754426 - nsScreenManagerAndroid::AddRef called from wrong thread during OMTC GLContext creation

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Benoit Jacob [:bjacob] (mostly away)]

This was obtained with the patch from bug 753659 applied, to make this a fatal assertion.



adb| void mozilla::AndroidBridge::HandleGeckoMessage(const nsAString_internal&, nsAString_internal&)
adb| Got message: Content:StateChange
adb| State - 786448
adb| Got a document stop
adb| leaving void mozilla::AndroidBridge::HandleGeckoMessage(const nsAString_internal&, nsAString_internal&)
adb| ###!!! ASSERTION: Using observer service off the main thread!: 'Error', file /hack/mozilla-central/xpcom/ds/nsObserverService.cp...
adb| Logging GL tracing output to /data/data/org.mozilla.fennec_bjacob/firefox.trace
adb| Attempting load of /data/local/egltrace.so
adb| Attempting load of libEGL.so
[New Thread 7772]
adb| Extensions: EGL_KHR_image EGL_KHR_image_base EGL_KHR_image_pixmap EGL_ANDROID_image_native_buffer EGL_ANDROID_swap_rectangle  0x45
adb| Extensions length: 113
adb| ###!!! ASSERTION: Using observer service off the main thread!: 'Error', file /hack/mozilla-central/xpcom/ds/nsObserverService.cp...

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 7772]
0x4b8a0512 in nsScreenManagerAndroid::AddRef (this=0x492ddbf0) at /hack/mozilla-central/widget/android/nsScreenManagerAndroid.cpp:98
98      NS_IMPL_ISUPPORTS1(nsScreenManagerAndroid, nsIScreenManager)
(gdb) bt
#0  0x4b8a0512 in nsScreenManagerAndroid::AddRef (this=0x492ddbf0)
    at /hack/mozilla-central/widget/android/nsScreenManagerAndroid.cpp:98
#1  0x4ad9ff90 in nsCOMPtr<nsISupports>::nsCOMPtr (this=0x49eff7b8, aSmartPtr=...) at ../../../dist/include/nsCOMPtr.h:881
#2  0x4bb29c2a in nsComponentManagerImpl::GetServiceByContractID (this=0x478a1400, 
    aContractID=0x4ca6dfbc "@mozilla.org/gfx/screenmanager;1", aIID=..., result=0x49eff85c)
    at /hack/mozilla-central/xpcom/components/nsComponentManager.cpp:1403
#3  0x4bad2928 in CallGetService (aContractID=0x4ca6dfbc "@mozilla.org/gfx/screenmanager;1", aIID=..., aResult=0x49eff85c)
    at /hack/mozilla-central/obj-mobile-debug/xpcom/build/nsComponentManagerUtils.cpp:94
#4  0x4bad2d62 in nsGetServiceByContractID::operator() (this=0x49eff850, aIID=..., aInstancePtr=0x49eff85c)
    at /hack/mozilla-central/obj-mobile-debug/xpcom/build/nsComponentManagerUtils.cpp:278
#5  0x4a86b9fa in nsCOMPtr<nsIAppStartup>::assign_from_gs_contractid (this=0x49eff880, gs=..., aIID=...)
    at ../../dist/include/nsCOMPtr.h:1212
#6  0x4ad25a84 in nsCOMPtr<nsIScreenManager>::nsCOMPtr (this=0x49eff880, gs=...) at ../../../../dist/include/nsCOMPtr.h:615
#7  0x4bc7f71e in mozilla::gl::GetScreenDepth () at /hack/mozilla-central/gfx/gl/GLContextProviderEGL.cpp:1406
#8  0x4bc7f7bc in mozilla::gl::CreateConfig (aConfig=0x49eff8d4) at /hack/mozilla-central/gfx/gl/GLContextProviderEGL.cpp:1422
#9  0x4bc7f9f2 in mozilla::gl::GLContextProviderEGL::CreateForWindow (aWidget=0x46459880)
    at /hack/mozilla-central/gfx/gl/GLContextProviderEGL.cpp:1525
#10 0x4bc5921e in mozilla::layers::LayerManagerOGL::CreateContext (this=0x49def8a0)
    at /hack/mozilla-central/gfx/layers/opengl/LayerManagerOGL.cpp:177
#11 0x4b8a4c5a in mozilla::layers::LayerManagerOGL::Initialize (this=0x49def8a0, force=false)
    at ../../dist/include/LayerManagerOGL.h:110
#12 0x4bc6b202 in mozilla::layers::CompositorParent::AllocPLayers (this=0x49d05c00, backendType=@0x49effa38)
    at /hack/mozilla-central/gfx/layers/ipc/CompositorParent.cpp:457
#13 0x4ba2487a in mozilla::layers::PCompositorParent::OnMessageReceived (this=0x49d05c00, __msg=..., __reply=@0x49effbdc)
    at /hack/mozilla-central/obj-mobile-debug/ipc/ipdl/PCompositorParent.cpp:470
#14 0x4b9cad08 in mozilla::ipc::SyncChannel::OnDispatchMessage (this=0x49d05c08, msg=...)
    at /hack/mozilla-central/ipc/glue/SyncChannel.cpp:175
#15 0x4b9c43e6 in mozilla::ipc::RPCChannel::OnMaybeDequeueOne (this=0x49d05c08) at /hack/mozilla-central/ipc/glue/RPCChannel.cpp:432
#16 0x4b99ceda in DispatchToMethod<mozilla::plugins::ChildTimer, void (mozilla::plugins::ChildTimer::*)()> (obj=0x49d05c08, method=
    (void (mozilla::plugins::ChildTimer::*)(mozilla::plugins::ChildTimer * const)) 0x4b9c423d <mozilla::ipc::RPCChannel::OnMaybeDequeueOne()>, arg=...) at /hack/mozilla-central/ipc/chromium/src/base/tuple.h:383
#17 0x4b9a4d24 in RunnableMethod<mozilla::plugins::PluginInstanceChild, void (mozilla::plugins::PluginInstanceChild::*)(), Tuple0>::Run
    (this=0x49afc580) at /hack/mozilla-central/ipc/chromium/src/base/task.h:307
#18 0x4b9c2f04 in mozilla::ipc::RPCChannel::RefCountedTask::Run (this=0x49afe760) at ../../dist/include/mozilla/ipc/RPCChannel.h:462
#19 0x4b9c2fe8 in mozilla::ipc::RPCChannel::DequeueTask::Run (this=0x49f91820) at ../../dist/include/mozilla/ipc/RPCChannel.h:485
#20 0x4bb84eac in MessageLoop::RunTask (this=0x49effdf0, task=0x49f91820)
    at /hack/mozilla-central/ipc/chromium/src/base/message_loop.cc:318
#21 0x4bb84f02 in MessageLoop::DeferOrRunPendingTask (this=0x49effdf0, pending_task=...)
    at /hack/mozilla-central/ipc/chromium/src/base/message_loop.cc:326
#22 0x4bb8526a in MessageLoop::DoWork (this=0x49effdf0) at /hack/mozilla-central/ipc/chromium/src/base/message_loop.cc:426
#23 0x4bb89172 in base::MessagePumpDefault::Run (this=0x49f91780, delegate=0x49effdf0)
    at /hack/mozilla-central/ipc/chromium/src/base/message_pump_default.cc:23
#24 0x4bb84ae8 in MessageLoop::RunInternal (this=0x49effdf0) at /hack/mozilla-central/ipc/chromium/src/base/message_loop.cc:208
#25 0x4bb84a82 in MessageLoop::RunHandler (this=0x49effdf0) at /hack/mozilla-central/ipc/chromium/src/base/message_loop.cc:201
#26 0x4bb84a2a in MessageLoop::Run (this=0x49effdf0) at /hack/mozilla-central/ipc/chromium/src/base/message_loop.cc:175
#27 0x4bb9df9e in base::Thread::ThreadMain (this=0x49cf9d00) at /hack/mozilla-central/ipc/chromium/src/base/thread.cc:156
#28 0x4bbbec9e in ThreadFunc (closure=0x49cf9d00) at /hack/mozilla-central/ipc/chromium/src/base/platform_thread_posix.cc:27
#29 0xafd118e8 in __thread_entry () from /hack/moz-gdb/lib/3834B8993E6B00EC/system/lib/libc.so
#30 0xafd114b4 in pthread_create () from /hack/moz-gdb/lib/3834B8993E6B00EC/system/lib/libc.so
#31 0x00000000 in ?? ()

Comment 1

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: get screen depth from the main thread, expose it to other threads via gfxAndroidPlatform

Comment 2

[Benoit Jacob [:bjacob] (mostly away)]

This fixes the crashes, as apparent from the stack, was that GetScreenDepth in the EGL provider was being called from non-main-thread during OMTC initialization.

Comment 3

[Benoit Jacob [:bjacob] (mostly away)]

http://hg.mozilla.org/integration/mozilla-inbound/rev/cdbc3312ae80

Comment 4

[Benoit Jacob [:bjacob] (mostly away)]

Comment on attachment 623305 [details] [diff] [review]
get screen depth from the main thread, expose it to other threads via gfxAndroidPlatform

[Approval Request Comment]
Bug caused by (feature/regressing bug #): unknown
User impact if declined: either crashes, or makes subsequent crashes harder to debug.
Testing completed (on m-c, etc.): m-i
Risk to taking this patch (and alternatives if risky): not risky
String or UUID changes made by this patch: none

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/cdbc3312ae80

Comment 6

[Lukas Blakk [:lsblakk] use ?needinfo]

Comment on attachment 623305 [details] [diff] [review]
get screen depth from the main thread, expose it to other threads via gfxAndroidPlatform

looks low risk, helps with crash debugging - taking for aurora

Comment 7

[Benoit Jacob [:bjacob] (mostly away)]

http://hg.mozilla.org/releases/mozilla-aurora/rev/e82cd30c4c96