Closed
Bug 989408
Opened 10 years ago
Closed 10 years ago
crash in mozilla::layers::PLayerTransactionChild::SendPLayerConstructor(mozilla::layers::PLayerChild*)
Categories
(Core :: Graphics: Layers, defect)
Tracking
()
People
(Reporter: bzumwalt, Assigned: sotaro)
References
(Depends on 1 open bug)
Details
(Keywords: crash, reproducible, Whiteboard: [b2g-crash])
Crash Data
Attachments
(4 files)
13.01 KB,
text/plain
|
Details | |
10.88 KB,
patch
|
Details | Diff | Splinter Review | |
72.20 KB,
text/plain
|
Details | |
5.67 KB,
patch
|
nical
:
review+
bjacob
:
review+
|
Details | Diff | Splinter Review |
This bug was filed from the Socorro interface and is report bp-531e51f8-71a0-4eea-b068-802232140328. ============================================================= Description: In FTU opening and closing Firefox Privacy policy page rapidly results in crash to homescreen Repro Steps: 1) Updated Buri to BuildID: 20140328000202 2) Sign in to wireless network in FTU 3) Select next in FTU until reaching Geolocation page 4) Press "More about your privacy link" 5) Click Firefox OS 6) Close page by pressing "X" 7) Repeat steps 5 & 6 rapidly and repeatedly Actual: Device crashes to homescreen. Expected: User is taken back and forth between two pages. Environmental Variables: Device: Buri v1.4 Mozilla RIL BuildID: 20140328000202 Gaia: e07a5915737727ba22c06f270ee7af6572f746f3 Gecko: 33e7fd745c1b Version: 30.0a2 Firmware Version: v1.2-device.cfg Notes: Repro frequency: 3/3, 100% See attached: logcat crash in mozilla::layers::PLayerTransactionChild::SendPLayerConstructor(mozilla::layers::PLayerChild*)
Reporter | ||
Comment 1•10 years ago
|
||
Attached logcat. Unable to include logcat while Console and Gaia Debug Traces are enabled due to lack of access to dev options inside FTU.
Comment 2•10 years ago
|
||
I'm pretty sure this isn't reproducing on 1.3, but let's confirm that to be sure.
blocking-b2g: --- → 1.4?
Component: Gaia::First Time Experience → Graphics: Layers
Product: Firefox OS → Core
Whiteboard: [b2g-crash]
Version: unspecified → 30 Branch
Comment 3•10 years ago
|
||
(In reply to Jason Smith [:jsmith] from comment #2) > I'm pretty sure this isn't reproducing on 1.3, but let's confirm that to be > sure. I was able to reproduce this issue on the 1.3 build, the device crashed to homescreen. Environmental Variables: Device: Buri 1.3 MOZ BuildID: 20140328004002 Gaia: 523196662f4d19c7898d5f4773da020c39cfe57e Gecko: aa1d48ab3715 Version: 28.0 Firmware Version: V1.2-device.cfg
Keywords: qawanted
Comment 4•10 years ago
|
||
Can you check if this happens on 1.1?
Updated•10 years ago
|
status-b2g-v1.3:
--- → affected
status-b2g-v1.4:
--- → affected
Reporter | ||
Comment 5•10 years ago
|
||
Does NOT occur in 1.1. Menu navigation also appears to be different. Instead of the "X" in the top corner on the Firefox OS privacy policy page there is a back button on the bottom of the screen. Environmental Variables: Device: Buri v1.1 Mozilla RIL BuildID: 20140331041208 Gaia: 44a2ddf63373f8e95c784faf4ed4d60081699c61 Gecko: 170d87349060 Version: 18.0 Firmware Version: v1.2-device.cfg
status-b2g18:
--- → unaffected
Flags: needinfo?(bzumwalt)
Comment 6•10 years ago
|
||
Can this be reproduced this in a more realistic user flow in 1.3 (i.e. not rapid interactions, but normal user workflows of operation).
Keywords: qawanted
Assignee | ||
Updated•10 years ago
|
Assignee: nobody → sotaro.ikeda.g
Assignee | ||
Comment 7•10 years ago
|
||
Add some logouts and KillHard() call in ContentParent::ProcessingError(Result what) is commented out for ease of debugging.
Assignee | ||
Comment 8•10 years ago
|
||
On recent v1.4 hamachi, I could reproduce the crash but the crash happened around IndexedDB's IPC. Anyway, from the source code, ShadowLayerForwarder's code also has a problem. Need to fix it.
Assignee | ||
Comment 9•10 years ago
|
||
From the log, content's initialization happens after TabChild::ActorDestroy() and TabParent::Destroy() is called.
Assignee | ||
Comment 10•10 years ago
|
||
(In reply to Sotaro Ikeda [:sotaro] from comment #8) > On recent v1.4 hamachi, I could reproduce the crash but the crash happened > around IndexedDB's IPC. Anyway, from the source code, ShadowLayerForwarder's > code also has a problem. Need to fix it. I always face an application's crash because of IndexedDB error. I did not see PLayerTransactionChild::SendPLayerConstructor().
Assignee | ||
Comment 11•10 years ago
|
||
Assignee | ||
Updated•10 years ago
|
Attachment #8406508 -
Flags: review?(nical.bugzilla)
Attachment #8406508 -
Flags: review?(bjacob)
Assignee | ||
Comment 12•10 years ago
|
||
Set to 1.4? flag. This bug blocks 1.4+ bug.
Comment 13•10 years ago
|
||
Comment on attachment 8406508 [details] [diff] [review] patch - Add checking IPCOpen to ShadowLayerForwarder Review of attachment 8406508 [details] [diff] [review]: ----------------------------------------------------------------- Thanks! One comment below: ::: gfx/layers/ipc/ShadowLayers.cpp @@ +585,5 @@ > bool > ShadowLayerForwarder::IsSameProcess() const > { > + if (!mShadowManager->IPCOpen()) { > + return false; Could this instead be a MOZ_ASSERT(mShadowManager->IPCOpen()), and fix the callers to check IPCOpen() before calling IsSameProcess()? That would make more sense to me, than encoding "IPC link down" as "not same process" which seems ad-hoc. There should be very few callers to fix, as I only very recently added this IsSameProcess thing for MemoryTexture's.
Attachment #8406508 -
Flags: review?(bjacob) → review+
Comment 14•10 years ago
|
||
Note that this comment is only about this one instance, in IsSameProcess. All other places look fine.
Comment 15•10 years ago
|
||
(In reply to Sotaro Ikeda [:sotaro] from comment #12) > Set to 1.4? flag. This bug blocks 1.4+ bug. Blocks a blocker.
blocking-b2g: --- → 1.4+
Keywords: qawanted
Comment 16•10 years ago
|
||
Comment on attachment 8406508 [details] [diff] [review] patch - Add checking IPCOpen to ShadowLayerForwarder Review of attachment 8406508 [details] [diff] [review]: ----------------------------------------------------------------- About bjacob's comment: we almost never use debug builds for automated testing on b2g so they are not as useful as they are on desktop. I would rather have at least the "if -> return" and optionally have an assert on top of that for debug builds.
Attachment #8406508 -
Flags: review?(nical.bugzilla) → review+
Assignee | ||
Comment 17•10 years ago
|
||
(In reply to Benoit Jacob [:bjacob] from comment #13) > Comment on attachment 8406508 [details] [diff] [review] > patch - Add checking IPCOpen to ShadowLayerForwarder > > Review of attachment 8406508 [details] [diff] [review]: > ----------------------------------------------------------------- > > Thanks! One comment below: > > ::: gfx/layers/ipc/ShadowLayers.cpp > @@ +585,5 @@ > > bool > > ShadowLayerForwarder::IsSameProcess() const > > { > > + if (!mShadowManager->IPCOpen()) { > > + return false; > > Could this instead be a MOZ_ASSERT(mShadowManager->IPCOpen()), and fix the > callers to check IPCOpen() before calling IsSameProcess()? I do not want to expose IPC internal status out side of ShadowLayerForwarder. I do not even like current patch. I create it just for band-aid fix.
Assignee | ||
Comment 18•10 years ago
|
||
https://tbpl.mozilla.org/?tree=Try&rev=c4157576588d
Assignee | ||
Comment 19•10 years ago
|
||
https://hg.mozilla.org/integration/b2g-inbound/rev/d8e8e9c6bf09
Comment 20•10 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/d8e8e9c6bf09
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla31
Comment 21•10 years ago
|
||
https://hg.mozilla.org/releases/mozilla-aurora/rev/987db9c9b103
status-b2g-v2.0:
--- → fixed
status-firefox29:
--- → wontfix
status-firefox30:
--- → fixed
status-firefox31:
--- → fixed
You need to log in
before you can comment on or make changes to this bug.
Description
•