Chris Peterson [:cpeterson] Reporter
	Description • 9 years ago

When testing MSE bug 1189987, I hit this e10s crash.

STR:
1. Enable e10s.
2. Load http://www.dash-player.com/demo/manifest-test/
3. Paste this manifest URL into the video player: https://mozillalive-a.akamaihd.net/Akamai_Public/ngrp:Nomad-1_all/manifest.mpd
4. Press the LOAD and then play button.

RESULT:
The tab crashes! If the tab doesn't crash within a couple seconds, reload the page and try again.

No crash report is logged to about:crashes, but the following error messages are logged to stdout:

###!!! [Child][DispatchAsyncMessage] Error: (msgtype=0xFFFB,name=???) Payload error: message could not be deserialized

IPDL protocol error: Error deserializing 'data' (Shmem) member of 'SurfaceDescriptorShmem'
IPDL protocol error: Error deserializing 'SurfaceDescriptor'

###!!! [Child][DispatchAsyncMessage] Error: (msgtype=0x800006,name=PLayerTransaction::Msg_PTextureConstructor) Value error: message was deserialized, but contained an illegal value

###!!! [Parent][MessageChannel] Error: (msgtype=0x200084,name=PBrowser::Msg_Destroy) Channel error: cannot send/recv

	Chris Peterson [:cpeterson] Reporter
	Comment 1 • 9 years ago

@ Kats, I bisected this crash to this pushlog, which implicates APZ on OS X:

https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=6ad92b48085b&tochange=cfc312d8ef20

I can reproduce this crash on my MacBook Pro's Retina display, but not on an external non-HiDPI display.

	Kartikaya Gupta (email:kats@mozilla.staktrace.com)
	Comment 2 • 9 years ago

:nical, any ideas what's going on here? I poked around in the IPDL code and it would appear that this happens if the child cannot create a shmem from the info the parent provided (either the bytes are bad or the shmem id is invalid). Not really sure why this would be APZ-specific though.

cpeterson, if you are able to attach a debugger to the child process and see why the shmem deserializing is failing that might help. The relevant code is generated into objdir/ipc/ipdl/PLayerTransactionChild.cpp: the function is PLayerTransaction::Read(Shmem* v__, const Message* msg__, void** iter__) - this is returning false when it shouldn't be.

	Kartikaya Gupta (email:kats@mozilla.staktrace.com)
	Comment 3 • 9 years ago

(I'm also not able to repro this on my non-retina mac air)

	Markus Stange [:mstange]
	Comment 4 • 9 years ago

The reproduction steps work on my machine.

	Kartikaya Gupta (email:kats@mozilla.staktrace.com)
	Comment 5 • 8 years ago

Is this still reproducible?

	Kartikaya Gupta (email:kats@mozilla.staktrace.com)
	Comment 6 • 8 years ago

(Please check both 46 and 47 if you have a chance. If it's only fixed in 47, we should uplift whatever fixed it to 46)

	Chris Peterson [:cpeterson] Reporter
	Comment 7 • 8 years ago

The crash is reproducible in Aurora 46, but not Nightly 47.

Note that the manifest.mpd URL in comment 0's STR is 404. You can reproduce the crash with this mpd URL:

http://storage.googleapis.com/widevine-demo-media/sintel-1080p/dash.mpd

	Kartikaya Gupta (email:kats@mozilla.staktrace.com)
	Comment 8 • 8 years ago

Thanks! We should get a fix window and see if we can uplift whatever fixed it. Adding regression-window keyword but really we need a reverse-regression window between 46 and 47.

	Chris Peterson [:cpeterson] Reporter
	Comment 9 • 8 years ago

Kats, I bisected the fix with mozregression to bug 1208226, which is pending uplift approval for Aurora 46 and Beta 45. Do you want to close this bug as FIXED by bug 1208226? Or wait until that fix has been uplifted and this bug's STR retested?

https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=8eeb8603b17a97ef1699409a9146b9e912094ca7&tochange=cd6861f24772db945f5e6ea7c5bd0b81a05350f8

	Kartikaya Gupta (email:kats@mozilla.staktrace.com)
	Comment 10 • 8 years ago

Thanks, Chris! I'll mark this as FIXED and leave a comment in the other bug which might help with the uplift decision. We can reverify once the patch is uplifted.