2014723 - Crash in [@ mozilla::layers::WebRenderBridgeParent::ScreenPixelsRequest::~ScreenPixelsRequest]

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

13 crashes from 8 installs of Firefox for Android 149.0a1 20260204214433

Crash report: https://crash-stats.mozilla.org/report/index/86954bbf-f157-4cd1-a587-e70270260205

MOZ_CRASH Reason:

MozPromise::ThenValue created from 'RecvRequestScreenPixels' destroyed without being either disconnected, resolved, or rejected (dispatchRv: not dispatched)

Top 10 frames:

0  libxul.so  MOZ_CrashSequence(void*, long)  mfbt/Assertions.h:242
0  libxul.so  MOZ_Crash(char const*, int, char const*)  mfbt/Assertions.h:375
0  libxul.so  mozilla::MozPromise<ProcessInfo, nsresult, false>::ThenValueBase::AssertIsDead()  xpcom/threads/MozPromise.h:544
1  libxul.so  mozilla::MozPromise<nsTArray<mozilla::net::CookieStructTable>, mozilla::ipc::...  xpcom/threads/MozPromise.h:1270
2  libxul.so  mozilla::MozPromise<RefPtr<mozilla::layers::AndroidHardwareBuffer>, nsresult,...  xpcom/threads/MozPromise.h:1318
3  libxul.so  mozilla::MozPromise<RefPtr<mozilla::layers::AndroidHardwareBuffer>, nsresult,...  xpcom/threads/MozPromise.h:257
4  libxul.so  mozilla::MozPromiseRefcountable::Release()  xpcom/threads/MozPromise.h:152
4  libxul.so  mozilla::RefPtrTraits<mozilla::MozPromise<RefPtr<mozilla::layers::AndroidHard...  mfbt/RefPtr.h:49
4  libxul.so  RefPtr<mozilla::MozPromise<RefPtr<mozilla::layers::AndroidHardwareBuffer>, ns...  mfbt/RefPtr.h:409
4  libxul.so  RefPtr<mozilla::MozPromise<RefPtr<mozilla::layers::AndroidHardwareBuffer>, ns...  mfbt/RefPtr.h:80

Comment 1

[Jamie Nicol [:jnicol]]

Ah if the WebRenderBridgeParent is destroyed between RequestScreenPixels() which creates the promise, and MaybeCaptureScreenPixels() which chains it to the WebRenderAPI::RequestScreenPixels() promise, then we'll hit this. We should reject the promise if it exists in Destroy(). (And guard against RequestScreenPixels() being called after destroy)

Comment 2

[Jamie Nicol [:jnicol]]

Attachment: Bug 2014723 - Reject screen pixels request if WebRenderBridgeParent is destroyed. r?#gfx-reviewers

WebRenderBridgeParent::RequestScreenPixels() creates and returns a
promise. When the subsequent frame is generated, this promise is
chained to the result of WebRenderAPI::RequestScreenPixels(). If the
WebRenderBridgeParent is destroyed prior to this occuring, then the
promise will be destroyed without disconnected, resolved, or rejected,
causing a crash.

To avoid this this patch explicitly rejects the promise in
WebRenderBridgeParent::Destroy(), and additionally guards against
calling RequestScreenPixels() if the WebRenderBridgeParent is already
destroyed.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/2754a61f93de
https://hg.mozilla.org/integration/autoland/rev/88dcf38864c9
Reject screen pixels request if WebRenderBridgeParent is destroyed. r=gfx-reviewers,lsalzman

Comment 4

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/88dcf38864c9