Closed Bug 923917 Opened 11 years ago Closed 11 years ago

[mobile] crash in mozilla::layers::CompositableParentManager::ReceiveCompositableUpdate(mozilla::layers::CompositableOperation const&, std::vector<mozilla::layers::EditReply, std::allocator<mozilla::layers::EditReply> >&)

Categories

(Core :: Graphics: Layers, defect)

All
Android
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla27
Tracking Status
firefox26 --- unaffected
firefox27 --- fixed

People

(Reporter: martijn.martijn, Assigned: nical)

References

()

Details

(Keywords: crash, mobile, regression)

Crash Data

Attachments

(2 files)

I'm hitting this crash on trunk with the url in the url fiel on my Galaxy Nex,us Android 4.3.
I think it's happening because of the Flash video that is in the middle of that page.


This bug was filed from the Socorro interface and is 
report bp-77f7460d-d776-44e7-987c-8e7332131006.
=============================================================
0 	libxul.so 	mozilla::layers::CompositableParentManager::ReceiveCompositableUpdate(mozilla::layers::CompositableOperation const&, std::vector<mozilla::layers::EditReply, std::allocator<mozilla::layers::EditReply> >&) 	/builds/slave/fx-team-and-000000000000000000/build/obj-firefox/gfx/layers/../../../gfx/layers/ipc/CompositableTransactionParent.cpp
1 	libxul.so 	mozilla::layers::LayerTransactionParent::RecvUpdate(nsTArray<mozilla::layers::Edit> const&, mozilla::layers::TargetConfig const&, bool const&, nsTArray<mozilla::layers::EditReply>*) 	gfx/layers/ipc/LayerTransactionParent.cpp
2 	libxul.so 	mozilla::layers::PLayerTransactionParent::OnMessageReceived(IPC::Message const&, IPC::Message*&) 	obj-firefox/ipc/ipdl/PLayerTransactionParent.cpp
3 	libxul.so 	mozilla::layers::PCompositorParent::OnMessageReceived(IPC::Message const&, IPC::Message*&) 	obj-firefox/ipc/ipdl/PCompositorParent.cpp
4 	libxul.so 	mozilla::ipc::MessageChannel::DispatchSyncMessage(IPC::Message const&) 	/builds/slave/fx-team-and-000000000000000000/build/obj-firefox/ipc/glue/../../../ipc/glue/MessageChannel.cpp
5 	libxul.so 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	/builds/slave/fx-team-and-000000000000000000/build/obj-firefox/ipc/glue/../../../ipc/glue/MessageChannel.cpp
6 	libxul.so 	RunnableMethod<ThumbnailRunnable, tag_nsresult (ThumbnailRunnable::*)(), Tuple0>::Run() 	ipc/chromium/src/base/tuple.h
7 	libxul.so 	mozilla::ipc::MessageChannel::DequeueTask::Run() 	/builds/slave/fx-team-and-000000000000000000/build/obj-firefox/ipc/glue/../../dist/include/mozilla/ipc/MessageChannel.h
8 	libxul.so 	MessageLoop::RunTask(Task*) 	/builds/slave/fx-team-and-000000000000000000/build/obj-firefox/ipc/chromium/../../../ipc/chromium/src/base/message_loop.cc
9 	libxul.so 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) 	/builds/slave/fx-team-and-000000000000000000/build/obj-firefox/ipc/chromium/../../../ipc/chromium/src/base/message_loop.cc
10 	libxul.so 	MessageLoop::DoWork() 	/builds/slave/fx-team-and-000000000000000000/build/obj-firefox/ipc/chromium/../../../ipc/chromium/src/base/message_loop.cc
11 	libxul.so 	base::MessagePumpDefault::Run(base::MessagePump::Delegate*) 	ipc/chromium/src/ba
This is not a problem with Aurora.
Keywords: regression
This is the #1 topcrash on Android Nightly now. We definitely should work on this.

It first started to appear in October 4 builds, so some checkin on the 3rd seems to have caused this.
Steps to reproduce crash:
1. Go to a site that has flash content.
2. Go to settings->display->plugins and choose "Enabled"
3. Go back to page and refresh page.

Result:
Firefox crashes; also there is no way you can view flash content(logging a separate bug for that issue)
Depends on: 924092
tracking-fennec: --- → ?
Fallout from bug 916118?
Flags: needinfo?(nical.bugzilla)
Flags: needinfo?(ncameron)
(In reply to Aaron Train [:aaronmt] from comment #4)
> Fallout from bug 916118?

Seems possible. Nical, are you able to look at this? I won't have time until Wednesday afternoon - happy to look at it then.
Flags: needinfo?(ncameron)
I am looking at this.
Assignee: nobody → nical.bugzilla
Flags: needinfo?(nical.bugzilla)
The regression has probably been triggered by enabling the new textures (Bug 922007). There must be something different in the way we composite plugins on fennec and mac (the failing code works on mac).
I can see that we try to update a layer on the content side with an invalid TextureClient. Then serializing the TextureClient fails and it's corresponding TextureHost is not created on the compositor side. Soon after that we send a command that expects to use an unexistant texture host and we hit a fatal assertion.

That highlight the fact that we should have a way to handle serialization failure (at the moment CompositableForwarder::AddTexture just returns void, we should return a boolean and the caller should not try to send other messages for the invalid texture client.

This does not solve the problem that compositing a flash element is broken. still investigating.
This patch adds boolean return value to CompositableClient::AddTextureClient so that the caller can handle failure scenarios. ImageClient::UpdateImage and CanvasClient::Update (the callers) are modified accordingly.

Interestingly, this fixes the crash. It looks like when compositing a flash element the first 1 or 2 frames are not valid and then the compositable receives good textures.

However, the frames are improperly y-inverted. This should not be too hard to fix though.
Attachment #814674 - Flags: review?(ncameron)
Turns out the y-flip problem is just a simple omission to set the texture flag properly.

Now that most of the problem is fixed I'd still like to understand what's happening to those first few frames that don't get serialized properly.
Attachment #814682 - Flags: review?(bas)
there was a bad keystroke in that last try push
https://tbpl.mozilla.org/?tree=Try&rev=19665994590d
Comment on attachment 814674 [details] [diff] [review]
Make ImageClient not crash when texture serialization fails

Review of attachment 814674 [details] [diff] [review]:
-----------------------------------------------------------------

all good
Attachment #814674 - Flags: review?(ncameron) → review+
Comment on attachment 814682 [details] [diff] [review]
Properly se the y-flip flag when needed in SharedTextureClientOGL

Review of attachment 814682 [details] [diff] [review]:
-----------------------------------------------------------------

It sort of saddens me we have this on the TextureClient and not just the Compositable still :( but oh well.
Attachment #814682 - Flags: review?(bas) → review+
(In reply to Bas Schouten (:bas.schouten) from comment #15)
> Comment on attachment 814682 [details] [diff] [review]
> Properly se the y-flip flag when needed in SharedTextureClientOGL
> 
> Review of attachment 814682 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> It sort of saddens me we have this on the TextureClient and not just the
> Compositable still :( but oh well.

Moving this flag to the compositable is probably not very hard to do.
I am busy with plenty of more important stuff though.
https://hg.mozilla.org/mozilla-central/rev/05c32b7824e6
https://hg.mozilla.org/mozilla-central/rev/a79c6c91b105
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla27
tracking-fennec: ? → ---
Depends on: 928804
This caused a regression where all youtube videos are upside-down, bug 928804.
The crash signature associated with this bug is still the #1 topcrash on mac in 27 beta. Tracy were you tracking this in some other bug? Nicolas was the fix that landed somehow specific to mobile and perhaps didn't fix the issue on mac?
Flags: needinfo?(twalker)
Flags: needinfo?(nical.bugzilla)
There was not a desktop Mac specific bug for this.  

Just filed bug 959615 as a follow up to get a fix for desktop.
Flags: needinfo?(twalker)
It's a different crash, in the same function but this function handles a lot of stuff.
Flags: needinfo?(nical.bugzilla)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: