861636 - Crash in mozilla::layers::ImageHostBuffered::EnsureTextureHost with OMTC

Status: VERIFIED FIXED

(Core :: Graphics: Layers, defect)

Description

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

Open http://www.scroogled.com/mail
and Nightly will crash

Comment 1

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

https://crash-stats.mozilla.com/report/index/bp-8331e40f-c9bc-4fb1-882d-a659a2130414

https://crash-stats.mozilla.com/report/index/bp-520e3d49-970c-4c1b-8b8c-0e7cd2130414

Comment 2

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

https://crash-stats.mozilla.com/report/index/bp-8331e40f-c9bc-4fb1-882d-a659a2130414

https://crash-stats.mozilla.com/report/index/bp-520e3d49-970c-4c1b-8b8c-0e7cd2130414

Comment 3

[Scoobidiver (away)]

It doesn't crash for me.
Debug symbols are missing so please use Nightly instead of Hourly.

Comment 4

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

Awww... Sorry!
I completely forgot that builds from inbound didn't contain debug symbols.

https://crash-stats.mozilla.com/report/index/bp-1bf8277b-e4f1-42c7-964e-c4df22130414
https://crash-stats.mozilla.com/report/index/bp-f9043710-fd5e-43bc-a290-0a9d82130414
https://crash-stats.mozilla.com/report/index/bp-6ed4f7e9-5974-4ee2-be19-8452a2130414

Comment 5

[Scoobidiver (away)]

The crash signature syntax is as the top of the crash report.

Does it happen in Safe Mode? and also with only extensions disabled (HW acceleration enabled)?
Does it happen with a new profile?

Comment 6

[gixxpunk]

I can confirm this crash:

AdapterDeviceID: 0x6779
AdapterVendorID: 0x1002
Add-ons: %7BD4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389%7D:0.9.10,%7B1BC9BA34-1EED-42ca-A505-6D2F1A935BBB%7D:4.12.22.2,checkplaces%40andyhalford.com:2.6.2,sortplaces%40andyhalford.com:1.9.2,firefox%40mega.co.nz:1.0.3,translator%40zoli.bod:2.1.0.3,proxyauth%40lammersoft.com:0.1.2,%7Bdc572301-7619-498c-a57d-39143191b318%7D:0.4.1.0pre.130408a,%7Be4a8a97b-f2ed-450b-b12d-ee082ba24781%7D:1.8,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:23.0a1,nocopypaste%40adblockplus.org:1.0,elemhidehelper%40adblockplus.org:1.2.4a.448,%7Bd10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d%7D:2.2.4a.3640
AvailablePageFile: 6059524096
AvailablePhysicalMemory: 2120953856
AvailableVirtualMemory: 3586633728
BuildID: 20130414031025
CrashTime: 1366013543
EMCheckCompatibility: true
FramePoisonBase: 00000000f0de0000
FramePoisonSize: 65536
InstallTime: 1366010511
Notes: AdapterVendorID: 0x1002, AdapterDeviceID: 0x6779, AdapterSubsysID: 00000000, AdapterDriverVersion: 12.100.17.0
D2D? D2D+ DWrite? DWrite+ D3D10 Layers! D3D10 Layers+ 
ProductID: {ec8030f7-c20a-464f-9b0e-13a3a9e97384}
ProductName: Firefox
ReleaseChannel: nightly
SecondsSinceLastCrash: 143
StartupTime: 1366013405
SystemMemoryUsePercentage: 50
Theme: classic/1.0
Throttleable: 1
TotalVirtualMemory: 4294836224
URL: http://www.scroogled.com/mail
Vendor: Mozilla
Version: 23.0a1
Winsock_LSP: MSAFD-Tcpip [TCP/IP] : 2 : 1 : %SystemRoot%\system32\mswsock.dll 
 MSAFD-Tcpip [UDP/IP] : 2 : 2 :  
 MSAFD-Tcpip [RAW/IP] : 2 : 3 : %SystemRoot%\system32\mswsock.dll 
 MSAFD-Tcpip [TCP/IPv6] : 2 : 1 :  
 MSAFD-Tcpip [UDP/IPv6] : 2 : 2 : %SystemRoot%\system32\mswsock.dll 
 MSAFD-Tcpip [RAW/IPv6] : 2 : 3 :  
 RSVP-TCPv6-Dienstanbieter : 2 : 1 : %SystemRoot%\system32\mswsock.dll 
 RSVP-TCP-Dienstanbieter : 2 : 1 :  
 RSVP-UDPv6-Dienstanbieter : 2 : 2 : %SystemRoot%\system32\mswsock.dll 
 RSVP-UDP-Dienstanbieter : 2 : 2 : 

This report also contains technical information about the state of the application when it crashed.

Comment 7

[gixxpunk]

Crash-stats link: https://crash-stats.mozilla.com/report/index/e1c4ba7e-1c71-4783-bf16-c223b2130415

Comment 8

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

OK, guys I know the culprit here... as I try harder to remember what can causes the crash as it didn't happen some days ago I remembered that I changed
"layers.offmainthreadcomposition.enabled" from "false" to "true" after landing layers-refactoring and this setting is the culprit. So now I don't know it this bug is still valid as OMTC hasn't landed yet for Windows.

Comment 9

[gixxpunk]

Thanks, after setting layers.offmainthreadcomposition.enabled to false it does not crash anymore!

Comment 10

[Scoobidiver (away)]

The stack trace looks like:
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::layers::ImageHostBuffered::EnsureTextureHost 	gfx/layers/composite/ImageHost.cpp:164
1 	xul.dll 	mozilla::layers::CompositableParentManager::ReceiveCompositableUpdate 	gfx/layers/ipc/CompositableTransactionParent.cpp:79
2 	xul.dll 	mozilla::layers::ImageBridgeParent::RecvUpdate 	gfx/layers/ipc/ImageBridgeParent.cpp:51
3 	xul.dll 	mozilla::layers::PImageBridgeParent::OnMessageReceived 	obj-firefox/ipc/ipdl/PImageBridgeParent.cpp:505
4 	xul.dll 	mozilla::ipc::SyncChannel::OnDispatchMessage 	ipc/glue/SyncChannel.cpp:145
5 	xul.dll 	mozilla::ipc::RPCChannel::OnMaybeDequeueOne 	ipc/glue/RPCChannel.cpp:400
6 	xul.dll 	MessageLoop::RunTask 	ipc/chromium/src/base/message_loop.cc:334
7 	xul.dll 	MessageLoop::DeferOrRunPendingTask 	ipc/chromium/src/base/message_loop.cc:342
8 	xul.dll 	MessageLoop::DoWork 	ipc/chromium/src/base/message_loop.cc:442
9 	xul.dll 	base::MessagePumpDefault::Run 	ipc/chromium/src/base/message_pump_default.cc:23
10 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:209
11 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:183
12 	xul.dll 	base::Thread::ThreadMain 	ipc/chromium/src/base/thread.cc:156
13 	xul.dll 	`anonymous namespace'::ThreadFunc 	ipc/chromium/src/base/platform_thread_win.cc:26
14 	kernel32.dll 	BaseThreadInitThunk 	
15 	ntdll.dll 	__RtlUserThreadStart 	
16 	ntdll.dll 	_RtlUserThreadStart 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Alayers%3A%3AImageHostBuffered%3A%3AEnsureTextureHost%28unsigned+int%2C+mozilla%3A%3Alayers%3A%3ASurfaceDescriptor+const%26%2C+mozilla%3A%3Alayers%3A%3AISurfaceAllocator*%2C+mozilla%3A%3Alayers%3A%3ATextureInfo+const%26%29

Comment 11

[Nick Cameron [:nrc]]

Most of the crash reports are on Windows, OMTC is currently not supported in any way, shape, or form on Windows, nor is it expected to work, so crashing is kind of the expected behaviour here (long term, we're working on it though!).

There seem to be two reports on Android though, I'll look into those...

Comment 12

[Nick Cameron [:nrc]]

Well, I couldn't reproduce this on Android, it's possible its been fixed by some of the patches landed recently. Looking at the code, it is possible we don't have a compositor and don't have a texture host which would seg fault, but that should not ever happen. Maybe we should be paranoid and guard against it anyway.

Comment 13

[Nick Cameron [:nrc]]

Attachment: add some slightly paranoid null checks

Comment 14

[Nicolas Silva [:nical]]

Comment on attachment 738869 [details] [diff] [review]
add some slightly paranoid null checks

Review of attachment 738869 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/layers/composite/ImageHost.cpp
@@ +47,4 @@
>      mTextureHost->SetCompositor(compositor);
>    }
>  
>    return true;

maybe we should return false if !mTextureHost

Comment 15

[Nick Cameron [:nrc]]

(In reply to Nicolas Silva [:nical] from comment #14)
> Comment on attachment 738869 [details] [diff] [review]
> add some slightly paranoid null checks
> 
> Review of attachment 738869 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> ::: gfx/layers/composite/ImageHost.cpp
> @@ +47,4 @@
> >      mTextureHost->SetCompositor(compositor);
> >    }
> >  
> >    return true;
> 
> maybe we should return false if !mTextureHost

I don't even know why we return a bool here, I'll remove that.

Comment 16

[Nick Cameron [:nrc]]

Attachment: patch mk2

requesting re-review for the change to EnsureTextureHost signature

Comment 17

[Nick Cameron [:nrc]]

Attachment: patch mk2

better version

Comment 18

[Nick Cameron [:nrc]]

try push: https://tbpl.mozilla.org/?tree=Try&rev=be17354dee43

Comment 19

[Nicolas Silva [:nical]]

Comment on attachment 739286 [details] [diff] [review]
patch mk2

Review of attachment 739286 [details] [diff] [review]:
-----------------------------------------------------------------

It's better indeed without the bool return.

Comment 20

[Nick Cameron [:nrc]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/faf24511d2c6

Comment 21

[Ed Morley [:emorley]]

Backed out for mochitest-2 failures on Android (these were present in the comment 18 try push):
https://tbpl.mozilla.org/?tree=Mozilla-Inbound&rev=faf24511d2c6&jobname=android.*mochitest-2

https://hg.mozilla.org/integration/mozilla-inbound/rev/5517dbffd39d

Comment 22

[Nick Cameron [:nrc]]

(In reply to Ed Morley [:edmorley UTC+1] from comment #21)
> Backed out for mochitest-2 failures on Android (these were present in the
> comment 18 try push):
> https://tbpl.mozilla.org/?tree=Mozilla-
> Inbound&rev=faf24511d2c6&jobname=android.*mochitest-2
> 
> https://hg.mozilla.org/integration/mozilla-inbound/rev/5517dbffd39d

ah, sorry, there were so many suggested bugs for intermittent orange I had assumed they were intermittent :-(

Comment 23

[Nick Cameron [:nrc]]

Try push with new patch: https://tbpl.mozilla.org/?tree=Try&rev=f3af15d1957e

Comment 24

[Nick Cameron [:nrc]]

and another: https://tbpl.mozilla.org/?tree=Try&rev=4891b5cad406

Comment 25

[Nick Cameron [:nrc]]

Attachment: patch mk3

Had to give it another rejig (added MakeTextureHost to ImageHost) to get it to work.

Comment 26

[Nick Cameron [:nrc]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/104e71fda7b9

Comment 27

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/104e71fda7b9

Comment 28

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

Verified with latest Nightly.

FYI - It still crashing, but with other crash signature, so I created a new bug
Bug #866652 - Crash in mozilla::layers::CreateTextureHostD3D9 with OMTC