999736 - crash in mozilla::layers::ContentHostTexture::Lock()

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-53d4b079-628b-4d23-a94f-5fdea2140417.
=============================================================
Frame 	Module 	Signature 	Source
0 	libxul.so 	mozilla::layers::ContentHostTexture::Lock() 	/builds/slave/b2g_m-cen_ham_ntly-00000000000/build/objdir-gecko/gfx/layers/../../dist/include/mozilla/layers/ContentHost.h
1 	libxul.so 	mozilla::layers::ContentHostBase::Composite(mozilla::layers::EffectChain&, float, mozilla::gfx::Matrix4x4 const&, mozilla::gfx::Filter const&, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const&, nsIntRegion const*, mozilla::layers::TiledLayerProperties*) 	gfx/layers/composite/ContentHost.cpp
2 	libxul.so 	mozilla::layers::ThebesLayerComposite::RenderLayer(nsIntRect const&) 	gfx/layers/composite/ThebesLayerComposite.cpp
3 	libxul.so 	void mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerComposite>(mozilla::layers::ContainerLayerComposite*, mozilla::layers::LayerManagerComposite*, nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
4 	libxul.so 	mozilla::layers::ContainerLayerComposite::RenderLayer(nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
5 	libxul.so 	void mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerComposite>(mozilla::layers::ContainerLayerComposite*, mozilla::layers::LayerManagerComposite*, nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
6 	libxul.so 	mozilla::layers::ContainerLayerComposite::RenderLayer(nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
7 	libxul.so 	void mozilla::layers::ContainerRender<mozilla::layers::RefLayerComposite>(mozilla::layers::RefLayerComposite*, mozilla::layers::LayerManagerComposite*, nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
8 	libxul.so 	mozilla::layers::RefLayerComposite::RenderLayer(nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
9 	libxul.so 	void mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerComposite>(mozilla::layers::ContainerLayerComposite*, mozilla::layers::LayerManagerComposite*, nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
10 	libxul.so 	mozilla::layers::ContainerLayerComposite::RenderLayer(nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
11 	libxul.so 	void mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerComposite>(mozilla::layers::ContainerLayerComposite*, mozilla::layers::LayerManagerComposite*, nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
12 	libxul.so 	mozilla::layers::ContainerLayerComposite::RenderLayer(nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
13 	libxul.so 	mozilla::layers::LayerManagerComposite::Render() 	gfx/layers/composite/LayerManagerComposite.cpp
14 	libxul.so 	mozilla::layers::LayerManagerComposite::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/composite/LayerManagerComposite.cpp
15 	libxul.so 	mozilla::layers::LayerManagerComposite::EndEmptyTransaction(mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/composite/LayerManagerComposite.cpp
16 	libxul.so 	mozilla::layers::CompositorParent::CompositeToTarget(mozilla::gfx::DrawTarget*) 	gfx/layers/ipc/CompositorParent.cpp
17 	libxul.so 	mozilla::layers::CompositorParent::Composite() 	gfx/layers/ipc/CompositorParent.cpp
18 	libxul.so 	RunnableMethod<FdWatcher, void (FdWatcher::*)(), Tuple0>::Run() 	ipc/chromium/src/base/tuple.h
19 	libxul.so 	MessageLoop::RunTask(Task*) 	ipc/chromium/src/base/message_loop.cc
20 	libxul.so 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) 	ipc/chromium/src/base/message_loop.cc
21 	libxul.so 	MessageLoop::DoDelayedWork(base::TimeTicks*) 	ipc/chromium/src/base/message_loop.cc
22 	libxul.so 	base::MessagePumpDefault::Run(base::MessagePump::Delegate*) 	ipc/chromium/src/base/message_pump_default.cc
23 	libxul.so 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc
24 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
25 	libxul.so 	base::Thread::ThreadMain() 	ipc/chromium/src/base/thread.cc
26 	libxul.so 	ThreadFunc 	ipc/chromium/src/base/platform_thread_posix.cc
27 	libc.so 	__thread_entry 	bionic/libc/bionic/pthread.c
28 	libc.so 	pthread_create 	bionic/libc/bionic/pthread.c

First crash started seems like 4/3?  Maybe related to bug 990437?  I am not sure.  I might be wrong.

Comment 1

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

The only URL I can find for this crash is : 
http://www.simonwessely.com/Downloads/Publications/Military/historical/Jones%202007%20-%20shell%20shock%20mtbi.pdf

I'm not sure if that's related as of yet.  We probably need STRs to figure this crash out?

Comment 2

[Jason Smith [:jsmith]]

Note - try to reproduce using the URL provided in comment 1 on trunk.

Comment 3

[Nicolas Silva [:nical]]

Looking at the crashing code, it's probably just a missing null check.

Comment 4

[Nicolas Silva [:nical]]

Attachment: Add a null-check in ContentHostTexture::Lock

Comment 5

[Nicolas Silva [:nical]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3d11450e02cb

I don't know how busy qa is at the moment, but if you guys are very busy, then you can probably test whenever this patches makes it to trunk.

Comment 6

[Ryan VanderMeulen (PTO, back July 27)]

https://hg.mozilla.org/mozilla-central/rev/3d11450e02cb