1147777 - Make TextureClientX11 thread safe

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Andreas Pehrson [:pehrsons]]

From bug 1032848 comment 24, we can segfault or deadlock in case two TextureClientX11s are being composited at the same time on different threads.

A race observed is on linux with e10s enabled; one TextureClientX11 is composited through ImageClient and is used on the ImageBridgeChild thread. The other through CanvasClient on the main thread.

==========

Stack trace for a failure on ImageClient:
> #0  0x00007ffff13cfcc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
> #1  0x00007ffff13d30d8 in __GI_abort () at abort.c:89
> #2  0x00007ffff13c8b86 in __assert_fail_base (fmt=0x7ffff1519830 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x7fffecb00390 "!xcb_xlib_threads_sequence_lost", 
>     file=file@entry=0x7fffecb001db "../../src/xcb_io.c",
> line=line@entry=635, function=function@entry=0x7fffecb00657 "_XReply") at
> assert.c:92
> #3  0x00007ffff13c8c32 in __GI___assert_fail (assertion=0x7fffecb00390 "!xcb_xlib_threads_sequence_lost", file=0x7fffecb001db "../../src/xcb_io.c", line=635, function=0x7fffecb00657 "_XReply")
>     at assert.c:101
> #4  0x00007fffeca9184c in _XReply () from /usr/lib/x86_64-linux-gnu/libX11.so.6
> #5  0x00007fffeca8d0cd in XSync () from /usr/lib/x86_64-linux-gnu/libX11.so.6
> #6  0x00007ffff323c987 in mozilla::layers::TextureClientX11::AllocateForSurface (this=0x7fffd1cb9b80, aSize=..., aTextureFlags=<optimised out>)
>     at
> /home/pehrsons/mozilla-central/gfx/layers/basic/TextureClientX11.cpp:130
> #7  0x00007ffff327d67d in mozilla::layers::TextureClient::CreateForDrawing (aAllocator=0x7fffe40d02e8, aFormat=<optimised out>, aSize=..., aMoz2DBackend=mozilla::gfx::CAIRO, 
>     aMoz2DBackend@entry=mozilla::gfx::NONE,
> aTextureFlags=mozilla::layers::NO_FLAGS,
> aAllocFlags=mozilla::layers::ALLOC_DEFAULT) at
> /home/pehrsons/mozilla-central/gfx/layers/client/TextureClient.cpp:387
> #8  0x00007ffff327d76b in mozilla::layers::CompositableClient::CreateTextureClientForDrawing (this=this@entry=0x7fffdbccfc90, aFormat=<optimised out>, aSize=..., aSize@entry=..., 
>     aMoz2DBackend=aMoz2DBackend@entry=mozilla::gfx::NONE,
> aTextureFlags=aTextureFlags@entry=mozilla::layers::NO_FLAGS,
> aAllocFlags=mozilla::layers::ALLOC_DEFAULT)
>     at
> /home/pehrsons/mozilla-central/gfx/layers/client/CompositableClient.cpp:214
> #9  0x00007ffff322fa8c in mozilla::layers::CairoImage::GetTextureClient (this=0x7fffdbcf6520, aClient=0x7fffdbccfc90) at /home/pehrsons/mozilla-central/gfx/layers/ImageContainer.cpp:532
> #10 0x00007ffff327e3ba in mozilla::layers::ImageClientSingle::UpdateImage (this=0x7fffdbccfc90, aContainer=0x7fffcfaa2180, aContentFlags=<optimised out>)
>     at /home/pehrsons/mozilla-central/gfx/layers/client/ImageClient.cpp:199
> #11 0x00007ffff32a0695 in mozilla::layers::UpdateImageClientNow (aClient=0x7fffdbccfc90, aContainer=0x7fffcfaa2180) at /home/pehrsons/mozilla-central/gfx/layers/ipc/ImageBridgeChild.cpp:421
> #12 0x00007ffff2cd846e in MessageLoop::RunTask (this=0x7fffe22fca40, task=0x7fffd9f96940) at /home/pehrsons/mozilla-central/ipc/chromium/src/base/message_loop.cc:361


Stack trace for a failure on CanvasClient:
> #0  0x00007ffff148612d in poll () at ../sysdeps/unix/syscall-template.S:81
> #1  0x00007fffe9d96b72 in ?? () from /usr/lib/x86_64-linux-gnu/libxcb.so.1
> #2  0x00007fffe9d983ff in ?? () from /usr/lib/x86_64-linux-gnu/libxcb.so.1
> #3  0x00007fffe9d98512 in xcb_wait_for_reply () from /usr/lib/x86_64-linux-gnu/libxcb.so.1
> #4  0x00007fffeca9148f in _XReply () from /usr/lib/x86_64-linux-gnu/libX11.so.6
> #5  0x00007fffeca778dd in XGetImage () from /usr/lib/x86_64-linux-gnu/libX11.so.6
> #6  0x00007ffff4ad5f8e in _get_image_surface (surface=0x7fffd1ce6000, interest_rect=interest_rect@entry=0x0, image_out=image_out@entry=0x7fffffffa578, image_rect=image_rect@entry=0x0)
>     at
> /home/pehrsons/mozilla-central/gfx/cairo/cairo/src/cairo-xlib-surface.c:855
> #7  0x00007ffff4ad681d in _cairo_xlib_surface_acquire_source_image (abstract_surface=<optimised out>, image_out=0x7fffffffa690, image_extra=0x7fffffffa6c0)
>     at
> /home/pehrsons/mozilla-central/gfx/cairo/cairo/src/cairo-xlib-surface.c:1390
> #8  0x00007ffff4b06285 in _cairo_surface_acquire_source_image (surface=0x7fffd1ce6000, image_out=image_out@entry=0x7fffffffa690, image_extra=image_extra@entry=0x7fffffffa6c0)
>     at
> /home/pehrsons/mozilla-central/gfx/cairo/cairo/src/cairo-surface.c:1452
> #9  0x00007ffff4aeb6bd in _pixman_image_for_surface (iy=0x7fffffffa784, ix=0x7fffffffa780, extents=<optimised out>, is_mask=0, pattern=0x7fffffffad88)
>     at
> /home/pehrsons/mozilla-central/gfx/cairo/cairo/src/cairo-image-surface.c:1502
> #10 _pixman_image_for_pattern (pattern=pattern@entry=0x7fffffffad88, is_mask=is_mask@entry=0, extents=extents@entry=0x7fffffffa850, tx=tx@entry=0x7fffffffa780, ty=ty@entry=0x7fffffffa784)
>     at
> /home/pehrsons/mozilla-central/gfx/cairo/cairo/src/cairo-image-surface.c:1680
> #11 0x00007ffff4aecee3 in _composite_boxes (extents=0x7fffffffa830, clip=0x0, antialias=CAIRO_ANTIALIAS_DEFAULT, boxes=0x7fffffffaa80, pattern=0x7fffffffad88, op=CAIRO_OPERATOR_SOURCE, 
>     dst=0x7fffdedd2960) at
> /home/pehrsons/mozilla-central/gfx/cairo/cairo/src/cairo-image-surface.c:3016
> #12 _clip_and_composite_boxes (dst=0x7fffdedd2960, op=CAIRO_OPERATOR_SOURCE, src=0x7fffffffad88, boxes=0x7fffffffaa80, antialias=CAIRO_ANTIALIAS_DEFAULT, extents=0x7fffffffa830, clip=0x0)
>     at
> /home/pehrsons/mozilla-central/gfx/cairo/cairo/src/cairo-image-surface.c:3077
> #13 0x00007ffff4aee81b in _cairo_image_surface_paint (abstract_surface=0x7fffdedd2960, op=CAIRO_OPERATOR_SOURCE, source=0x7fffffffad88, clip=0x0)
>     at
> /home/pehrsons/mozilla-central/gfx/cairo/cairo/src/cairo-image-surface.c:3325
> #14 0x00007ffff4b0b84c in _cairo_surface_paint (surface=0x7fffdedd2960, op=CAIRO_OPERATOR_SOURCE, source=0x7fffffffad88, clip=0x0)
>     at
> /home/pehrsons/mozilla-central/gfx/cairo/cairo/src/cairo-surface.c:2109
> #15 0x00007ffff4aee1e2 in _cairo_gstate_fill (gstate=0x7fffd4bbd9c8, path=path@entry=0x7fffd4bbdb68) at /home/pehrsons/mozilla-central/gfx/cairo/cairo/src/cairo-gstate.c:1285
> #16 0x00007ffff4b0f973 in INT__moz_cairo_fill_preserve (cr=cr@entry=0x7fffd4bbd800) at /home/pehrsons/mozilla-central/gfx/cairo/cairo/src/cairo.c:2464
> #17 0x00007ffff4b0f996 in _moz_cairo_fill (cr=0x7fffd4bbd800) at /home/pehrsons/mozilla-central/gfx/cairo/cairo/src/cairo.c:2440
> #18 0x00007ffff31cc701 in mozilla::gfx::DrawTargetCairo::CopySurfaceInternal (this=0x7fffd0f1e680, aSurface=0x7fffd1ce6000, aSource=..., aDest=...)
>     at /home/pehrsons/mozilla-central/gfx/2d/DrawTargetCairo.cpp:993
> #19 0x00007ffff31d3996 in mozilla::gfx::DrawTargetCairo::CopySurface (this=0x7fffd0f1e680, aSurface=<optimised out>, aSource=..., aDest=...)
>     at /home/pehrsons/mozilla-central/gfx/2d/DrawTargetCairo.cpp:1015
> #20 0x00007ffff32430b6 in mozilla::layers::CopyableCanvasLayer::UpdateTarget (this=this@entry=0x7fffe1197400, aDestTarget=0x7fffd0f1e680)
>     at /home/pehrsons/mozilla-central/gfx/layers/CopyableCanvasLayer.cpp:94
> #21 0x00007ffff326c882 in mozilla::layers::CanvasClient2D::Update (this=0x7fffdc72edc0, aSize=..., aLayer=0x7fffe1197400) at /home/pehrsons/mozilla-central/gfx/layers/client/CanvasClient.cpp:102
> #22 0x00007ffff326b6df in mozilla::layers::ClientCanvasLayer::RenderLayer (this=0x7fffe1197400) at /home/pehrsons/mozilla-central/gfx/layers/client/ClientCanvasLayer.cpp:182
> #23 0x00007ffff327343e in mozilla::layers::ClientContainerLayer::RenderLayer (this=0x7fffd0f48c00) at /home/pehrsons/mozilla-central/gfx/layers/client/ClientContainerLayer.h:68
> #24 0x00007ffff327343e in mozilla::layers::ClientContainerLayer::RenderLayer (this=0x7fffd10a1400) at /home/pehrsons/mozilla-central/gfx/layers/client/ClientContainerLayer.h:68
> #25 0x00007ffff3267da1 in mozilla::layers::ClientLayerManager::EndTransactionInternal (this=this@entry=0x7fffe3e53e00, aCallback=aCallback@entry=
>     0x7ffff43250e8
> <mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*,
> gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip,
> nsIntRegion const&, void*)>, 
>     aCallbackData=aCallbackData@entry=0x7fffffffbb30) at
> /home/pehrsons/mozilla-central/gfx/layers/client/ClientLayerManager.cpp:272
> #26 0x00007ffff326dd7f in mozilla::layers::ClientLayerManager::EndTransaction (this=0x7fffe3e53e00, 
>     aCallback=0x7ffff43250e8
> <mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*,
> gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip,
> nsIntRegion const&, void*)>, 
>     aCallbackData=0x7fffffffbb30,
> aFlags=mozilla::layers::LayerManager::END_DEFAULT) at
> /home/pehrsons/mozilla-central/gfx/layers/client/ClientLayerManager.cpp:315
> #27 0x00007ffff4361337 in nsDisplayList::PaintRoot (this=this@entry=0x7fffffffb960, aBuilder=aBuilder@entry=0x7fffffffbb30, aCtx=aCtx@entry=0x0, aFlags=aFlags@entry=13)
>     at /home/pehrsons/mozilla-central/layout/base/nsDisplayList.cpp:1763
> #28 0x00007ffff43a6e6f in nsLayoutUtils::PaintFrame (aRenderingContext=aRenderingContext@entry=0x0, aFrame=aFrame@entry=0x7fffe0ebf4a8, aDirtyRegion=..., aBackstop=aBackstop@entry=0, 
>     aFlags=<optimised out>) at
> /home/pehrsons/mozilla-central/layout/base/nsLayoutUtils.cpp:3284
> #29 0x00007ffff43a7955 in PresShell::Paint (this=0x7fffe0e62800, aViewToPaint=aViewToPaint@entry=0x7fffe0fc6510, aDirtyRegion=..., aFlags=aFlags@entry=1)
>     at /home/pehrsons/mozilla-central/layout/base/nsPresShell.cpp:6322
> #30 0x00007ffff413c5b6 in nsViewManager::ProcessPendingUpdatesPaint (this=0x7fffe0e8de00, aWidget=aWidget@entry=0x7fffe8d92e30) at /home/pehrsons/mozilla-central/view/nsViewManager.cpp:445
> #31 0x00007ffff413c761 in nsViewManager::ProcessPendingUpdatesForView (this=<optimised out>, aView=<optimised out>, aFlushDirtyRegion=aFlushDirtyRegion@entry=true)
>     at /home/pehrsons/mozilla-central/view/nsViewManager.cpp:385
> #32 0x00007ffff413c816 in nsViewManager::ProcessPendingUpdates (this=this@entry=0x7fffe0e8de00) at /home/pehrsons/mozilla-central/view/nsViewManager.cpp:1076
> #33 0x00007ffff430618f in nsRefreshDriver::Tick (this=0x7fffe0e61800, aNowEpoch=aNowEpoch@entry=1427270525402089, aNowTime=...) at /home/pehrsons/mozilla-central/layout/base/nsRefreshDriver.cpp:1715
> #34 0x00007ffff43087ec in mozilla::RefreshDriverTimer::TickDriver (driver=<optimised out>, jsnow=jsnow@entry=1427270525402089, now=..., now@entry=...)
>     at /home/pehrsons/mozilla-central/layout/base/nsRefreshDriver.cpp:198
> #35 0x00007ffff43088a4 in mozilla::RefreshDriverTimer::Tick (this=this@entry=0x7fffe3e472c0, jsnow=jsnow@entry=1427270525402089, now=...)

Comment 1

[Karl Tomlinson (:karlt)]

I don't see any XInitThreads() call for the child process.

https://bugzilla.mozilla.org/show_bug.cgi?id=1032848#c24 says the stacks are for the child process.

Comment 2

[Nicolas Silva [:nical]]

Attachment: XInitThread in child processes

(In reply to Karl Tomlinson (:karlt) from comment #1)
> I don't see any XInitThreads() call for the child process.
> 
> https://bugzilla.mozilla.org/show_bug.cgi?id=1032848#c24 says the stacks are
> for the child process.

Ah indeed!
This should do.

Comment 3

[Nicolas Silva [:nical]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2c717162f3f8

Comment 4

[Nicolas Silva [:nical]]

https://hg.mozilla.org/mozilla-central/rev/2c717162f3f8

(I put the wrong bug number in the commit message)