Open Bug 1833951 Opened 2 years ago Updated 1 year ago

Crash in [@ mozilla::layers::ImageBridgeChild::InitForContent] with "Failed to start ImageBridgeChild thread!"

Categories

(Core :: Graphics, defect)

defect

Tracking

()

People

(Reporter: mccr8, Unassigned, NeedInfo)

References

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

Crash report: https://crash-stats.mozilla.org/report/index/7add681b-3685-4575-ac9c-9d3b70230517

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT(((bool)(__builtin_expect(!!(!NS_FAILED_impl(rv)), 1)))) (Failed to start ImageBridgeChild thread!)

Top 10 frames of crashing thread:

0  libxul.so  mozilla::layers::ImageBridgeChild::InitForContent  gfx/layers/ipc/ImageBridgeChild.cpp:445
1  libxul.so  mozilla::dom::ContentChild::RecvInitRendering  dom/ipc/ContentChild.cpp:1607
2  libxul.so  mozilla::dom::PContentChild::OnMessageReceived  ipc/ipdl/PContentChild.cpp:9334
3  libxul.so  mozilla::ipc::MessageChannel::DispatchAsyncMessage  ipc/glue/MessageChannel.cpp:1800
3  libxul.so  mozilla::ipc::MessageChannel::DispatchMessage  ipc/glue/MessageChannel.cpp:1725
4  libxul.so  mozilla::ipc::MessageChannel::RunMessage  ipc/glue/MessageChannel.cpp:1525
4  libxul.so  mozilla::ipc::MessageChannel::MessageTask::Run  ipc/glue/MessageChannel.cpp:1623
5  libxul.so  mozilla::RunnableTask::Run  xpcom/threads/TaskController.cpp:555
5  libxul.so  mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal  xpcom/threads/TaskController.cpp:879
6  libxul.so  mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal  xpcom/threads/TaskController.cpp:702

Creating the thread could be failing due to OOM, I don't think I suspect a bug at this crash volume. Crashing is the best we can do if this fails.

Severity: -- → S3
See Also: → 1836528
I experience firefox 116.0 (64 bit) crashes multiple times per hour. It appears to be more prevalent when at least one tab has video content. I am running on Gentoo Linux using FluxBox as my window manager. 32G memory, stacks of disk Linux Lyalls-PC 6.1.41-gentoo #2 SMP PREEMPT_DYNAMIC Thu Aug 3 22:48:50 ACST 2023 x86_64 Intel(R) Core(TM) i7-7700 CPU @ 3.60GHz GenuineIntel GNU/Linux nvidia drivers 525.125 Firefox build has been tweaked to include debug symbols Core file size has been increased for my test of Firefox, and I have 37 cores, so far, ranging in size from 25M to 45M System wide, only about 1300 threads, about 120 odd processes. root@Lyalls-PC cores # ulimit -a real-time non-blocking time (microseconds, -R) unlimited core file size (blocks, -c) 0 data seg size (kbytes, -d) unlimited scheduling priority (-e) 39 file size (blocks, -f) unlimited pending signals (-i) 128129 max locked memory (kbytes, -l) 8192 max memory size (kbytes, -m) unlimited open files (-n) 1024 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 real-time priority (-r) 95 stack size (kbytes, -s) 9788 cpu time (seconds, -t) unlimited max user processes (-u) 1000 virtual memory (kbytes, -v) unlimited file locks (-x) unlimited

I experience firefox 116.0 (64 bit) crashes multiple times per hour.
It appears to be more prevalent when at least one tab has video content.

I am running on Gentoo Linux using FluxBox as my window manager.
32G memory, stacks of disk, swap is hardly used, memory, system wide is no more than 7G of 32G of physical memory.

Linux Lyalls-PC 6.1.41-gentoo #2 SMP PREEMPT_DYNAMIC Thu Aug 3 22:48:50 ACST 2023 x86_64 Intel(R) Core(TM) i7-7700 CPU @ 3.60GHz GenuineIntel GNU/Linux

nvidia drivers 525.125.06 driving a nVidia GeForce RTX 3060 video card, NVML Version 12.525.125.06

Firefox build has been tweaked to include debug symbols (not stripped)

Core file size has been increased for my test of Firefox, and I have 37 cores, so far, ranging in size from 25M to 45M

System wide, only about 1300 threads, about 120 odd processes.

I am happy to upload one or more cores and the entire /usr/lib64/firefox directory, to aid in diagnosis, if it will help.

root@Lyalls-PC cores

ulimit -a

real-time non-blocking time (microseconds, -R) unlimited
core file size (blocks, -c) 0
data seg size (kbytes, -d) unlimited
scheduling priority (-e) 39
file size (blocks, -f) unlimited
pending signals (-i) 128129
max locked memory (kbytes, -l) 8192
max memory size (kbytes, -m) unlimited
open files (-n) 1024
pipe size (512 bytes, -p) 8
POSIX message queues (bytes, -q) 819200
real-time priority (-r) 95
stack size (kbytes, -s) 9788
cpu time (seconds, -t) unlimited
max user processes (-u) 1000
virtual memory (kbytes, -v) unlimited
file locks (-x) unlimited

gdb /usr/lib64/firefox/firefox "/data/cores/core.Web Content.13126.1000.11.1691665764"

GNU gdb (Gentoo 13.2 vanilla) 13.2

<<snip>>

Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/lib64/firefox/firefox...

warning: Can't open file /memfd:mozilla-ipc (deleted) during file-backed mapping note processing

warning: core file may not match specified executable file.
[New LWP 13126]
[New LWP 13133]
[New LWP 13132]
[New LWP 13130]
[New LWP 13134]
[New LWP 13136]
[New LWP 13138]
[New LWP 13137]
[New LWP 13148]
[New LWP 13141]
[New LWP 13143]
[New LWP 13144]
[New LWP 13145]
[New LWP 13142]
[New LWP 13146]
[New LWP 13147]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/usr/lib64/firefox/firefox -contentproc -childID 79 -isForBrowser -prefsLen 301'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 mozilla::layers::ImageBridgeChild::InitForContent (aEndpoint=..., aNamespace=245)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/gfx/layers/ipc/ImageBridgeChild.cpp:445
445 /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/gfx/layers/ipc/ImageBridgeChild.cpp: No such file or directory.
[Current thread is 1 (Thread 0x7f6ff18ad480 (LWP 13126))]
(gdb) set pagination off
(gdb) where
#0 mozilla::layers::ImageBridgeChild::InitForContent(mozilla::ipc::Endpoint<mozilla::layers::PImageBridgeChild>&&, unsigned int) (aEndpoint=..., aNamespace=245)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/gfx/layers/ipc/ImageBridgeChild.cpp:445
#1 0x00007f6febb1c672 in mozilla::dom::ContentChild::RecvInitRendering(mozilla::ipc::Endpoint<mozilla::layers::PCompositorManagerChild>&&, mozilla::ipc::Endpoint<mozilla::layers::PImageBridgeChild>&&, mozilla::ipc::Endpoint<mozilla::gfx::PVRManagerChild>&&, mozilla::ipc::Endpoint<mozilla::PRemoteDecoderManagerChild>&&, nsTArray<unsigned int>&&)
(this=0x7f6ff12c2930, aCompositor=..., aImageBridge=..., aVRBridge=..., aVideoManager=..., namespaces=...)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/dom/ipc/ContentChild.cpp:1576
#2 0x00007f6febbf709e in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&)
(this=0x7f6ff12c2930, msg__=<optimized out>)
at /tmp/portage/www-client/firefox-116.0/work/firefox_build/ipc/ipdl/PContentChild.cpp:9211
#3 0x00007f6fe9c3aeec in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)
(this=this@entry=0x7f6ff12c29a8, aProxy=aProxy@entry=0x7f6ff12899e0, aMsg=...)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/ipc/glue/MessageChannel.cpp:1811
#4 0x00007f6fe9c3a1a2 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >)
(this=this@entry=0x7f6ff12c29a8, aProxy=aProxy@entry=0x7f6ff12899e0, aMsg=...)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/ipc/glue/MessageChannel.cpp:1736
#5 0x00007f6fe9c3a534 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&)
(this=0x7f6ff12c29a8, aProxy=aProxy@entry=0x7f6ff12899e0, aTask=...)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/ipc/glue/MessageChannel.cpp:1536
#6 0x00007f6fe9c3a973 in mozilla::ipc::MessageChannel::MessageTask::Run()
(this=0x7f6fe4b32120)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/ipc/glue/MessageChannel.cpp:1634
#7 0x00007f6fe971ad2e in mozilla::RunnableTask::Run() (this=0x7f6ff12fdc80)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/xpcom/threads/TaskController.cpp:555
#8 0x00007f6fe971866d in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
(this=this@entry=0x7f6ff1276c00, aProofOfLock=...)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/xpcom/threads/TaskController.cpp:880
#9 0x00007f6fe9717aa7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) (this=0x7f6fe8034ee2,
this@entry=0x7f6ff1276c00, aProofOfLock=...)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/xpcom/threads/TaskController.cpp:704
#10 0x00007f6fe9717cf8 in mozilla::TaskController::ProcessPendingMTTask(bool)
(this=0x7f6ff1276c00, aMayWait=false)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/xpcom/threads/TaskController.cpp:491
#11 0x00007f6fe971c172 in mozilla::TaskController::TaskController()::$_3::operator()() const
(this=<optimized out>)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/xpcom/threads/TaskController.cpp:218
#12 mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_3>::Run()
(this=<optimized out>)
at /tmp/portage/www-client/firefox-116.0/work/firefox_build/dist/include/nsThreadUtils.h:548
#13 0x00007f6fe972841a in nsThread::ProcessNextEvent(bool, bool*)
(this=0x7f6ff12631a0, aMayWait=<optimized out>, aResult=0x7fff1b8229e7)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/xpcom/threads/nsThread.cpp:1199
#14 0x00007f6fe972bbda in NS_ProcessNextEvent(nsIThread*, bool) (aThread=0x7f6fe8034ee2,
aThread@entry=0x7f6ff12631a0, aMayWait=false)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/xpcom/threads/nsThreadUtils.cpp:480
#15 0x00007f6fe9c3d472 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)
(this=0x7f6ff127e790, aDelegate=0x7fff1b822b10)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/ipc/glue/MessagePump.cpp:85
#16 0x00007f6fe9bfabd7 in MessageLoop::RunInternal() (this=0x0)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/ipc/chromium/src/base/message_loop.cc:370
#17 MessageLoop::RunHandler() (this=0x0)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/ipc/chromium/src/base/message_loop.cc:363
#18 MessageLoop::Run() (this=0x0)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/ipc/chromium/src/base/message_loop.cc:345
#19 0x00007f6febfa5019 in nsBaseAppShell::Run() (this=0x7f6fe4b32c80)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/widget/nsBaseAppShell.cpp:148
#20 0x00007f6fecec6c0a in XRE_RunAppShell() ()
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/toolkit/xre/nsEmbedFunctions.cpp:717
#21 0x00007f6fe9bfabd7 in MessageLoop::RunInternal() (this=0x0)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/ipc/chromium/src/base/message_loop.cc:370
#22 MessageLoop::RunHandler() (this=0x0)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/ipc/chromium/src/base/message_loop.cc:363
#23 MessageLoop::Run() (this=0x0)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/ipc/chromium/src/base/message_loop.cc:345
#24 0x00007f6fecec6a32 in XRE_InitChildProcess(int, char**, XREChildData const*)
(aArgc=15, aArgv=0x7fff1b823f18, aChildData=<optimized out>)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/toolkit/xre/nsEmbedFunctions.cpp:652
#25 0x000056091e21d9d2 in content_process_main(mozilla::Bootstrap*, int, char**)
(bootstrap=0x7f6ff1233660, argc=17, argv=0x7fff1b823f18)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/browser/app/../../ipc/contentproc/plugin-container.cpp:57
#26 main(int, char**, char**) (argc=<optimized out>, argv=0x7fff1b823f18, envp=<optimized out>)
at /tmp/portage/www-client/firefox-116.0/work/firefox-116.0/browser/app/nsBrowserApp.cpp:375
(gdb)

Andrew, any ideas why we could be failing to create the ImageBridgeChild thread?

Flags: needinfo?(aosmond)

FYI: I just completed a full memory test, no problems.
It wouldn't be the first time I have had software fail unexpectedly due to faulty memory....

Happy to do any diagnostics required, though I am not an expert. I have 187 core files just from the last week (I have a cronjob to remove older cores).

My Firefox 115.6 is built using the Gentoo package manager and has full debug symbols, as is almost all of the rest of my system, including system libraries such as libc, libgcc, libm, etc. I think the only thing in my system not built with debug symbols is the rust compiler because my build environment needs to be expanded in order for it to build successfully.

I can zip up whatever is required and post somewhere if someone wants.

You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: