1029719 - TextureClient destruction happens on incorrect thread

Status: VERIFIED FIXED

(Core :: Graphics: Layers, defect)

Description

[Sotaro Ikeda [:sotaro]]

By Bug 1006957 fix, a TextureClient that is allocated under main-thread's layer becomes freed on ImageBridge thread. This causes crash.

A TextureClient that is allocated under ImageBridge thread already faces similar situation and correctly handle this case.

But the TextureClient that is allocated under main-thread's layer does not handle the situation correctly. TextureClient's destruction happens on ImageBridge thread. The destruction should happen on main-thread. It causes the crash.

Comment 1

[Sotaro Ikeda [:sotaro]]

On master nexus-5, it is easier to reproduce. Bug 1027088 fix is necessary to cause the crash in the following STR.

STR
[1] open browser app
[2] move to a scrollable web page(APZ enabled page).
[3] Do scroll, pan and zoom until the crash happens.

Comment 2

[Sotaro Ikeda [:sotaro]]

Attachment: calls stack of the crash

Comment 3

[Sotaro Ikeda [:sotaro]]

Nominate to b2g-v1.4+. It blocks bug 1006957. The STR to cause crash in b2g v1.4 is not clear yet. But the problem exists also on b2g v1.4.

The crash happens more often happens after Bug 1027088 is fixed.

Comment 4

[Sotaro Ikeda [:sotaro]]

In main thread's TextureClient case, we can not do same thing like ImageBridgeChild::RemoveTexture(). ImageBridge should not be blocked and it could cause the deadlock.

 http://dxr.mozilla.org/mozilla-central/source/gfx/layers/ipc/ImageBridgeChild.cpp#921

Comment 5

[Sotaro Ikeda [:sotaro]]

Attachment: patch - Release TextureClient on correct thread

The patch fixes the crash on master nexus-5.

Comment 6

[Sotaro Ikeda [:sotaro]]

https://tbpl.mozilla.org/?tree=Try&rev=d27f13d12638

Comment 7

[Preeti Raghunath(:Preeti)]

QA,

Please verify on Master. Would like to take in 1.4 based on results on Master.

Comment 8

[Sotaro Ikeda [:sotaro]]

(In reply to Sotaro Ikeda [:sotaro] from comment #1)
> On master nexus-5, it is easier to reproduce. Bug 1027088 fix is necessary
> to cause the crash in the following STR.
> 
> STR
> [1] open browser app
> [2] move to a scrollable web page(APZ enabled page).
> [3] Do scroll, pan and zoom until the crash happens.

Nexus-5's display is larger than other b2g devices. It uses a lot of tiles at scrollable layers than b2g devices. It seems a reason why the problem could easily happen on nexus-5.

Comment 9

[Sotaro Ikeda [:sotaro]]

Attachment: patch v2 - Release TextureClient on correct thread

Some clean ups.

Comment 10

[Sotaro Ikeda [:sotaro]]

https://tbpl.mozilla.org/?tree=Try&rev=0d68a3fd1ecf

Comment 11

[Sotaro Ikeda [:sotaro]]

 https://hg.mozilla.org/integration/mozilla-inbound/rev/284f9c4ac272

Comment 12

[Preeti Raghunath(:Preeti)]

William

Please test this patch on master and post results.

I'd like to take this in 1.4 if results on master look clean.

Comment 13

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/284f9c4ac272

Comment 14

[Sotaro Ikeda [:sotaro]]

Attachment: patch v2 for b2g v1.4 - Release TextureClient on correct thread

A patch for b2g v1.4.

Comment 15

[Ivan Tsay (:ITsay)]

Let's wait for the test per comment 12.

Comment 16

[William Hsu [:whsu]]

I encountered a crash while I tested this patch.
Please help clarify this crash to see if it relates to this patch.
Thanks!

https://crash-stats.mozilla.com/report/index/17ffc1ee-e1e9-47bc-bd7f-afef62140630
Browser hang there and cannot scroll, pan or zoom.
- WP_20140630_014.mp4

* Build information:
 - Gaia      de14e61098b742251b34f856e48649db8bed552c
 - Gecko     https://hg.mozilla.org/mozilla-central/rev/b6408c32a170
 - BuildID   20140630040201
 - Version   33.0a1

Comment 17

[William Hsu [:whsu]]

Attachment: WP_20140630_014.mp4

Comment 18

[Sotaro Ikeda [:sotaro]]

(In reply to William Hsu [:whsu] from comment #16)
> I encountered a crash while I tested this patch.
> Please help clarify this crash to see if it relates to this patch.
> Thanks!
> 
> https://crash-stats.mozilla.com/report/index/17ffc1ee-e1e9-47bc-bd7f-
> afef62140630
> Browser hang there and cannot scroll, pan or zoom.
> - WP_20140630_014.mp4

It is a different crash. It seems Bug 1031527 .

Comment 19

[Sotaro Ikeda [:sotaro]]

(In reply to William Hsu [:whsu] from comment #16)
> I encountered a crash while I tested this patch.
> Please help clarify this crash to see if it relates to this patch.
> Thanks!
> 
> https://crash-stats.mozilla.com/report/index/17ffc1ee-e1e9-47bc-bd7f-
> afef62140630
> Browser hang there and cannot scroll, pan or zoom.
> - WP_20140630_014.mp4
> 
> * Build information:
>  - Gaia      de14e61098b742251b34f856e48649db8bed552c
>  - Gecko     https://hg.mozilla.org/mozilla-central/rev/b6408c32a170
>  - BuildID   20140630040201
>  - Version   33.0a1

wshu, can you provide a url when the crash happen?  And this is a different problem, can you create a new bug for it?

Comment 20

[William Hsu [:whsu]]

> wshu, can you provide a url when the crash happen?  And this is a different
> problem, can you create a new bug for it?

Hi, Sotaro,

Which URL do you need?
Website I visited?
If so, here is the hyperlinks.
- http://www.sina.com.cn/
- http://www.msn.com

As you mentioned, this is a different problem.
Could I know if it relates to this patch?
Thanks.

Comment 21

[William Hsu [:whsu]]

> wshu, can you provide a url when the crash happen?  And this is a different
> problem, can you create a new bug for it?

Bug 1032642 is submitted.

Comment 22

[Sotaro Ikeda [:sotaro]]

(In reply to William Hsu [:whsu] from comment #20)
> > wshu, can you provide a url when the crash happen?  And this is a different
> > problem, can you create a new bug for it?
> 
> Hi, Sotaro,
> 
> Which URL do you need?
> Website I visited?
> If so, here is the hyperlinks.
> - http://www.sina.com.cn/
> - http://www.msn.com
> 
> As you mentioned, this is a different problem.
> Could I know if it relates to this patch?
> Thanks.

Thanks for the link. The crash is not related to this bug as I already commented at Comment 18.

Comment 23

[William Hsu [:whsu]]

(In reply to Sotaro Ikeda [:sotaro] from comment #22)
> (In reply to William Hsu [:whsu] from comment #20)
> > > wshu, can you provide a url when the crash happen?  And this is a different
> > > problem, can you create a new bug for it?
> > 
> > Hi, Sotaro,
> > 
> > Which URL do you need?
> > Website I visited?
> > If so, here is the hyperlinks.
> > - http://www.sina.com.cn/
> > - http://www.msn.com
> > 
> > As you mentioned, this is a different problem.
> > Could I know if it relates to this patch?
> > Thanks.
> 
> Thanks for the link. The crash is not related to this bug as I already
> commented at Comment 18.

If so, I don't have any concern regarding this patch.
I suggest to uplift it.

I will also re-confirm this patch on Dolphin device after the patch lands on v1.4.
Thanks! Have a nice day!

Comment 24

[Ivan Tsay (:ITsay)]

Plus this for v1.4 to fix the possible crash issue.

Comment 25

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/7be237616cbe
https://hg.mozilla.org/releases/mozilla-b2g30_v1_4/rev/9357149d7a91

Comment 26

[William Hsu [:whsu]]

Thanks Sotaro!
Also, verified this patch on PVT build.
No regression and side effect is found.

* Build information:
 - Gaia      b7d36622c7df92c976c37520ccab25199c7ada91
 - Gecko     https://hg.mozilla.org/releases/mozilla-b2g30_v1_4/rev/de7ecfb00955
 - BuildID   20140715000202
 - Version   30.0

Comment 27

[sarsenyev]

Verified the issue is fixed on 2.2, 2.1 and 2.0

Crash doesn't appear on the page when scrolling, panning and zooming


"Flame 2.1 

Device: Flame 2.1 (319mb)(Kitkat Base)(Shallow Flash)
BuildID: 20141126001202
Gaia: db2e84860f5a7cc334464618c6ea9e92ff82e9dd
Gecko: 211eae88f119
Version: 34.0 (2.1) 
Firmware Version: v188-1
User Agent: Mozilla/5.0 (Mobile; rv:34.0) Gecko/34.0 Firefox/34.0"

"Flame 2.0

Device: Flame 2.0 (319mb)(Kitkat Base)(Shallow Flash)
Build ID: 20141126000203
Gaia: f9d6e3d83c3922e9399a6c27f5ce4cdd27bdfd05
Gecko: 45112935086f
Version: 32.0 (2.0)
Firmware Version: v188-1
User Agent: Mozilla/5.0 (Mobile; rv:32.0) Gecko/32.0 Firefox/32.0"

Comment 28

[sarsenyev]

Verified the issue is fixed on 1.4 Flame

Crash doesn't occur when scrolling, zooming in/out a webpage

Device: Flame 1.4
BuildID: 20141201000201
Gaia: 22c80a708329321a2fdeed4ece019498c0cec90d
Gecko: 429d90dd383c
Version: 30.0 (1.4)
Firmware: V123
User Agent: Mozilla/5.0 (Mobile; rv:30.0) Gecko/30.0 Firefox/30.0