%3ATransactionBuilder%3A%3ATransactionBuilder&date=%3E%3D2021-07-04T04%3A08%3A00.000Z&date=%3C2021-10-04T04%3A08%3A00.000Z

Comment 6

[Dzmitry Malyshau [:kvark]]

Sotaro, should we mark it as solved by your patch?

Comment 7

[Sotaro Ikeda [:sotaro]]

Yes!