This bug is for crash report bp-0362e851-cb5f-4995-b725-5659b0190730.

Top 10 frames of crashing thread:

0 xul.dll mozilla::gfx::VRShMem::JoinShMem gfx/vr/VRShMem.cpp:279
1 xul.dll void mozilla::gfx::VRService::ServiceInitialize gfx/vr/service/VRService.cpp:151
2 xul.dll nsresult mozilla::detail::RunnableMethodImpl< xpcom/threads/nsThreadUtils.h:1176
3 xul.dll MessageLoop::DoWork ipc/chromium/src/base/message_loop.cc:523
4 xul.dll base::MessagePumpDefault::Run ipc/chromium/src/base/message_pump_default.cc:35
5 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:308
6 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:290
7 xul.dll base::Thread::ThreadMain ipc/chromium/src/base/thread.cc:192
8 xul.dll `anonymous namespace'::ThreadFunc ipc/chromium/src/base/platform_thread_win.cc:19
9 kernel32.dll BaseThreadInitThunk 

There are 18 crashes (from 10 installations) in nightly 70 starting with buildid 20190729213839. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1563233.

[1] https://hg.mozilla.org/mozilla-central/rev?node=d1b749a11195

Requesting access to crash dumps so that I can investigate the bug

That should be related with Bug 1570440.

Reliable repro steps:

1. turn off vr process in about:config
2. restart fx
3. navigate to https://webvr.info/samples/03-vr-presentation.html
4. enter vr (steamvr should start if not already running)
5. exit vr
6. navigate to https://www.bing.com/
7. wait for firefox.exe to no longer appear in steamvr status
8. navigate back to https://webvr.info/samples/03-vr-presentation.html
9. crash

Bug understood, testing and validating local fix

This change addresses an issue where VRShMem can be in an invalid state when
there is no VR process available. In this case, the VRExternalShmem struct is
allocated on the heap rather than accessed via shared memory. When VRService
stops, it clears this pointer, but cannot re-access it when it restarts. Thus,
this results in a nullptr crash when a tab Enters, Exits, and Re-enters VR.

The fix is to distinguish between in-proc heap allocation vs cross-proc shared
memory so that VRService can decide to make the call to LeaveShMem in its Stop
function. This will keep the heap allocation alive across service restarts and
prevent the null crash.

Backed out for crashes on mozilla::gfx::VRShMem::CreateShMem(bool)

Backout link: https://hg.mozilla.org/integration/autoland/rev/51738e0c713be935e60012e29d08b121289c3931
Log link: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=260453257&repo=autoland&lineNumber=3561

https://hg.mozilla.org/mozilla-central/rev/6ed00c66b890

Clearing needinfo, fix checked in