623728 - Crash when leaving fullscreen while playing OGG video

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Doug Turner (:dougt)]

After playing a video in fullscreen mode, I closed it.  Soon after, fennec crashed.  I don't have a stack, but this was in the output.

I can reproduce this pretty consistently with todays build.

I am on a G2 running cyanogen.

I/Gecko   (12169): ###!!! ABORT: unknown union type: file PLayersParent.cpp, line 560

Comment 1

[Matthew Gregan [:kinetik]]

Given the abort, I'm assuming this should be in Core/GFX.

Comment 2

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Yes, gfx.

This abort is being triggered by a SurfaceDescriptor with an invalid type, probably T__none which would suggest that the descriptor is uninitialized.  A link to a minidump from the abort would be useful.  Will try to repro later.

Comment 3

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Oh yeah, this is tres bad and should block.

Comment 4

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Problem is here

void
PLayersParent::Write(
        const OpThebesBufferSwap& __v,
        Message* __msg)
{
    Write((__v).layerParent(), __msg, false);
    // skipping actor field that's meaningless on this side
>>>    Write((__v).newBackBuffer(), __msg);
    Write((__v).newValidRegion(), __msg);
    Write((__v).newXResolution(), __msg);
    Write((__v).newYResolution(), __msg);
    Write((__v).readOnlyFrontBuffer(), __msg);
    Write((__v).frontUpdatedRegion(), __msg);
}


newBackBuffer() has a ThebesBuffer of Descriptor type T__none.

Comment 6

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Regression from bug 623255.

Comment 7

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Attachment: Don't process transactions on destroyed shadow layer managers, even when the layer manager hasn't been explicitly destroyed

The problem is that with bug 623255, we started destroying shadow layers upon TabParent::Destroy, because there may be "orphaned" layers that wouldn't be signaled on LayerManager::Destroy.  This caused use-after-free bugs of GLContexts.

In this case, we have the opposite problem: LayerManager::Destroy is *not* being called around the time when TabParent::Destroy is called.  This was causing shadow layers to have transactions processed on them after they became zombies.  This patch records when we explicitly destroy shadow layers from TabParent::Destroy and stops relying solely on the layer-manager destroyed state.

Comment 8

[Jeff Muizelaar [:jrmuizel]]

Comment on attachment 502722 [details] [diff] [review]
Don't process transactions on destroyed shadow layer managers, even when the layer manager hasn't been explicitly destroyed

Please add a comment at the mDestroyed declaration about why the additional state is needed.

Comment 9

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

(In reply to comment #8)
> Comment on attachment 502722 [details] [diff] [review]
> Don't process transactions on destroyed shadow layer managers, even when the
> layer manager hasn't been explicitly destroyed
> 
> Please add a comment at the mDestroyed declaration about why the additional
> state is needed.

Done.

Comment 11

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

http://hg.mozilla.org/mozilla-central/rev/d89371fd4fa4