Closed Bug 1260559 Opened 8 years ago Closed 8 years ago

A google maps map keep crashing with hardware acceleration

Categories

(Core :: Graphics: Layers, defect)

Product:
Core
Component:
Graphics: Layers
Version:
48 Branch
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: anakin.cs, Assigned: acomminos)

References

Details

(Whiteboard: gfx-noted) 

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:47.0) Gecko/20100101 Firefox/47.0
Build ID: 20160329004124

Steps to reproduce:

I am on the latest nightly build (v48 - 20160329) from mozilla and the same thing happen for a ArchLinux Developer Edition build (v47 - 20160329).

E10S is disabled and layers.acceleration.force-enabled is set to true.


Actual results:

I visit this google maps link, and firefox crash while loading the page:
https://goo.gl/WjDwvU

This is what shows up in a terminal:
[3556] ###!!! ABORT: X_ShmAttach: BadAccess (attempt to access private resource denied); 15 requests ago: file /builds/slave/m-cen-l64-ntly-000000000000000/build/src/toolkit/xre/nsX11ErrorHandler.cpp, line 157
[3556] ###!!! ABORT: X_ShmAttach: BadAccess (attempt to access private resource denied); 15 requests ago: file /builds/slave/m-cen-l64-ntly-000000000000000/build/src/toolkit/xre/nsX11ErrorHandler.cpp, line 157
Depends on: ogl-linux-beta
OS: Unspecified → Linux
Hardware: Unspecified → x86_64
Info from about:support:

Adapter Description	Intel Open Source Technology Center -- Mesa DRI Intel(R) Haswell Mobile
Asynchronous Pan/Zoom	none
Device ID	Mesa DRI Intel(R) Haswell Mobile
Driver Version	3.0 Mesa 11.1.2
GPU Accelerated Windows	1/1 OpenGL (OMTC)
Supports Hardware H264 Decoding	No
Vendor ID	Intel Open Source Technology Center
WebGL Renderer	Intel Open Source Technology Center -- Mesa DRI Intel(R) Haswell Mobile
windowLayerManagerRemote	true
AzureCanvasAccelerated	0
AzureCanvasBackend	skia
AzureContentBackend	cairo
AzureFallbackCanvasBackend	none
CairoUseXRender	0
Linux, sounds like shmem errors.
This might end up being WebGL compositing code that's the problem, but GFX::Layers is fine for now.

When might "X_ShmAttach: BadAccess" happen?
Flags: needinfo?(lsalzman)
Whiteboard: gfx-noted
(In reply to Jeff Gilbert [:jgilbert] from comment #2)
> Linux, sounds like shmem errors.
> This might end up being WebGL compositing code that's the problem, but
> GFX::Layers is fine for now.
> 
> When might "X_ShmAttach: BadAccess" happen?

I can't manage to reproduce this one at all at least locally.

I can only speculate that the usage of ScopedXErrorHandler inside the GLX provider code, being called off the main thread, is having some fun interaction with the nsShmImage widget code that sets its own temporary X11 handler which is what is trapping the call to XShmAttach normally. That's only a guess, since there's not enough to go on here so far.

AnAkkk, can you possibly get a more detailed crashed stack, from a debug build if necessary? That would help us see where this crash is occurring and why in more detail.
Flags: needinfo?(lsalzman) → needinfo?(anakin.cs)
Do I have to build firefox myself or are there any debug builds available for download?
Flags: needinfo?(anakin.cs)
(In reply to AnAkkk from comment #4)
> Do I have to build firefox myself or are there any debug builds available
> for download?

You could try the mozilla-central build here: http://archive.mozilla.org/pub/firefox/tinderbox-builds/mozilla-central-linux64-debug/1460541294/
Here is the crash stack with the nightly you linked to me:

#01: ???[/home/user/Documents/firefox/libxul.so +0x3baffc1]
#02: ???[/usr/lib/libpthread.so.0 +0x10e80]
#03: mozalloc_abort(char const*)[firefox-bin +0x63d0]
#04: NS_DebugBreak[/home/user/Documents/firefox/libxul.so +0xb31c74]
#05: ???[/home/user/Documents/firefox/libxul.so +0x2e39a6a]
#06: ???[/home/user/Documents/firefox/libxul.so +0x2e3a43b]
#07: g_logv[/usr/lib/libglib-2.0.so.0 +0x50734]
#08: g_log[/usr/lib/libglib-2.0.so.0 +0x5095f]
#09: ???[/usr/lib/libgdk-3.so.0 +0x56ad8]
#10: ???[/usr/lib/libgdk-3.so.0 +0x62ca9]
#11: _XError[/usr/lib/libX11.so.6 +0x4487d]
#12: ???[/usr/lib/libX11.so.6 +0x417c7]
#13: ???[/usr/lib/libX11.so.6 +0x41885]
#14: _XReply[/usr/lib/libX11.so.6 +0x42830]
#15: XGetGeometry[/usr/lib/libX11.so.6 +0x271be]
#16: ???[/home/user/Documents/firefox/libxul.so +0x141a333]
#17: ???[/home/user/Documents/firefox/libxul.so +0x14f24de]
#18: ???[/home/user/Documents/firefox/libxul.so +0x14c3562]
#19: ???[/home/user/Documents/firefox/libxul.so +0x14c3cd9]
#20: ???[/home/user/Documents/firefox/libxul.so +0x14c3f2d]
#21: ???[/home/user/Documents/firefox/libxul.so +0x14e2dff]
#22: ???[/home/user/Documents/firefox/libxul.so +0x14e30e4]
#23: ???[/home/user/Documents/firefox/libxul.so +0xf0bbc2]
#24: ???[/home/user/Documents/firefox/libxul.so +0xf1229c]
#25: ???[/home/user/Documents/firefox/libxul.so +0xf123cb]
#26: ???[/home/user/Documents/firefox/libxul.so +0xf0dc1a]
#27: ???[/home/user/Documents/firefox/libxul.so +0xf0db33]
#28: ???[/home/user/Documents/firefox/libxul.so +0xf0db5a]
#29: ???[/home/user/Documents/firefox/libxul.so +0xf14c75]
#30: ???[/home/user/Documents/firefox/libxul.so +0xf126b3]
#31: ???[/usr/lib/libpthread.so.0 +0x7424]
#32: clone[/usr/lib/libc.so.6 +0xe7cbd]
#33: ??? (???:???)
(In reply to AnAkkk from comment #6)
> Here is the crash stack with the nightly you linked to me:
> 
> #01: ???[/home/user/Documents/firefox/libxul.so +0x3baffc1]
> #02: ???[/usr/lib/libpthread.so.0 +0x10e80]
> #03: mozalloc_abort(char const*)[firefox-bin +0x63d0]
> #04: NS_DebugBreak[/home/user/Documents/firefox/libxul.so +0xb31c74]
> #05: ???[/home/user/Documents/firefox/libxul.so +0x2e39a6a]
> #06: ???[/home/user/Documents/firefox/libxul.so +0x2e3a43b]
> #07: g_logv[/usr/lib/libglib-2.0.so.0 +0x50734]
> #08: g_log[/usr/lib/libglib-2.0.so.0 +0x5095f]
> #09: ???[/usr/lib/libgdk-3.so.0 +0x56ad8]
> #10: ???[/usr/lib/libgdk-3.so.0 +0x62ca9]
> #11: _XError[/usr/lib/libX11.so.6 +0x4487d]
> #12: ???[/usr/lib/libX11.so.6 +0x417c7]
> #13: ???[/usr/lib/libX11.so.6 +0x41885]
> #14: _XReply[/usr/lib/libX11.so.6 +0x42830]
> #15: XGetGeometry[/usr/lib/libX11.so.6 +0x271be]
> #16: ???[/home/user/Documents/firefox/libxul.so +0x141a333]
> #17: ???[/home/user/Documents/firefox/libxul.so +0x14f24de]
> #18: ???[/home/user/Documents/firefox/libxul.so +0x14c3562]
> #19: ???[/home/user/Documents/firefox/libxul.so +0x14c3cd9]
> #20: ???[/home/user/Documents/firefox/libxul.so +0x14c3f2d]
> #21: ???[/home/user/Documents/firefox/libxul.so +0x14e2dff]
> #22: ???[/home/user/Documents/firefox/libxul.so +0x14e30e4]
> #23: ???[/home/user/Documents/firefox/libxul.so +0xf0bbc2]
> #24: ???[/home/user/Documents/firefox/libxul.so +0xf1229c]
> #25: ???[/home/user/Documents/firefox/libxul.so +0xf123cb]
> #26: ???[/home/user/Documents/firefox/libxul.so +0xf0dc1a]
> #27: ???[/home/user/Documents/firefox/libxul.so +0xf0db33]
> #28: ???[/home/user/Documents/firefox/libxul.so +0xf0db5a]
> #29: ???[/home/user/Documents/firefox/libxul.so +0xf14c75]
> #30: ???[/home/user/Documents/firefox/libxul.so +0xf126b3]
> #31: ???[/usr/lib/libpthread.so.0 +0x7424]
> #32: clone[/usr/lib/libc.so.6 +0xe7cbd]
> #33: ??? (???:???)

Can you run inside GDB so we can get some symbol information from the libxul.so parts of the stack?
I am not sure how to load the debug symbols though. Do I need to download the separate crashreport-symbols.zip?
Ok, here is the backtrace with gdb:

#0  0x00007faeb492461d in nanosleep () from /usr/lib/libc.so.6
#1  0x00007faeb492456a in sleep () from /usr/lib/libc.so.6
#2  0x00007faea5cc659e in ah_crap_handler(int) ()
   from /home/user/Documents/firefox/libxul.so
#3  0x00007faea5cb8c0f in nsProfileLock::FatalSignalHandler(int, siginfo*, void*) () from /home/user/Documents/firefox/libxul.so
#4  0x00007faea6a3dfc1 in AsmJSFaultHandler(int, siginfo*, void*) ()
   from /home/user/Documents/firefox/libxul.so
#5  <signal handler called>
#6  0x00000000004063d0 in mozalloc_abort(char const*) ()
#7  0x00007faea39bfc74 in NS_DebugBreak ()
   from /home/user/Documents/firefox/libxul.so
#8  0x00007faea5cc7a6a in X11Error ()
   from /home/user/Documents/firefox/libxul.so
#9  0x00007faea5cc843b in GdkErrorHandler(char const*, GLogLevelFlags, char const*, void*) () from /home/user/Documents/firefox/libxul.so
#10 0x00007faeaf90b734 in g_logv () from /usr/lib/libglib-2.0.so.0
#11 0x00007faeaf90b95f in g_log () from /usr/lib/libglib-2.0.so.0
#12 0x00007faeb22aead8 in ?? () from /usr/lib/libgdk-3.so.0
#13 0x00007faeb22baca9 in ?? () from /usr/lib/libgdk-3.so.0
#14 0x00007faeb1b4987d in _XError () from /usr/lib/libX11.so.6
#15 0x00007faeb1b467c7 in ?? () from /usr/lib/libX11.so.6
#16 0x00007faeb1b46885 in ?? () from /usr/lib/libX11.so.6
---Type <return> to continue, or q <return> to quit---
#17 0x00007faeb1b47235 in _XEventsQueued () from /usr/lib/libX11.so.6
#18 0x00007faeb1b38b87 in XPending () from /usr/lib/libX11.so.6
#19 0x00007faea549fc2d in nsWindow::OnMotionNotifyEvent(_GdkEventMotion*) ()
   from /home/user/Documents/firefox/libxul.so
#20 0x00007faea549fe30 in motion_notify_event_cb(_GtkWidget*, _GdkEventMotion*) ()
   from /home/user/Documents/firefox/libxul.so
#21 0x00007faeb275114c in ?? () from /usr/lib/libgtk-3.so.0
#22 0x00007faeafbdafa5 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#23 0x00007faeafbecff1 in ?? () from /usr/lib/libgobject-2.0.so.0
#24 0x00007faeafbf5829 in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#25 0x00007faeafbf60bf in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#26 0x00007faeb2893ecc in ?? () from /usr/lib/libgtk-3.so.0
#27 0x00007faeb28b4183 in ?? () from /usr/lib/libgtk-3.so.0
#28 0x00007faeb2750360 in gtk_main_do_event () from /usr/lib/libgtk-3.so.0
#29 0x00007faeb2288625 in ?? () from /usr/lib/libgdk-3.so.0
#30 0x00007faeb22b5492 in ?? () from /usr/lib/libgdk-3.so.0
#31 0x00007faeaf904f07 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#32 0x00007faeaf905160 in ?? () from /usr/lib/libglib-2.0.so.0
#33 0x00007faeaf90520c in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#34 0x00007faea54a863b in nsAppShell::ProcessNextNativeEvent(bool) () from /home/user/Documents/firefox/libxul.so
#35 0x00007faea5487a37 in nsBaseAppShell::DoProcessNextNativeEvent(bool) ()
   from /home/user/Documents/firefox/libxul.so
#36 0x00007faea548a4ba in nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, bool) ()
   from /home/user/Documents/firefox/libxul.so
#37 0x00007faea3a2d113 in nsThread::ProcessNextEvent(bool, bool*) () from /home/user/Documents/firefox/libxul.so
#38 0x00007faea3a52fde in NS_ProcessNextEvent(nsIThread*, bool) () from /home/user/Documents/firefox/libxul.so
#39 0x00007faea3dbd340 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ()
   from /home/user/Documents/firefox/libxul.so
#40 0x00007faea3d9bb33 in MessageLoop::RunInternal() () from /home/user/Documents/firefox/libxul.so
#41 0x00007faea3d9bb5a in MessageLoop::Run() () from /home/user/Documents/firefox/libxul.so
#42 0x00007faea5485ec3 in nsBaseAppShell::Run() () from /home/user/Documents/firefox/libxul.so
#43 0x00007faea5c7631e in nsAppStartup::Run() () from /home/user/Documents/firefox/libxul.so
#44 0x00007faea5cc4857 in XREMain::XRE_mainRun() () from /home/user/Documents/firefox/libxul.so
#45 0x00007faea5cc4c7d in XREMain::XRE_main(int, char**, nsXREAppData const*) ()
   from /home/user/Documents/firefox/libxul.so
#46 0x00007faea5cc4ed9 in XRE_main () from /home/user/Documents/firefox/libxul.so
#47 0x0000000000406189 in do_main(int, char**, char**, nsIFile*) ()
#48 0x000000000040565c in main ()
This crashstack from GDB looks like it is occurring in a different place in the code than the earlier one you pasted (it passes through libgtk and friends more than the other ones). Can you see if you can get one more GDB backtrace that looks more like the other ones, but with the added GDB symbol information you got in this last one?
Tried once again, and got another different backtrace:

#0  0x00007f952beb461d in nanosleep () from /usr/lib/libc.so.6
#1  0x00007f952beb456a in sleep () from /usr/lib/libc.so.6
#2  0x00007f951d1c659e in ah_crap_handler(int) () from /home/user/Documents/firefox/libxul.so
#3  0x00007f951d1b8c0f in nsProfileLock::FatalSignalHandler(int, siginfo*, void*) () from /home/user/Documents/firefox/libxul.so
#4  0x00007f951df3dfc1 in AsmJSFaultHandler(int, siginfo*, void*) () from /home/user/Documents/firefox/libxul.so
#5  <signal handler called>
#6  0x00000000004063d0 in mozalloc_abort(char const*) ()
#7  0x00007f951aebfc74 in NS_DebugBreak () from /home/user/Documents/firefox/libxul.so
#8  0x00007f951d1c7a6a in X11Error () from /home/user/Documents/firefox/libxul.so
#9  0x00007f951d1c843b in GdkErrorHandler(char const*, GLogLevelFlags, char const*, void*) () from /home/user/Documents/firefox/libxul.so
#10 0x00007f9526e0b734 in g_logv () from /usr/lib/libglib-2.0.so.0
#11 0x00007f9526e0b95f in g_log () from /usr/lib/libglib-2.0.so.0
#12 0x00007f95297aead8 in ?? () from /usr/lib/libgdk-3.so.0
#13 0x00007f95297baca9 in ?? () from /usr/lib/libgdk-3.so.0
#14 0x00007f952904987d in _XError () from /usr/lib/libX11.so.6
#15 0x00007f95290467c7 in ?? () from /usr/lib/libX11.so.6
#16 0x00007f9529046885 in ?? () from /usr/lib/libX11.so.6
#17 0x00007f9529047235 in _XEventsQueued () from /usr/lib/libX11.so.6
#18 0x00007f9529038b87 in XPending () from /usr/lib/libX11.so.6
#19 0x00007f95297b560b in ?? () from /usr/lib/libgdk-3.so.0
#20 0x00007f9529784969 in gdk_display_get_event () from /usr/lib/libgdk-3.so.0
#21 0x00007f95297b5482 in ?? () from /usr/lib/libgdk-3.so.0
#22 0x00007f9526e04f07 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#23 0x00007f9526e05160 in ?? () from /usr/lib/libglib-2.0.so.0
#24 0x00007f9526e0520c in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#25 0x00007f951c9a863b in nsAppShell::ProcessNextNativeEvent(bool) () from /home/user/Documents/firefox/libxul.so
---Type <return> to continue, or q <return> to quit---
#26 0x00007f951c987a37 in nsBaseAppShell::DoProcessNextNativeEvent(bool) () from /home/user/Documents/firefox/libxul.so
#27 0x00007f951c98a4ba in nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, bool) () from /home/user/Documents/firefox/libxul.so
#28 0x00007f951af2d113 in nsThread::ProcessNextEvent(bool, bool*) () from /home/user/Documents/firefox/libxul.so
#29 0x00007f951af52fde in NS_ProcessNextEvent(nsIThread*, bool) () from /home/user/Documents/firefox/libxul.so
#30 0x00007f951b2bd340 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) () from /home/user/Documents/firefox/libxul.so
#31 0x00007f951b29bb33 in MessageLoop::RunInternal() () from /home/user/Documents/firefox/libxul.so
#32 0x00007f951b29bb5a in MessageLoop::Run() () from /home/user/Documents/firefox/libxul.so
#33 0x00007f951c985ec3 in nsBaseAppShell::Run() () from /home/user/Documents/firefox/libxul.so
#34 0x00007f951d17631e in nsAppStartup::Run() () from /home/user/Documents/firefox/libxul.so
#35 0x00007f951d1c4857 in XREMain::XRE_mainRun() () from /home/user/Documents/firefox/libxul.so
#36 0x00007f951d1c4c7d in XREMain::XRE_main(int, char**, nsXREAppData const*) () from /home/user/Documents/firefox/libxul.so
#37 0x00007f951d1c4ed9 in XRE_main () from /home/user/Documents/firefox/libxul.so
#38 0x0000000000406189 in do_main(int, char**, char**, nsIFile*) ()
#39 0x000000000040565c in main ()
That last one is either not a crash (i.e. maybe you accidentally hit ctrl-C), or somehow you switched to another thread in the debugger than the one that initiated the crash. What we're looking for here in the crash stack is the X11 error handler, and evidence that the handler that should be trapping the failed XShmAttach is somehow not actually trapping it.
I kept getting the same stack trace, but I have been able to get the one you want by attaching gdb before the crash.

[1907] ###!!! ABORT: X_ShmAttach: BadAccess (attempt to access private resource denied); 15 requests ago; id=0x0
Re-running with MOZ_X_SYNC=1 in the environment may give a more helpful backtrace.: file /builds/slave/m-cen-l64-d-000000000000000000/build/src/toolkit/xre/nsX11ErrorHandler.cpp, line 157
Hit MOZ_CRASH() at /builds/slave/m-cen-l64-d-000000000000000000/build/src/memory/mozalloc/mozalloc_abort.cpp:33

Thread 48 "Compositor" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffb9df8700 (LWP 1958)]
0x00000000004063d0 in mozalloc_abort(char const*) ()
(gdb) bt
#0  0x00000000004063d0 in mozalloc_abort(char const*) ()
#1  0x00007fffe5cbfc74 in NS_DebugBreak () from /home/user/Documents/firefox/libxul.so
#2  0x00007fffe7fc7a6a in X11Error () from /home/user/Documents/firefox/libxul.so
#3  0x00007fffe7fc843b in GdkErrorHandler(char const*, GLogLevelFlags, char const*, void*) () from /home/user/Documents/firefox/libxul.so
#4  0x00007ffff1c0b734 in g_logv () from /usr/lib/libglib-2.0.so.0
#5  0x00007ffff1c0b95f in g_log () from /usr/lib/libglib-2.0.so.0
#6  0x00007ffff45aead8 in ?? () from /usr/lib/libgdk-3.so.0
#7  0x00007ffff45baca9 in ?? () from /usr/lib/libgdk-3.so.0
#8  0x00007ffff3e4987d in _XError () from /usr/lib/libX11.so.6
#9  0x00007ffff3e467c7 in ?? () from /usr/lib/libX11.so.6
#10 0x00007ffff3e46885 in ?? () from /usr/lib/libX11.so.6
#11 0x00007ffff3e47830 in _XReply () from /usr/lib/libX11.so.6
#12 0x00007ffff3e2c1be in XGetGeometry () from /usr/lib/libX11.so.6
#13 0x00007fffe65a8333 in mozilla::gl::GLContextGLX::GetTargetSize() () from /home/user/Documents/firefox/libxul.so
#14 0x00007fffe66804de in mozilla::layers::CompositorOGL::BeginFrame(mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float> const*, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float>*, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float>*) () from /home/user/Documents/firefox/libxul.so
#15 0x00007fffe6651562 in mozilla::layers::LayerManagerComposite::Render(mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&) ()
   from /home/user/Documents/firefox/libxul.so
#16 0x00007fffe6651cd9 in mozilla::layers::LayerManagerComposite::UpdateAndRender() () from /home/user/Documents/firefox/libxul.so
#17 0x00007fffe6651f2d in mozilla::layers::LayerManagerComposite::EndTransaction(mozilla::TimeStamp const&, mozilla::layers::LayerManager::EndTransactionFlags) () from /home/user/Documents/firefox/libxul.so
#18 0x00007fffe6670dff in mozilla::layers::CompositorBridgeParent::CompositeToTarget(mozilla::gfx::DrawTarget*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const*) ()
   from /home/user/Documents/firefox/libxul.so
#19 0x00007fffe66710e4 in mozilla::layers::CompositorVsyncScheduler::Composite(mozilla::TimeStamp) () from /home/user/Documents/firefox/libxul.so
#20 0x00007fffe6099bc2 in MessageLoop::RunTask(Task*) () from /home/user/Documents/firefox/libxul.so
#21 0x00007fffe60a029c in MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) () from /home/user/Documents/firefox/libxul.so
---Type <return> to continue, or q <return> to quit---
#22 0x00007fffe60a03cb in MessageLoop::DoWork() () from /home/user/Documents/firefox/libxul.so
#23 0x00007fffe609bc1a in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) () from /home/user/Documents/firefox/libxul.so
#24 0x00007fffe609bb33 in MessageLoop::RunInternal() () from /home/user/Documents/firefox/libxul.so
#25 0x00007fffe609bb5a in MessageLoop::Run() () from /home/user/Documents/firefox/libxul.so
#26 0x00007fffe60a2c75 in base::Thread::ThreadMain() () from /home/user/Documents/firefox/libxul.so
#27 0x00007fffe60a06b3 in ThreadFunc(void*) () from /home/user/Documents/firefox/libxul.so
#28 0x00007ffff7bc3424 in start_thread () from /usr/lib/libpthread.so.0
#29 0x00007ffff6c59cbd in clone () from /usr/lib/libc.so.6
I think there are 2 different crashes here, but both are caused by loading this map (and maybe moving the map with the mouse).
(In reply to Lee Salzman [:lsalzman] from comment #3)
> I can only speculate that the usage of ScopedXErrorHandler inside the GLX
> provider code, being called off the main thread, is having some fun
> interaction with the nsShmImage widget code that sets its own temporary X11
> handler which is what is trapping the call to XShmAttach normally.

Yes, if ScopedXErrorHandler is called off main thread, while the main thread is not blocked, it would cause this.
I tried one more time to reproduce this with the settings you reported - e10s off, OpenGL layers, over a clean profile - and I could not get anything resembling the race condition to trigger at all.

Are there any other important settings you are using that are required to trigger this? If you start with a clean profile, no add-ons, then turn e10s off and OpenGL layers on, does it still occur?
Flags: needinfo?(anakin.cs)
I've just did what you told me with the latest nightly (49.0a1.20160509), e10s off, clean profile, no addons and OpenGL layers on, and reproduced the crash again. Did you try to move the map around with your mouse and scroll in/out a lot ?
Flags: needinfo?(anakin.cs)
(In reply to Karl Tomlinson (ni?:karlt) from comment #16)
> (In reply to Lee Salzman [:lsalzman] from comment #3)
> > I can only speculate that the usage of ScopedXErrorHandler inside the GLX
> > provider code, being called off the main thread, is having some fun
> > interaction with the nsShmImage widget code that sets its own temporary X11
> > handler which is what is trapping the call to XShmAttach normally.
> 
> Yes, if ScopedXErrorHandler is called off main thread, while the main thread
> is not blocked, it would cause this.

Unless MOZ_GLX_DEBUG is set, ScopedXErrorHandler shouldn't be allocated at all off the main thread using GL layers. Do you mind checking if this is set? (we should really make ScopedXErrorHandler thread-safe or not use it when the main thread isn't blocking)

Assuming MOZ_GLX_DEBUG is unset, judging by the stack trace in comment 14, I'd imagine that the call to XGetGeometry on the compositor thread is forcing X to finish the commands queued in the output buffer. The strange part here is that the call to XShmAttach *should* be trapped by the error handler set in nsShmImage. Maybe our error handler is being overridden elsewhere.

FWIW, I can't seem to reproduce this either with a clean profile, e10s off, and GL layers forced.
Flags: needinfo?(anakin.cs)
(I don't think bug 1272485 is the cause of this bug, but it is related.)
See Also: → 1272485
Is there anything else I can provide that can help you?
Flags: needinfo?(anakin.cs)
Assignee: nobody → andrew
Depends on: 1286649
As we are no longer making unchecked calls to attach X SHM segments (bug 1286649), this should be fixed.

Can you please check if this crash still occurs in the latest nightly? Thanks!
Flags: needinfo?(anakin.cs)
Seems to be fixed, I can't reproduce it anymore after a few tries. Thanks :)
Status: UNCONFIRMED → RESOLVED
Closed: 8 years ago
Flags: needinfo?(anakin.cs)
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.