Closed Bug 1029719 Opened 5 years ago Closed 5 years ago

TextureClient destruction happens on incorrect thread

Categories

(Core :: Graphics: Layers, defect)

ARM
Gonk (Firefox OS)
defect
Not set

Tracking

()

VERIFIED FIXED
mozilla33
blocking-b2g 1.4+
Tracking Status
firefox31 --- wontfix
firefox32 --- fixed
firefox33 --- fixed
b2g-v1.4 --- verified
b2g-v2.0 --- verified
b2g-v2.1 --- verified

People

(Reporter: sotaro, Assigned: sotaro)

References

Details

(Keywords: regression)

Attachments

(4 files, 1 obsolete file)

By Bug 1006957 fix, a TextureClient that is allocated under main-thread's layer becomes freed on ImageBridge thread. This causes crash.

A TextureClient that is allocated under ImageBridge thread already faces similar situation and correctly handle this case.

But the TextureClient that is allocated under main-thread's layer does not handle the situation correctly. TextureClient's destruction happens on ImageBridge thread. The destruction should happen on main-thread. It causes the crash.
Assignee: nobody → sotaro.ikeda.g
On master nexus-5, it is easier to reproduce. Bug 1027088 fix is necessary to cause the crash in the following STR.

STR
[1] open browser app
[2] move to a scrollable web page(APZ enabled page).
[3] Do scroll, pan and zoom until the crash happens.
Nominate to b2g-v1.4+. It blocks bug 1006957. The STR to cause crash in b2g v1.4 is not clear yet. But the problem exists also on b2g v1.4.

The crash happens more often happens after Bug 1027088 is fixed.
blocking-b2g: --- → 1.4?
In main thread's TextureClient case, we can not do same thing like ImageBridgeChild::RemoveTexture(). ImageBridge should not be blocked and it could cause the deadlock.

 http://dxr.mozilla.org/mozilla-central/source/gfx/layers/ipc/ImageBridgeChild.cpp#921
The patch fixes the crash on master nexus-5.
QA,

Please verify on Master. Would like to take in 1.4 based on results on Master.
Keywords: verifyme
(In reply to Sotaro Ikeda [:sotaro] from comment #1)
> On master nexus-5, it is easier to reproduce. Bug 1027088 fix is necessary
> to cause the crash in the following STR.
> 
> STR
> [1] open browser app
> [2] move to a scrollable web page(APZ enabled page).
> [3] Do scroll, pan and zoom until the crash happens.

Nexus-5's display is larger than other b2g devices. It uses a lot of tiles at scrollable layers than b2g devices. It seems a reason why the problem could easily happen on nexus-5.
Some clean ups.
Attachment #8445459 - Attachment is obsolete: true
Attachment #8446745 - Flags: review?(jmuizelaar)
Status: NEW → ASSIGNED
Attachment #8446745 - Flags: review?(jmuizelaar) → review+
William

Please test this patch on master and post results.

I'd like to take this in 1.4 if results on master look clean.
Flags: needinfo?(whsu)
https://hg.mozilla.org/mozilla-central/rev/284f9c4ac272
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla33
Let's wait for the test per comment 12.
I encountered a crash while I tested this patch.
Please help clarify this crash to see if it relates to this patch.
Thanks!

https://crash-stats.mozilla.com/report/index/17ffc1ee-e1e9-47bc-bd7f-afef62140630
Browser hang there and cannot scroll, pan or zoom.
- WP_20140630_014.mp4

* Build information:
 - Gaia      de14e61098b742251b34f856e48649db8bed552c
 - Gecko     https://hg.mozilla.org/mozilla-central/rev/b6408c32a170
 - BuildID   20140630040201
 - Version   33.0a1
Flags: needinfo?(whsu)
Attached video WP_20140630_014.mp4
(In reply to William Hsu [:whsu] from comment #16)
> I encountered a crash while I tested this patch.
> Please help clarify this crash to see if it relates to this patch.
> Thanks!
> 
> https://crash-stats.mozilla.com/report/index/17ffc1ee-e1e9-47bc-bd7f-
> afef62140630
> Browser hang there and cannot scroll, pan or zoom.
> - WP_20140630_014.mp4

It is a different crash. It seems Bug 1031527 .
(In reply to William Hsu [:whsu] from comment #16)
> I encountered a crash while I tested this patch.
> Please help clarify this crash to see if it relates to this patch.
> Thanks!
> 
> https://crash-stats.mozilla.com/report/index/17ffc1ee-e1e9-47bc-bd7f-
> afef62140630
> Browser hang there and cannot scroll, pan or zoom.
> - WP_20140630_014.mp4
> 
> * Build information:
>  - Gaia      de14e61098b742251b34f856e48649db8bed552c
>  - Gecko     https://hg.mozilla.org/mozilla-central/rev/b6408c32a170
>  - BuildID   20140630040201
>  - Version   33.0a1

wshu, can you provide a url when the crash happen?  And this is a different problem, can you create a new bug for it?
Flags: needinfo?(whsu)
> wshu, can you provide a url when the crash happen?  And this is a different
> problem, can you create a new bug for it?

Hi, Sotaro,

Which URL do you need?
Website I visited?
If so, here is the hyperlinks.
- http://www.sina.com.cn/
- http://www.msn.com

As you mentioned, this is a different problem.
Could I know if it relates to this patch?
Thanks.
Flags: needinfo?(whsu) → needinfo?(sotaro.ikeda.g)
> wshu, can you provide a url when the crash happen?  And this is a different
> problem, can you create a new bug for it?

Bug 1032642 is submitted.
(In reply to William Hsu [:whsu] from comment #20)
> > wshu, can you provide a url when the crash happen?  And this is a different
> > problem, can you create a new bug for it?
> 
> Hi, Sotaro,
> 
> Which URL do you need?
> Website I visited?
> If so, here is the hyperlinks.
> - http://www.sina.com.cn/
> - http://www.msn.com
> 
> As you mentioned, this is a different problem.
> Could I know if it relates to this patch?
> Thanks.

Thanks for the link. The crash is not related to this bug as I already commented at Comment 18.
Flags: needinfo?(sotaro.ikeda.g)
(In reply to Sotaro Ikeda [:sotaro] from comment #22)
> (In reply to William Hsu [:whsu] from comment #20)
> > > wshu, can you provide a url when the crash happen?  And this is a different
> > > problem, can you create a new bug for it?
> > 
> > Hi, Sotaro,
> > 
> > Which URL do you need?
> > Website I visited?
> > If so, here is the hyperlinks.
> > - http://www.sina.com.cn/
> > - http://www.msn.com
> > 
> > As you mentioned, this is a different problem.
> > Could I know if it relates to this patch?
> > Thanks.
> 
> Thanks for the link. The crash is not related to this bug as I already
> commented at Comment 18.

If so, I don't have any concern regarding this patch.
I suggest to uplift it.

I will also re-confirm this patch on Dolphin device after the patch lands on v1.4.
Thanks! Have a nice day!
Plus this for v1.4 to fix the possible crash issue.
blocking-b2g: 1.4? → 1.4+
Thanks Sotaro!
Also, verified this patch on PVT build.
No regression and side effect is found.

* Build information:
 - Gaia      b7d36622c7df92c976c37520ccab25199c7ada91
 - Gecko     https://hg.mozilla.org/releases/mozilla-b2g30_v1_4/rev/de7ecfb00955
 - BuildID   20140715000202
 - Version   30.0
Status: RESOLVED → VERIFIED
Verified the issue is fixed on 2.2, 2.1 and 2.0

Crash doesn't appear on the page when scrolling, panning and zooming


"Flame 2.1 

Device: Flame 2.1 (319mb)(Kitkat Base)(Shallow Flash)
BuildID: 20141126001202
Gaia: db2e84860f5a7cc334464618c6ea9e92ff82e9dd
Gecko: 211eae88f119
Version: 34.0 (2.1) 
Firmware Version: v188-1
User Agent: Mozilla/5.0 (Mobile; rv:34.0) Gecko/34.0 Firefox/34.0"

"Flame 2.0

Device: Flame 2.0 (319mb)(Kitkat Base)(Shallow Flash)
Build ID: 20141126000203
Gaia: f9d6e3d83c3922e9399a6c27f5ce4cdd27bdfd05
Gecko: 45112935086f
Version: 32.0 (2.0)
Firmware Version: v188-1
User Agent: Mozilla/5.0 (Mobile; rv:32.0) Gecko/32.0 Firefox/32.0"
QA Whiteboard: [QAnalyst-Triage?]
Flags: needinfo?(ktucker)
Verified the issue is fixed on 1.4 Flame

Crash doesn't occur when scrolling, zooming in/out a webpage

Device: Flame 1.4
BuildID: 20141201000201
Gaia: 22c80a708329321a2fdeed4ece019498c0cec90d
Gecko: 429d90dd383c
Version: 30.0 (1.4)
Firmware: V123
User Agent: Mozilla/5.0 (Mobile; rv:30.0) Gecko/30.0 Firefox/30.0
QA Whiteboard: [QAnalyst-Triage?] → [QAnalyst-Triage+]
Flags: needinfo?(ktucker)
You need to log in before you can comment on or make changes to this bug.