915095 - crash in nsXPCOMCycleCollectionParticipant::Unroot(void*)

Status: RESOLVED DUPLICATE of bug 912725

(Core :: Graphics: Layers, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-e7d13a87-eceb-49b7-a710-f83842130911.
=============================================================
Frame 	Module 	Signature 	Source
0 	libxul.so 	nsXPCOMCycleCollectionParticipant::Unroot(void*) 	/builds/slave/b2g_m-cen_leo_ntly-00000000000/build/objdir-gecko/xpcom/build/nsCycleCollectionParticipant.cpp
1 	libxul.so 	mozilla::layers::GrallocBufferActor::ActorDestroy(mozilla::ipc::IProtocolManager<mozilla::ipc::RPCChannel::RPCListener>::ActorDestroyReason) 	gfx/layers/ipc/ShadowLayerUtilsGralloc.cpp
2 	libxul.so 	mozilla::docshell::POfflineCacheUpdateParent::DestroySubtree(mozilla::ipc::IProtocolManager<mozilla::ipc::RPCChannel::RPCListener>::ActorDestroyReason) 	/builds/slave/b2g_m-cen_leo_ntly-00000000000/build/objdir-gecko/ipc/ipdl/POfflineCacheUpdateParent.cpp
3 	libxul.so 	mozilla::layers::PGrallocBufferParent::OnMessageReceived(IPC::Message const&) 	/builds/slave/b2g_m-cen_leo_ntly-00000000000/build/objdir-gecko/ipc/ipdl/PGrallocBufferParent.cpp
4 	libxul.so 	mozilla::layers::PCompositorParent::OnMessageReceived(IPC::Message const&) 	/builds/slave/b2g_m-cen_leo_ntly-00000000000/build/objdir-gecko/ipc/ipdl/PCompositorParent.cpp
5 	libxul.so 	mozilla::ipc::AsyncChannel::OnDispatchMessage(IPC::Message const&) 	ipc/glue/AsyncChannel.cpp
6 	libxul.so 	mozilla::ipc::RPCChannel::OnMaybeDequeueOne() 	ipc/glue/RPCChannel.cpp
7 	libxul.so 	RunnableMethod<WebCore::ReverbConvolver, void (WebCore::ReverbConvolver::*)(), Tuple0>::Run() 	ipc/chromium/src/base/tuple.h
8 	libxul.so 	mozilla::ipc::RPCChannel::DequeueTask::Run() 	/builds/slave/b2g_m-cen_leo_ntly-00000000000/build/objdir-gecko/ipc/glue/../../dist/include/mozilla/ipc/RPCChannel.h
9 	libxul.so 	MessageLoop::RunTask(Task*) 	ipc/chromium/src/base/message_loop.cc
10 	libxul.so 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) 	ipc/chromium/src/base/message_loop.cc
11 	libxul.so 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
12 	libxul.so 	base::MessagePumpDefault::Run(base::MessagePump::Delegate*) 	ipc/chromium/src/base/message_pump_default.cc
13 	libxul.so 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc
14 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
15 	libxul.so 	base::Thread::ThreadMain() 	ipc/chromium/src/base/thread.cc
16 	libxul.so 	ThreadFunc 	ipc/chromium/src/base/platform_thread_posix.cc
17 	libc.so 	__thread_entry 	bionic/libc/bionic/pthread.c
18 	libc.so 	pthread_create 	bionic/libc/bionic/pthread.c

More Crashes : 
https://crash-stats.mozilla.com/report/list?product=B2G&signature=nsXPCOMCycleCollectionParticipant%3A%3AUnroot%28void*%29

I also crashed w/ https://crash-stats.mozilla.com/report/index/06c08492-9b6b-43db-8ff6-47bcf2130911

STR:
1. launch Usage app
2. go through the FTE with default values
3. select settings
4. toggle on the data use alert
5. toggle off the data use alert right after

Expected: no crash
Actual: crash (see above)

Comment 1

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Note: this happens on leo and buri

Comment 2

[Nicolas Silva [:nical]]

huh, why does a compositor-side class have cycle collection?

Comment 3

[Benoit Jacob [:bjacob] (mostly away)]

The stack in

 https://crash-stats.mozilla.com/report/index/06c08492-9b6b-43db-8ff6-47bcf2130911

shows the crash in

 http://hg.mozilla.org/mozilla-central/annotate/be1053dc223b/gfx/layers/ipc/ShadowLayerUtilsGralloc.cpp#l274

which is the same crash as in bug 912725 and has nothing to do with cycle collection.

It appears that the symbol

  nsXPCOMCycleCollectionParticipant::Unroot(void*)

is just wrong, an error typically caused by Identical Code Folding (ICF) which can be locally disabled with --disable-icf.

Bug 912725 is fixed so this should not happen again. It landed on Sep. 11, so let me know if you see this crash again in builds from Sep. 12 or newer. Otherwise, please close this bug.

Comment 4

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Closing this bug as a duplicate based on comment 3