1851636 - Crash in [@ mozilla::layers::CanvasEventRingBuffer::SetNewBuffer]

Status: RESOLVED FIXED

(Core :: Graphics: Canvas2D, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

4 GPU crashes from 4 installations of Firefox 119.0a1.

Crash report: https://crash-stats.mozilla.org/report/index/af595d96-0d3b-4bb3-878b-25f220230904

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT(!mSharedMemory) (Shared memory should have been dropped before new buffer is sent.)

Top 10 frames of crashing thread:

0  xul.dll  mozilla::layers::CanvasEventRingBuffer::SetNewBuffer  gfx/layers/CanvasDrawEventRecorder.cpp:128
1  xul.dll  mozilla::layers::CanvasTranslator::RecvNewBuffer::<lambda_11>::operator  gfx/layers/ipc/CanvasTranslator.cpp:164
1  xul.dll  mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/gfx/layers/ipc/CanvasTranslator.cpp:164:3'>::Run  xpcom/threads/nsThreadUtils.h:548
2  xul.dll  mozilla::TaskQueue::Runner::Run  xpcom/threads/TaskQueue.cpp:257
3  xul.dll  nsThreadPool::Run  xpcom/threads/nsThreadPool.cpp:343
4  xul.dll  nsThread::ProcessNextEvent  xpcom/threads/nsThread.cpp:1193
5  xul.dll  NS_ProcessNextEvent  xpcom/threads/nsThreadUtils.cpp:480
5  xul.dll  mozilla::ipc::MessagePumpForNonMainThreads::Run  ipc/glue/MessagePump.cpp:300
6  xul.dll  MessageLoop::RunInternal  ipc/chromium/src/base/message_loop.cc:370
6  xul.dll  MessageLoop::RunHandler  ipc/chromium/src/base/message_loop.cc:363

Comment 1

[Bob Owen (:bobowen)]

Hmm, my first suspicion here is the reader has failed for some reason, so never gets to the drop buffer.
If it is the case, I ought to be able to detect (and should have been detecting :-) ) that and not create and send the new buffer.

Comment 2

[Bob Owen (:bobowen)]

https://treeherder.mozilla.org/jobs?repo=try&revision=be7554b5182dcc0c2de3c14f47ab8f6f35ed1310

Comment 3

[Bob Owen (:bobowen)]

Attachment: Bug 1851636: Don't create a new buffer if we fail to process the drop buffer event. r=jrmuizel!

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f1db1cd01b38
Don't create a new buffer if we fail to process the drop buffer event. r=jrmuizel

Comment 5

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/f1db1cd01b38