Intermittent test_getUserMedia_basicScreenshare.html | application crashed [@ mozilla::layers::ImageClientSingle::UpdateImage(mozilla::layers::ImageContainer*, unsigned int)] after Assertion failure: texture == mBuffers[i].mTextureClient

RESOLVED FIXED in Firefox 46

Status

()

Core
Graphics: Layers
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: philor, Assigned: sotaro)

Tracking

({assertion, intermittent-failure})

45 Branch
mozilla47
assertion, intermittent-failure
Points:
---

Firefox Tracking Flags

(firefox45 wontfix, firefox46 fixed, firefox47 fixed, firefox-esr45 fixed)

Details

(Whiteboard: gfx-noted)

Attachments

(2 attachments, 1 obsolete attachment)

(Reporter)

Description

2 years ago
https://treeherder.mozilla.org/logviewer.html#?job_id=17279138&repo=mozilla-inbound
Whiteboard: gfx-noted
Created attachment 8689566 [details]
crash.txt

This one reproduces in fresh Nightly for me with https://jsfiddle.net/Lfru4g4n/

I hit all the different resolution buttons for a while until it happens (~5-10 clicks). Debug output attached.
Hit this assertion on test_peerConnection_removeVideoTrack.html too.

https://treeherder.mozilla.org/logviewer.html#?job_id=14181663&repo=try

I can't change this bug's summery because it's too long.

Comment 3

2 years ago
19 automation job failures were associated with this bug in the last 7 days.

Repository breakdown:
* mozilla-inbound: 16
* b2g-inbound: 2
* try: 1

Platform breakdown:
* windows8-64: 18
* linux64: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1224833&startday=2015-12-07&endday=2015-12-13&tree=all
(Assignee)

Updated

2 years ago
Assignee: nobody → sotaro.ikeda.g

Comment 4

2 years ago
6 automation job failures were associated with this bug in the last 7 days.

Repository breakdown:
* mozilla-inbound: 2
* fx-team: 2
* b2g-inbound: 2

Platform breakdown:
* windows8-64: 4
* osx-10-6: 1
* linux32: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1224833&startday=2016-01-11&endday=2016-01-17&tree=all

Comment 5

2 years ago
8 automation job failures were associated with this bug in the last 7 days.

Repository breakdown:
* mozilla-inbound: 5
* fx-team: 2
* try: 1

Platform breakdown:
* windows8-64: 4
* linux64: 3
* windows7-32: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1224833&startday=2016-01-18&endday=2016-01-24&tree=all

Comment 6

2 years ago
5 automation job failures were associated with this bug in the last 7 days.

Repository breakdown:
* fx-team: 4
* mozilla-inbound: 1

Platform breakdown:
* windows8-64: 4
* linux64: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1224833&startday=2016-01-25&endday=2016-01-31&tree=all
(Assignee)

Comment 7

2 years ago
The cause of the problem seems to become clear. In ImageClientSingle::UpdateImage(), if the function tries to forward multiple RecyclingPlanarYCbCrImages, the situation could happen. RecyclingPlanarYCbCrImages does not have TextureClient, multiple TextureClients could be created for one RecyclingPlanarYCbCrImages. Then the TextureClients are stored in ImageClientSingle::mBuffers.
(Assignee)

Comment 8

2 years ago
Created attachment 8715277 [details] [diff] [review]
patch - Use image->GetTextureClient(this)
(Assignee)

Comment 9

2 years ago
(In reply to Sotaro Ikeda [:sotaro] from comment #7)
> The cause of the problem seems to become clear. In
> ImageClientSingle::UpdateImage(), if the function tries to forward multiple
> RecyclingPlanarYCbCrImages, the situation could happen.
> RecyclingPlanarYCbCrImages does not have TextureClient, multiple
> TextureClients could be created for one RecyclingPlanarYCbCrImages. Then the
> TextureClients are stored in ImageClientSingle::mBuffers.

The above was confirmed based on the link of comment 1.
(Assignee)

Updated

2 years ago
Attachment #8715277 - Flags: review?(nical.bugzilla)
Comment on attachment 8715277 [details] [diff] [review]
patch - Use image->GetTextureClient(this)

Review of attachment 8715277 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/layers/client/ImageClient.cpp
@@ +181,5 @@
>  
>      for (int32_t i = mBuffers.Length() - 1; i >= 0; --i) {
>        if (mBuffers[i].mImageSerial == image->GetSerial()) {
> +        if (image->GetTextureClient(this)) {
> +          MOZ_ASSERT(image->GetTextureClient(this) == mBuffers[i].mTextureClient);

I would much prefer that you create a constant boolean outside of the loop that is true if texture is non-null, and check that boolean in the loop rather than calling into GetTextureClient each time. At least we'll quickly see that checking the boolean doesn't have side effects (to make sure of that with GetTextureClient, we have to read every implementation of the method and hope that no side effects will appear in the future is an implementation is added or modified).
Attachment #8715277 - Flags: review?(nical.bugzilla) → review+
(Assignee)

Comment 11

2 years ago
Created attachment 8715615 [details] [diff] [review]
patch - Check explicitly if image has TextureClient

Apply the comment. Carry "r=nical".
Attachment #8715277 - Attachment is obsolete: true
(Assignee)

Updated

2 years ago
Attachment #8715615 - Flags: review+

Comment 12

2 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/b0c2f52f52f1

Comment 13

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/b0c2f52f52f1
Status: NEW → RESOLVED
Last Resolved: 2 years ago
status-firefox47: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla47

Comment 14

2 years ago
5 automation job failures were associated with this bug in the last 7 days.

Repository breakdown:
* mozilla-inbound: 3
* try: 1
* fx-team: 1

Platform breakdown:
* windows8-64: 4
* osx-10-6: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1224833&startday=2016-02-01&endday=2016-02-07&tree=all
Changes a debug-only check, so uplifting this a=NPOTB.

https://hg.mozilla.org/releases/mozilla-aurora/rev/b36320f44174
status-firefox45: affected → wontfix
status-firefox46: --- → fixed
status-firefox-esr45: --- → affected
Whiteboard: gfx-noted → gfx-noted [checkin-needed-esr45]
https://hg.mozilla.org/releases/mozilla-esr45/rev/12ef98ae2f51
status-firefox-esr45: affected → fixed
Whiteboard: gfx-noted [checkin-needed-esr45] → gfx-noted
You need to log in before you can comment on or make changes to this bug.