2084882 - Crash in [@ IPC::MessageReader::FatalError | IPC::ParamTraits<mozilla::layers::TimedTexture>::Read | _ZN3IPC9ReadParamIN7mozilla6layers12TimedTextureEEENS_10ReadResultIu11__remove_cvIT_EXoosr3stdE26is_default_constructible_vIS6_Eclsr6detailE40HasDepre...]

Status: NEW

(Core :: Graphics, defect)

Description

[Clouseau (:calixte)]

Crash report: https://crash-stats.mozilla.org/report/index/0b8d3720-3941-4c68-a5f6-bf2d60261021

Reports with a different stack in the same spike: https://crash-stats.mozilla.org/report/index/1815eeb8-947b-461a-80b5-640ad0261021, https://crash-stats.mozilla.org/report/index/c41a4e45-2abf-4834-8e14-2af8c0261021

MOZ_CRASH Reason:

MOZ_CRASH(IPC FatalError in the parent process!)

IPC FatalError message:

Error deserializing 'texture' (NotNull<PTexture>) member of 'TimedTexture'

Top 10 frames:

0  libxul.so  mozilla::ipc::FatalError(char const*, bool)  ipc/glue/ProtocolUtils.cpp:205
1  libxul.so  mozilla::ipc::IProtocol::HandleFatalError(char const*)  ipc/glue/ProtocolUtils.cpp:378
2  libxul.so  IPC::ParamTraits<mozilla::layers::TimedTexture>::Read(IPC::MessageReader*)  ipc/ipdl/LayersMessages.cpp
3  libxul.so  IPC::ReadSequenceParamImpl<mozilla::layers::TimedTexture, mozilla::nsTArrayBackI...  ipc/chromium/src/chrome/common/ipc_message_utils.h:686
4  libxul.so  IPC::ReadSequenceParam<mozilla::layers::TimedTexture, IPC::ParamTraits<nsTArray<...  ipc/chromium/src/chrome/common/ipc_message_utils.h:715
5  libxul.so  IPC::ParamTraits<mozilla::layers::OpUseTexture>::Read(IPC::MessageReader*)  ipc/ipdl/LayersMessages.cpp:3176
6  libxul.so  IPC::ParamTraits<mozilla::layers::CompositableOperation>::Read(IPC::MessageReade...  ipc/ipdl/LayersMessages.cpp:3987
7  libxul.so  IPC::ReadSequenceParamImpl<mozilla::layers::CompositableOperation, mozilla::nsTA...  ipc/chromium/src/chrome/common/ipc_message_utils.h:686
8  libxul.so  IPC::ReadSequenceParam<mozilla::layers::CompositableOperation, IPC::ParamTraits<...  ipc/chromium/src/chrome/common/ipc_message_utils.h:715
9  libxul.so  mozilla::layers::PImageBridgeParent::OnMessageReceived(IPC::Message const&)  ipc/ipdl/PImageBridgeParent.cpp:351

Filed because this signature's crash volume spiked. 70 reports from 3 distinct installations on the nightly build of 2026-10-21 (buildid 20261021092254); none of the preceding 3 build-days had any, and no build in the 21 days before had any report of it. That is an appearance from zero over the loudest of the preceding build-days and of this signature's builds over the 21 days before (Clouseau's bar is 3x, and the Poisson excess of the day against that baseline is z = 15.55, bar 3.62). This signature is new on nightly: crash-stats has no report of it there before this build.

Clouseau analysis (automated -- nothing below was checked by a human; a claim it could not ground is deliberately absent):

The GPU process (69 of 70 reports) aborts on its Compositor thread while reading a PImageBridge Update: an OpUseTexture refers to a PTexture that the GPU process never created. The reports' graphics log shows why. ForceAImageReader is enabled is followed by TextureHost creation failure type=5, and type 5 is SurfaceTextureDescriptor, which CreateTextureHostOGL rejects when gfxVars::ForceAImageReaderAndroid() is set. That gfx var is set when WebRender ANGLE is enabled. Bug 2080572 (5ff8628d1caa, in this build's window) gave Android an ANGLE backend feature, so gfx.webrender.enable-angle=true, which previously had no effect on Android, now turns ANGLE on. The crashes come from only 2 devices and 3 installations, and both of the prefs involved default to false on Android, so this most likely affects devices that set ANGLE or AImageReader on purpose. The fix is either to make video producers send AImageReader descriptors whenever ForceAImageReader is on in the GPU process, or to keep ANGLE (and so ForceAImageReader) off on Android until they do.

Suspected regressor (medium confidence): 5ff8628d1caa (bug 2080572) by :sotaro.

The diff adds #elif defined(MOZ_WIDGET_ANDROID) mFeatureWrAngleBackend = mFeatureGlAngle and enables WEBRENDER_ANGLE_GL by default. Before it, ConfigureWebRender always disabled WEBRENDER_ANGLE on Android ('OS not supported', because mFeatureWrAngleBackend was null). After it, the user pref gfx.webrender.enable-angle (default false on non-Windows) can enable it. Then gfxPlatform sets UseWebRenderANGLE, which sets ForceAImageReaderAndroid, and CreateTextureHostOGL returns null for SurfaceTextureDescriptor. Every report's graphics log shows ForceAImageReader is enabled and then TextureHost creation failure type=5. Confidence is medium because pref values are not in crash reports, so it is unproven that these devices enabled ANGLE rather than setting gfx.video.force-aimage-reader-android directly (which would make the change irrelevant).

Possible path to the crash:

Mechanism (observed): the IPC reader on the GPU process Compositor thread calls FatalError with 'Error deserializing 'texture' (NotNull<PTexture>) member of 'TimedTexture'' while reading PImageBridgeParent Update → CompositableOperation → OpUseTexture → TimedTexture, and MOZ_CRASH follows.

Path (inferred, medium):

1. gfxPlatform sets gfxVars::ForceAImageReaderAndroid because UseWebRenderANGLE or gfx.video.force-aimage-reader-android is true; the log line ForceAImageReader is enabled is observed in the reports.
2. A video producer still allocates a texture with a SurfaceTextureDescriptor and sends the PTexture constructor over ImageBridge.
3. In the GPU process, TextureHost::Create → CreateTextureHostOGL returns nullptr for that descriptor when ForceAImageReader is set (TextureHost creation failure type=5 is observed), so TextureParent::Init and CreateIPDLActor fail and no PTextureParent is bound (generated PImageBridgeParent code only warns 'Cannot bind null PTextureParent actor').
4. The child then sends UseTextures naming that texture, the parent cannot resolve the non-null actor, and the GPU process aborts.

Trigger (inferred, medium): ANGLE, or AImageReader mode, enabled by a pref on a few devices, which bug 2080572 made effective on Android. Both prefs default to false on Android.

Checked:

• 70 reports in the last 30 days, all on Fenix nightly, first seen in build 20261021092254 (searched over 364 days). 46 reports are on that build and 24 on 20261021205324. Process: gpu 69, parent 1. All reports share the same crash reason. (socorro crash_stats and facets build_id, 30 days)
• Only two cpu_info values (family 65 model 3393: 53; family 81 model 2: 17), matching exactly two install_time values (1640984816: 53; 1640984760: 17), both about 2022-01-01. This looks like 2 devices with reset clocks. (facets cpu_info and install_time, 30 days)
• The representative report's graphics log is 'Failed to create EGLSurface 0x3003 … ForceAImageReader is enabled (t=1.63) … TextureHost creation failure type=5 (t=1.63)'. Uptime is 2 s. The top 20 graphics_critical_error values (truncated) all show the same ForceAImageReader message. (crashstats report 0b8d3720-3941-4c68-a5f6-bf2d60261021; facets graphics_critical_error, 30 days)
• Type 5 of SurfaceDescriptor is SurfaceTextureDescriptor (counting the variants from 1: Buffer, D3D10, DXGIYCbCr, DMABuf, SurfaceTexture). [derived] (gfx/layers/ipc/LayersSurfaces.ipdlh@f62de275299e:228-245)
• CreateTextureHostOGL returns nullptr for TSurfaceTextureDescriptor when gfxVars::ForceAImageReaderAndroid() is set, and logs 'ForceAImageReader is enabled'. TextureHost::Create then logs 'TextureHost creation failure type='. (gfx/layers/opengl/TextureHostOGL.cpp@f62de275299e:65-70; gfx/layers/composite/TextureHost.cpp@f62de275299e:246-248)
• TextureHost::CreateIPDLActor returns nullptr when TextureParent::Init fails. (gfx/layers/composite/TextureHost.cpp@f62de275299e:131-145)
• ForceAImageReaderAndroid = UseWebRenderANGLE() || gfx.video.force-aimage-reader-android, and UseWebRenderANGLE is set when Feature::WEBRENDER_ANGLE is enabled. (gfx/thebes/gfxPlatform.cpp@f62de275299e:2461-2463, 2537-2541)
• The crashing build contains the Android WEBRENDER_ANGLE_GL backend. Without a backend, WEBRENDER_ANGLE is disabled as 'OS not supported'. With one, it follows gfx.webrender.enable-angle, which defaults to false on non-Windows. gfx.video.force-aimage-reader-android also defaults to false. (gfx/config/gfxConfigManager.cpp@f62de275299e:98-100, 220-237; modules/libpref/init/StaticPrefList.yaml@f62de275299e:8331-8337, 8849-8852)

Alternatives considered:

• c1557fb45d8b (bug 1981478, NDK decoding pref flip): ruled out -- backed out by e672705e945b before this build. The pinned StaticPrefList.yaml at f62de275299e still has the pre-change values.
• d08758e8ad1f / bug 1607634 (pipeline candidate, a race between texture destroy and use in the ImageBridge transaction): disfavored -- every report shows a deterministic TextureHost creation failure type=5 in the same second under ForceAImageReader, which explains the missing actor without a race.
• 7169058a1daa (bug 1564615, MessageLoop IsOnCurrentThread): not supported -- it only touches message_loop.cc, and the crash is a deserialization failure for a texture that was never created, not a shutdown or thread-check problem.
• Pipeline claim that the signature predates the window (46 reports over the past year): contradicted -- crash_stats searched 364 days and finds first-seen build 20261021092254.
• Hardware fault: disfavored -- 0% bit-flip annotations, and the failure is a deterministic, logged texture-creation refusal.

Worth checking first:

• Which pref enables ForceAImageReader on these devices (gfx.webrender.enable-angle vs gfx.video.force-aimage-reader-android): ask the reporters or check about:support (WEBRENDER_ANGLE / WEBRENDER_ANGLE_GL feature status). If it is the force-aimage-reader pref alone, 5ff8628d1caa is not the culprit and the defect predates it.
• Which producer still sends SurfaceTextureDescriptor while the GPU process has ForceAImageReader set: audit SurfaceTextureImage/AndroidDecoderModule texture creation for the same gfxVars::ForceAImageReaderAndroid() check that FFmpegVideoDecoder and GLBlitHelper apply.
• Whether a failed PTexture constructor should mark the TextureClient unusable on the child side (or make CompositableParentManager drop the op) instead of a later fatal deserialization error: review ImageBridgeChild::UseTextures and the failure handling in TextureParent::Init.

:sotaro, can you have a look please?

Filed automatically by Clouseau, which analyses nightly crashes with an LLM. Nothing above was written or checked by a human. Please close it as INVALID if it is wrong — that is useful feedback, not a nuisance.

This is not an independent Mozilla discovery: the crash is known here only because somebody submitted the crash report linked at the top. If this duplicates an existing report, please resolve THIS bug as the duplicate and leave the credit with the earlier reporter.

Comment 1

[Timothy Nikkel (:tnikkel)]

S3: this needs gfx.webrender.enable-angle, a non-default pref, turned on to reach the in-progress Android ANGLE work from bug 2080572. All reports come from two devices.

Comment 2

[Sotaro Ikeda [:sotaro]]

gfxVars::ForceAImageReaderAndroid() should be false by default.

Comment 3

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 2080572

Comment 4

[Sotaro Ikeda [:sotaro]]

Actual regression is by Bug 2081578.

It might better to avoid the crash.

Comment 5

[Sotaro Ikeda [:sotaro]]

Attachment: fix.patch

Comment 6

[Sotaro Ikeda [:sotaro]]

Attachment: Bug 2084882 - Return CreateDummyBufferTextureHost() on error in CreateTextureHostOGL()

Comment 7

[BugBot [:suhaib / :marco]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 10 AArch64 and ARM crashes on nightly

:sotaro, could you consider increasing the severity of this top-crash bug?

For more information, please visit BugBot documentation.

Comment 8

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 2081578