1893087 - Crash in [@ mozilla::layers::PCompositorBridgeChild::RemoveManagee]

Status: RESOLVED FIXED

(Core :: IPC, defect)

Description

[Andrew McCreight [:mccr8]]

Crash report: https://crash-stats.mozilla.org/report/index/afa6d26f-72e9-4b1e-8447-ee0670240423

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(false) (mManagedPWebRenderBridgeChild.EnsureRemoved(static_cast<PWebRenderBridgeChild*>(aListener)))

Top 10 frames:

0  xul.dll  mozilla::layers::PCompositorBridgeChild::RemoveManagee(int, mozilla::ipc::IPr...  ipc/ipdl/PCompositorBridgeChild.cpp:1679
1  xul.dll  mozilla::ipc::IProtocol::ActorDisconnected::<lambda_0>::operator()(mozilla::i...  ipc/glue/ProtocolUtils.cpp:579
1  xul.dll  mozilla::ipc::IProtocol::ActorDisconnected(mozilla::ipc::IProtocol::ActorDest...  ipc/glue/ProtocolUtils.cpp:610
2  xul.dll  mozilla::ipc::IProtocol::SetManagerAndRegister(mozilla::ipc::IRefCountedProto...  ipc/glue/ProtocolUtils.cpp:484
3  xul.dll  mozilla::layers::PCompositorBridgeChild::SendPWebRenderBridgeConstructor(mozi...  ipc/ipdl/PCompositorBridgeChild.cpp:1426
3  xul.dll  mozilla::layers::PCompositorBridgeChild::SendPWebRenderBridgeConstructor(mozi...  ipc/ipdl/PCompositorBridgeChild.cpp:1412
3  xul.dll  mozilla::layers::WebRenderLayerManager::Initialize(mozilla::layers::PComposit...  gfx/layers/wr/WebRenderLayerManager.cpp:84
4  xul.dll  mozilla::dom::BrowserChild::CreateRemoteLayerManager::<lambda_6>::operator()(...  dom/ipc/BrowserChild.cpp:2702
4  xul.dll  std::invoke(mozilla::dom::BrowserChild::CreateRemoteLayerManager::<lambda_6>&...  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/type_traits:1739
4  xul.dll  std::_Func_impl_no_alloc<`lambda at /builds/worker/checkouts/gecko/dom/ipc/Br...  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/functional:907

This showed up in Nightly. We have some similar crashes on treeherder and in older versions, but the frequency seems to have spiked up greatly in the 20240422214652 build. I don't know if this might simple be a change in how some crashes look or what. Here is the set of changes in that build. I'm guessing that bug 1724083 is the regressor, because it changed the assertion this crash is happening on.

Comment 1

[Andrew McCreight [:mccr8]]

I also see a single crash on Android Nightly with the signature [@ mozilla::dom::PContentParent::RemoveManagee ]. I'm not sure if that's the same thing or not, but it is the same assertion.

bp-0297c11f-9fc2-4737-a317-dbf910240423

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1724083

:nika, since you are the author of the regressor, bug 1724083, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 3

[Mayank Bansal]

I got this crash by repeatedly pinch-zooming on the testcase at https://bug1893436.bmoattachments.org/attachment.cgi?id=9398605 .
Crash: https://crash-stats.mozilla.org/report/index/3e78959c-7681-4ab9-be08-2dacd0240426#tab-bugzilla

The memory use during pinch-zoom was high, so this may just be a general gfx OOM crash.

gfx-log1:
(#0) GP+[GFX1-]: Error: 0x00000505, in /builds/worker/checkouts/gecko/gfx/angle/checkout/src/libANGLE/renderer/d3d/d3d11/ResourceManager11.cpp, allocate:404. Internal D3D11 error: HRESULT: 0x8007000E: Error allocating Texture2D
(#368) GP+[GFX1-]: Failed to load a program object with a program binary: brush_mix_blend renderer ANGLE (AMD, AMD Radeon(TM) Graphics Direct3D11 vs_5_0 ps_5_0, D3D11-31.0.21912.14)
(#369) GP+[GFX1-]: shader-cache: Failed program_binary
(#370) GP+[GFX1-]: Failed to compile vertex shader: brush_mix_blend_ALPHA_PASS
(#371) GP+[GFX1-]: DCompositionSurface::BeginDraw failed: 0x8007000e Rect(x=524288, y=524288, w=1024, h=512)
(#372) Error Handling webrender error 4
(#373) Error Fallback WR to SW-WR + D3D11
(#374) Error CompositorBridgeChild receives IPC close with reason=AbnormalShutdown
(#375) Error GPU process is being launched whilst app is in background
(#376) CP+[GFX1-]: CompositorBridgeChild receives IPC close with reason=AbnormalShutdown

gfx-log2 wit dcomp disabled:
(#0) GP+[GFX1-]: Error: 0x00000505, in /builds/worker/checkouts/gecko/gfx/angle/checkout/src/libANGLE/renderer/d3d/d3d11/ResourceManager11.cpp, allocate:404. Internal D3D11 error: HRESULT: 0x8007000E: Error allocating Texture2D
(#1) GP+[GFX1-]: Context has been lost.
(#2) Error Handling webrender error 2
(#3) Error Fallback WR to SW-WR + D3D11
(#4) GP+[GFX1-]: wr_renderer_render: OutOfMemory
(#5) GP+[GFX1-]: Error: 0x00000502, in /builds/worker/checkouts/gecko/gfx/angle/checkout/src/libANGLE/renderer/d3d/d3d11/ResourceManager11.cpp, allocate:404. Internal D3D11 error: HRESULT: 0x887A0005 (removal reason: HRESULT: 0x887A0007): Error allocating Texture2D
(#6) GP+[GFX1]: Device reset due to WR device: 0x887a0007
(#7) GP+[GFX1-]: GFX: RenderThread detected a device reset in PostUpdate
(#8) GP+[GFX1-]: Failed to make render context current during destroying.
(#9) GP+[GFX1-]: Error in eglMakeCurrent: 0x300e
(#10) GP+[GFX1-]: Error in eglDestroySurface: 0x300e

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 10 desktop browser crashes on nightly

For more information, please visit BugBot documentation.

Comment 5

[Pascal Chevrel:pascalc]

Nika, the fix for a rather low-volume long-standing crash in bug 1724083 caused this new top crash on nightly. Are you taking this bug or should we back out bug 1724083 for now? Thanks

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The bug is marked as tracked for firefox127 (nightly). We have limited time to fix this, the soft freeze is in 10 days. However, the bug still isn't assigned.

:gcp, could you please find an assignee for this tracked bug? Given that it is a regression and we know the cause, we could also simply backout the regressor. If you disagree with the tracking decision, please talk with the release managers.

For more information, please visit BugBot documentation.

Comment 7

[Nika Layzell [:nika] (ni? for response)]

This is a bit of a fiddly situation. Basically this is a diagnostic assertion which is being hit due to a new edge-case during construction which was added in bug 1724083. The crash doesn't indicate a bug (beyond there being a crash), it's just that it is now possible for SetManagerAndRegister to trigger actor destruction before the actor has been added to its manager's managee collection, which then leads to this crash as we assert that it can be found to be removed.

The easiest fix here is to remove the assertion for now, though in an ideal world, we'd clean up this code more to avoid the need for that change.

Comment 8

[Nika Layzell [:nika] (ni? for response)]

Attachment: Bug 1893087 - Part 1: Relax assertion in RemoveManagee, r=#ipc-reviewers!

With the new changes in bug 1724083, it is possible for an actor to be
destroyed during SetManagerAndRegister, which can lead to RemoveManagee being
called before the managee is even registered, leading to an assertion failure.
The easiest fix here is to relax this assertion, as we won't insert the entry
later in this failure case.

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

Copying crash signatures from duplicate bugs.

Comment 11

[Nika Layzell [:nika] (ni? for response)]

Attachment: Bug 1893087 - Part 2: Add test for constructing an actor under an already dead manager, r=#ipc-reviewers!

Depends on D208936

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8ec16738af22
Part 1: Relax assertion in RemoveManagee, r=ipc-reviewers,mccr8
https://hg.mozilla.org/integration/autoland/rev/0fdd6e986826
Part 2: Add test for constructing an actor under an already dead manager, r=ipc-reviewers,mccr8

Comment 13

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/8ec16738af22
https://hg.mozilla.org/mozilla-central/rev/0fdd6e986826

Comment 15

[BugBot [:suhaib / :marco/ :calixte]]

Copying crash signatures from duplicate bugs.