Closed Bug 861636 Opened 8 years ago Closed 8 years ago

Crash in mozilla::layers::ImageHostBuffered::EnsureTextureHost with OMTC

Categories

(Core :: Graphics: Layers, defect)

23 Branch
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla23
Tracking Status
firefox22 --- unaffected
firefox23 --- verified

People

(Reporter: Virtual, Assigned: nrc)

References

()

Details

(Keywords: crash, nightly-community, regression, Whiteboard: [native-crash])

Crash Data

Attachments

(1 file, 3 obsolete files)

https://crash-stats.mozilla.com/report/index/bp-8331e40f-c9bc-4fb1-882d-a659a2130414

https://crash-stats.mozilla.com/report/index/bp-520e3d49-970c-4c1b-8b8c-0e7cd2130414
Crash Signature: xul.dll@0xd8da0a | xul.dll@0x9a7381 | xul.dll@0x9d4a6b | xul.dll@0x4eb090 | xul.dll@0x4bef65 | xul.dll@0x4be49b | xul.dll@0x547e56 | xul.dll@0x5487f1 | xul.dll@0x548d13 | xul.dll@0x548f4c | xul.dll@0x5481df | xul.dll@0x5482ab | xul.dll@0x54aec9 | xul.d...
Keywords: crash, crashreportid
It doesn't crash for me.
Debug symbols are missing so please use Nightly instead of Hourly.
Crash Signature: xul.dll@0xd8da0a | xul.dll@0x9a7381 | xul.dll@0x9d4a6b | xul.dll@0x4eb090 | xul.dll@0x4bef65 | xul.dll@0x4be49b | xul.dll@0x547e56 | xul.dll@0x5487f1 | xul.dll@0x548d13 | xul.dll@0x548f4c | xul.dll@0x5481df | xul.dll@0x5482ab | xul.dll@0x54aec9 | xul.d...
Hardware: x86_64 → x86
Awww... Sorry!
I completely forgot that builds from inbound didn't contain debug symbols.

https://crash-stats.mozilla.com/report/index/bp-1bf8277b-e4f1-42c7-964e-c4df22130414
https://crash-stats.mozilla.com/report/index/bp-f9043710-fd5e-43bc-a290-0a9d82130414
https://crash-stats.mozilla.com/report/index/bp-6ed4f7e9-5974-4ee2-be19-8452a2130414
Crash Signature: mozilla::layers::ImageHostBuffered::EnsureTextureHost(unsigned int, mozilla::layers::SurfaceDescriptor const&, mozilla::layers::ISurfaceAllocator*, mozilla::layers::TextureInfo const&)
The crash signature syntax is as the top of the crash report.

Does it happen in Safe Mode? and also with only extensions disabled (HW acceleration enabled)?
Does it happen with a new profile?
Crash Signature: mozilla::layers::ImageHostBuffered::EnsureTextureHost(unsigned int, mozilla::layers::SurfaceDescriptor const&, mozilla::layers::ISurfaceAllocator*, mozilla::layers::TextureInfo const&) → [@ mozilla::layers::ImageHostBuffered::EnsureTextureHost(unsigned int, mozilla::layers::SurfaceDescriptor const&, mozilla::layers::ISurfaceAllocator*, mozilla::layers::TextureInfo const&) ]
Component: Untriaged → Graphics: Layers
Flags: needinfo?(BernesB)
Keywords: stackwanted
Product: Firefox → Core
Summary: Crash on http://www.scroogled.com/mail → Crash in mozilla::layers::ImageHostBuffered::EnsureTextureHost
I can confirm this crash:

AdapterDeviceID: 0x6779
AdapterVendorID: 0x1002
Add-ons: %7BD4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389%7D:0.9.10,%7B1BC9BA34-1EED-42ca-A505-6D2F1A935BBB%7D:4.12.22.2,checkplaces%40andyhalford.com:2.6.2,sortplaces%40andyhalford.com:1.9.2,firefox%40mega.co.nz:1.0.3,translator%40zoli.bod:2.1.0.3,proxyauth%40lammersoft.com:0.1.2,%7Bdc572301-7619-498c-a57d-39143191b318%7D:0.4.1.0pre.130408a,%7Be4a8a97b-f2ed-450b-b12d-ee082ba24781%7D:1.8,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:23.0a1,nocopypaste%40adblockplus.org:1.0,elemhidehelper%40adblockplus.org:1.2.4a.448,%7Bd10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d%7D:2.2.4a.3640
AvailablePageFile: 6059524096
AvailablePhysicalMemory: 2120953856
AvailableVirtualMemory: 3586633728
BuildID: 20130414031025
CrashTime: 1366013543
EMCheckCompatibility: true
FramePoisonBase: 00000000f0de0000
FramePoisonSize: 65536
InstallTime: 1366010511
Notes: AdapterVendorID: 0x1002, AdapterDeviceID: 0x6779, AdapterSubsysID: 00000000, AdapterDriverVersion: 12.100.17.0
D2D? D2D+ DWrite? DWrite+ D3D10 Layers! D3D10 Layers+ 
ProductID: {ec8030f7-c20a-464f-9b0e-13a3a9e97384}
ProductName: Firefox
ReleaseChannel: nightly
SecondsSinceLastCrash: 143
StartupTime: 1366013405
SystemMemoryUsePercentage: 50
Theme: classic/1.0
Throttleable: 1
TotalVirtualMemory: 4294836224
URL: http://www.scroogled.com/mail
Vendor: Mozilla
Version: 23.0a1
Winsock_LSP: MSAFD-Tcpip [TCP/IP] : 2 : 1 : %SystemRoot%\system32\mswsock.dll 
 MSAFD-Tcpip [UDP/IP] : 2 : 2 :  
 MSAFD-Tcpip [RAW/IP] : 2 : 3 : %SystemRoot%\system32\mswsock.dll 
 MSAFD-Tcpip [TCP/IPv6] : 2 : 1 :  
 MSAFD-Tcpip [UDP/IPv6] : 2 : 2 : %SystemRoot%\system32\mswsock.dll 
 MSAFD-Tcpip [RAW/IPv6] : 2 : 3 :  
 RSVP-TCPv6-Dienstanbieter : 2 : 1 : %SystemRoot%\system32\mswsock.dll 
 RSVP-TCP-Dienstanbieter : 2 : 1 :  
 RSVP-UDPv6-Dienstanbieter : 2 : 2 : %SystemRoot%\system32\mswsock.dll 
 RSVP-UDP-Dienstanbieter : 2 : 2 : 

This report also contains technical information about the state of the application when it crashed.
OK, guys I know the culprit here... as I try harder to remember what can causes the crash as it didn't happen some days ago I remembered that I changed
"layers.offmainthreadcomposition.enabled" from "false" to "true" after landing layers-refactoring and this setting is the culprit. So now I don't know it this bug is still valid as OMTC hasn't landed yet for Windows.
Flags: needinfo?(BernesB)
Thanks, after setting layers.offmainthreadcomposition.enabled to false it does not crash anymore!
The stack trace looks like:
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::layers::ImageHostBuffered::EnsureTextureHost 	gfx/layers/composite/ImageHost.cpp:164
1 	xul.dll 	mozilla::layers::CompositableParentManager::ReceiveCompositableUpdate 	gfx/layers/ipc/CompositableTransactionParent.cpp:79
2 	xul.dll 	mozilla::layers::ImageBridgeParent::RecvUpdate 	gfx/layers/ipc/ImageBridgeParent.cpp:51
3 	xul.dll 	mozilla::layers::PImageBridgeParent::OnMessageReceived 	obj-firefox/ipc/ipdl/PImageBridgeParent.cpp:505
4 	xul.dll 	mozilla::ipc::SyncChannel::OnDispatchMessage 	ipc/glue/SyncChannel.cpp:145
5 	xul.dll 	mozilla::ipc::RPCChannel::OnMaybeDequeueOne 	ipc/glue/RPCChannel.cpp:400
6 	xul.dll 	MessageLoop::RunTask 	ipc/chromium/src/base/message_loop.cc:334
7 	xul.dll 	MessageLoop::DeferOrRunPendingTask 	ipc/chromium/src/base/message_loop.cc:342
8 	xul.dll 	MessageLoop::DoWork 	ipc/chromium/src/base/message_loop.cc:442
9 	xul.dll 	base::MessagePumpDefault::Run 	ipc/chromium/src/base/message_pump_default.cc:23
10 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:209
11 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:183
12 	xul.dll 	base::Thread::ThreadMain 	ipc/chromium/src/base/thread.cc:156
13 	xul.dll 	`anonymous namespace'::ThreadFunc 	ipc/chromium/src/base/platform_thread_win.cc:26
14 	kernel32.dll 	BaseThreadInitThunk 	
15 	ntdll.dll 	__RtlUserThreadStart 	
16 	ntdll.dll 	_RtlUserThreadStart 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Alayers%3A%3AImageHostBuffered%3A%3AEnsureTextureHost%28unsigned+int%2C+mozilla%3A%3Alayers%3A%3ASurfaceDescriptor+const%26%2C+mozilla%3A%3Alayers%3A%3AISurfaceAllocator*%2C+mozilla%3A%3Alayers%3A%3ATextureInfo+const%26%29
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: regression
Summary: Crash in mozilla::layers::ImageHostBuffered::EnsureTextureHost → Crash in mozilla::layers::ImageHostBuffered::EnsureTextureHost with OMTC
OS: Windows 7 → All
Hardware: x86 → All
Whiteboard: [native-crash]
Most of the crash reports are on Windows, OMTC is currently not supported in any way, shape, or form on Windows, nor is it expected to work, so crashing is kind of the expected behaviour here (long term, we're working on it though!).

There seem to be two reports on Android though, I'll look into those...
Assignee: nobody → ncameron
Well, I couldn't reproduce this on Android, it's possible its been fixed by some of the patches landed recently. Looking at the code, it is possible we don't have a compositor and don't have a texture host which would seg fault, but that should not ever happen. Maybe we should be paranoid and guard against it anyway.
Attachment #738869 - Flags: review?(nical.bugzilla)
Comment on attachment 738869 [details] [diff] [review]
add some slightly paranoid null checks

Review of attachment 738869 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/layers/composite/ImageHost.cpp
@@ +47,4 @@
>      mTextureHost->SetCompositor(compositor);
>    }
>  
>    return true;

maybe we should return false if !mTextureHost
Attachment #738869 - Flags: review?(nical.bugzilla) → review+
(In reply to Nicolas Silva [:nical] from comment #14)
> Comment on attachment 738869 [details] [diff] [review]
> add some slightly paranoid null checks
> 
> Review of attachment 738869 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> ::: gfx/layers/composite/ImageHost.cpp
> @@ +47,4 @@
> >      mTextureHost->SetCompositor(compositor);
> >    }
> >  
> >    return true;
> 
> maybe we should return false if !mTextureHost

I don't even know why we return a bool here, I'll remove that.
Attached patch patch mk2 (obsolete) — Splinter Review
requesting re-review for the change to EnsureTextureHost signature
Attachment #738869 - Attachment is obsolete: true
Attachment #739280 - Flags: review?(nical.bugzilla)
Attached patch patch mk2 (obsolete) — Splinter Review
better version
Attachment #739280 - Attachment is obsolete: true
Attachment #739280 - Flags: review?(nical.bugzilla)
Attachment #739286 - Flags: review?(nical.bugzilla)
Comment on attachment 739286 [details] [diff] [review]
patch mk2

Review of attachment 739286 [details] [diff] [review]:
-----------------------------------------------------------------

It's better indeed without the bool return.
Attachment #739286 - Flags: review?(nical.bugzilla) → review+
(In reply to Ed Morley [:edmorley UTC+1] from comment #21)
> Backed out for mochitest-2 failures on Android (these were present in the
> comment 18 try push):
> https://tbpl.mozilla.org/?tree=Mozilla-
> Inbound&rev=faf24511d2c6&jobname=android.*mochitest-2
> 
> https://hg.mozilla.org/integration/mozilla-inbound/rev/5517dbffd39d

ah, sorry, there were so many suggested bugs for intermittent orange I had assumed they were intermittent :-(
Attached patch patch mk3Splinter Review
Had to give it another rejig (added MakeTextureHost to ImageHost) to get it to work.
Attachment #739286 - Attachment is obsolete: true
Attachment #741169 - Flags: review?(nical.bugzilla)
Attachment #741169 - Flags: review?(nical.bugzilla) → review+
https://hg.mozilla.org/mozilla-central/rev/104e71fda7b9
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
Verified with latest Nightly.

FYI - It still crashing, but with other crash signature, so I created a new bug
Bug #866652 - Crash in mozilla::layers::CreateTextureHostD3D9 with OMTC
Status: RESOLVED → VERIFIED
Keywords: crashreportid
You need to log in before you can comment on or make changes to this bug.