Closed Bug 986836 Opened 6 years ago Closed 6 years ago

Parent process crash when shutting down compositor @ 0xa5a5a5a4

Categories

(Core :: Graphics, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla31
blocking-b2g 1.4+
Tracking Status
firefox28 --- wontfix
firefox29 --- wontfix
firefox30 --- wontfix
firefox31 + fixed
b2g-v1.4 --- wontfix
b2g-v2.0 --- fixed

People

(Reporter: gwagner, Assigned: bjacob)

References

Details

Attachments

(1 file, 1 obsolete file)

Happens every time during shutdown after mochitests on emulators with debug gecko.

Main thread sends libxul.so!nsBaseWidget::DestroyCompositor()

Compositor thread crashes via libxul.so!mozilla::gl::GLLibraryEGL::fDestroySurface(void*, void*) [GLLibraryEGL.h:9fbc75ee6cfa : 187 + 0xd] at 0xa5a5a5a4

We finally have better stack coverage during mochitests so its hard to tell if this is a regression or not.


For example:
https://tbpl.mozilla.org/php/getParsedLog.php?id=36542254&full=1&branch=pine

There is also another assertion present in the _child_ process: MOZ_Assert: Assertion failure: work_queue_.empty(), at ../../../gecko/ipc/chromium/src/base/message_loop.cc:393
Maybe they are related?
See Also: → 986113
(In reply to Gregor Wagner [:gwagner] from comment #0)
> Happens every time during shutdown after mochitests on emulators with debug
> gecko.
> 
> Main thread sends libxul.so!nsBaseWidget::DestroyCompositor()
> 
> Compositor thread crashes via
> libxul.so!mozilla::gl::GLLibraryEGL::fDestroySurface(void*, void*)
> [GLLibraryEGL.h:9fbc75ee6cfa : 187 + 0xd] at 0xa5a5a5a4
> 
> We finally have better stack coverage during mochitests so its hard to tell
> if this is a regression or not.
> 
> 
> For example:
> https://tbpl.mozilla.org/php/getParsedLog.php?id=36542254&full=1&branch=pine
> 
> There is also another assertion present in the _child_ process: MOZ_Assert:
> Assertion failure: work_queue_.empty(), at
> ../../../gecko/ipc/chromium/src/base/message_loop.cc:393
> Maybe they are related?

It's plausible, as the latter shows that some work posted to the MessageLoop did not run.  It could be something that signals the parent process to do proper cleanup etc.
Blocking a blocker.
Blocks: 986113
blocking-b2g: --- → 1.4+
Milan, can you please help us find an owner here?  Thanks!
Assignee: nobody → milan
New feature for 1.4, better support for debug emulators.  I need to get this approved before messing with 2.0 work.
Got it approved.  Benoit, all yours.
Assignee: milan → bjacob
Flags: needinfo?(bjacob)
How far back does this issue go?
Got it, looking.
Flags: needinfo?(bjacob)
Attachment #8405006 - Flags: review?(jmuizelaar)
Comment on attachment 8405006 [details] [diff] [review]
Don't destroy the native framebuffer's eglSurface

Review of attachment 8405006 [details] [diff] [review]:
-----------------------------------------------------------------

Make a more thorough comment
Attachment #8405006 - Flags: review?(jmuizelaar) → review+
Attachment #8405006 - Attachment is obsolete: true
Attachment #8405009 - Flags: review?(jmuizelaar)
Attachment #8405009 - Flags: review?(jmuizelaar) → review+
I see more crashes with this patch applied: https://tbpl.mozilla.org/?showall=1&tree=Pine&rev=fed9d5539ef0
Are these followups?
(In reply to Gregor Wagner [:gwagner] from comment #11)
> I see more crashes with this patch applied:
> https://tbpl.mozilla.org/?showall=1&tree=Pine&rev=fed9d5539ef0
> Are these followups?

Aren't those crashes bug 983489?
(In reply to Gregor Wagner [:gwagner] from comment #11)
> I see more crashes with this patch applied:
> https://tbpl.mozilla.org/?showall=1&tree=Pine&rev=fed9d5539ef0
> Are these followups?

These crashes seem different. Clearly, trying to run DEBUG builds when we didn't until now, is bound to run into many crashes. The patch just landed fixes one specific crash, the one originally described in comment 0.

(In reply to :Ehsan Akhgari (lagging on bugmail, needinfo? me!) from comment #12)
> (In reply to Gregor Wagner [:gwagner] from comment #11)
> > I see more crashes with this patch applied:
> > https://tbpl.mozilla.org/?showall=1&tree=Pine&rev=fed9d5539ef0
> > Are these followups?
> 
> Aren't those crashes bug 983489?

Just clicking on a few orange numbers on the TBPL link in comment 11, suggests that we are looking at more than one different bug here.
mwu points out bug 930884 which has a patch fixing the ICS emulator bug that we were working around here.
Bug 930884 landed on March 15th, but this was filed a week after. So, it sounds like either bug 930884 didn't work or this patch won't make any difference and there's a different cause for this crash.
https://hg.mozilla.org/mozilla-central/rev/20e45d4b88f4
Status: NEW → RESOLVED
Closed: 6 years ago
status-b2g-v1.2: --- → ?
status-b2g-v1.3: --- → ?
status-b2g-v1.4: --- → ?
Resolution: --- → FIXED
Target Milestone: --- → mozilla31
(In reply to Ryan VanderMeulen [:RyanVM UTC-4] from comment #17)
> https://hg.mozilla.org/mozilla-central/rev/20e45d4b88f4

Did this only affect trunk and therefore not need sec-approval? The b2g flags kind of indicate otherwise.
Flags: needinfo?(bjacob)
Flags: needinfo?(bjacob)
This bug only affects ICS emulator, not real devices/users, and unhiding it will benefit discussion on another bug.
Group: core-security
Ah. So, what are next steps here?

Do we need to re-land this? If not, do we not need this at all anymore?

We probably need to sync on this with people working on bug 930884 ... Michael, do you know what we need to do here?
Flags: needinfo?(mwu)
Bug 930884 should've fixed it, and there haven't been any oranges reported on that bug after landing, so I think we're done. Relanding shouldn't be necessary.
Flags: needinfo?(mwu)
ignore that ^
You need to log in before you can comment on or make changes to this bug.