Robert Kaiser Reporter
	Description • 9 years ago

[Tracking Requested - why for this release]:

This bug was filed from the Socorro interface and is 
report bp-aa8091d3-7e50-43af-94a4-5581a2150924.
=============================================================

Strack Trace:
0 	mozglue.dll 	mozalloc_abort(char const* const) 	memory/mozalloc/mozalloc_abort.cpp
1 	xul.dll 	NS_DebugBreak 	xpcom/base/nsDebugImpl.cpp
2 	xul.dll 	mozilla::layers::PImageBridgeChild::Write(mozilla::layers::PCompositableChild*, IPC::Message*, bool) 	obj-firefox/ipc/ipdl/PImageBridgeChild.cpp
3 	xul.dll 	mozilla::layers::PImageBridgeChild::Write(mozilla::layers::CompositableOperation const&, IPC::Message*) 	obj-firefox/ipc/ipdl/PImageBridgeChild.cpp
4 	xul.dll 	mozilla::layers::PImageBridgeChild::SendUpdateNoSwap(nsTArray<mozilla::layers::CompositableOperation> const&) 	obj-firefox/ipc/ipdl/PImageBridgeChild.cpp
5 	xul.dll 	mozilla::layers::ImageBridgeChild::EndTransaction() 	gfx/layers/ipc/ImageBridgeChild.cpp
6 	xul.dll 	mozilla::ipc::MessageChannel::MaybeHandleError(mozilla::ipc::HasResultCodes::Result, IPC::Message const&, char const*) 	ipc/glue/MessageChannel.cpp
7 	mozglue.dll 	je_free 	memory/mozjemalloc/jemalloc.c
8 	xul.dll 	nsTArray_Impl<mozilla::layers::ImageClientSingle::Buffer, nsTArrayInfallibleAllocator>::RemoveElementsAt(unsigned int, unsigned int) 	xpcom/glue/nsTArray.h
9 	xul.dll 	nsTArray_Impl<mozilla::layers::ImageClientSingle::Buffer, nsTArrayInfallibleAllocator>::Clear() 	xpcom/glue/nsTArray.h
10 	xul.dll 	mozilla::layers::ImageClientSingle::FlushAllImages(mozilla::layers::AsyncTransactionWaiter*) 	gfx/layers/client/ImageClient.cpp
11 	xul.dll 	mozilla::layers::FlushAllImagesSync 	gfx/layers/ipc/ImageBridgeChild.cpp
12 	xul.dll 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc


This seems to have started spiking in 42, both Dev Edition and Beta 1, and is now the #3 with 2.2% of all 42 Beta 1 crashes.

	(Away)
	Comment 1 • 9 years ago

auto PImageBridgeChild::Write(
...
            NS_RUNTIMEABORT("actor has been |delete|d");

	Milan Sreckovic [:milan] (needinfo for best results)
	Comment 2 • 9 years ago

:nical, this is a top crasher on beta, so let's follow up on this or the blocking bug you entered without waiting too long.

	Nicolas Silva [:nical] Assignee
	Comment 3 • 9 years ago

The stacks are a bit odd (I can't imagine how destroying a TextureChild could cause EndTransaction further down the stack, so I don't trust stack frames above the EndTransaction parent).
This patch attempts to paper over the issue by making sure we do have a valid actor when we add it to the transaction. It should always be the case but It's not going to be easy to find out what puts us in this state this late in beta, so hopefully this will remove the crash.

	Nicolas Silva [:nical] Assignee
	Comment 4 • 9 years ago

Comment on attachment 8667889 [details] [diff] [review]
Make sure we never add a texture in a weird state to a transaction (beta)

Approval Request Comment
[Feature/regressing bug #]:
[User impact if declined]: top crash
[Describe test coverage new/current, TreeHerder]: none
[Risks and why]: rather low. The patch is simple.
[String/UUID change made/needed]:

	Pulsebot
	Comment 5 • 9 years ago

https://hg.mozilla.org/integration/mozilla-inbound/rev/bc3d04197a9b

	Carsten Book [:Tomcat]
	Comment 6 • 9 years ago

https://hg.mozilla.org/mozilla-central/rev/bc3d04197a9b

	Sylvestre Ledru [:Sylvestre]
	Comment 7 • 9 years ago

Comment on attachment 8667889 [details] [diff] [review]
Make sure we never add a texture in a weird state to a transaction (beta)

Taking it, should be in b3 or b4.

	Carsten Book [:Tomcat]
	Comment 8 • 9 years ago

https://hg.mozilla.org/releases/mozilla-beta/rev/3da1f59bedfa

	Carsten Book [:Tomcat]
	Comment 9 • 9 years ago

(In reply to Carsten Book [:Tomcat] from comment #8)
> https://hg.mozilla.org/releases/mozilla-beta/rev/3da1f59bedfa

landed by nical, but since pulsebot does not mark bugs in aurora/beta i did the marking now

	Nicolas Silva [:nical] Assignee
	Comment 10 • 9 years ago

(In reply to Carsten Book [:Tomcat] from comment #9)
> landed by nical, but since pulsebot does not mark bugs in aurora/beta i did
> the marking now

oops sorry, spoiled by the habbit of letting pulsebot do work for me :)

	Sylvestre Ledru [:Sylvestre]
	Comment 11 • 9 years ago

Looks like you forgot aurora here :)

	Sylvestre Ledru [:Sylvestre]
	Comment 12 • 9 years ago

Comment on attachment 8667889 [details] [diff] [review]
Make sure we never add a texture in a weird state to a transaction (beta)

Thanks!

	Nicolas Silva [:nical] Assignee
	Comment 13 • 9 years ago

https://hg.mozilla.org/releases/mozilla-aurora/rev/5d0ccc18994f