Closed Bug 1275866 Opened 3 years ago Closed 3 years ago

WebGLTimerQuery::Delete called after GLContext destroyed (was: Intermittent crash test_webglcontextcreationerror.html | application crashed [@ mozilla::WebGLContext::MakeContextCurrent])

Categories

(Core :: Canvas: WebGL, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla49
Tracking Status
firefox49 --- fixed
firefox50 --- wontfix

People

(Reporter: aryx, Assigned: jgilbert)

References

Details

(Keywords: crash, intermittent-failure, Whiteboard: [gfx-noted])

Crash Data

Attachments

(2 files, 1 obsolete file)

+++ This bug was initially created as a clone of Bug #1274769 +++

https://treeherder.mozilla.org/logviewer.html#?job_id=28771052&repo=mozilla-inbound

10:31:56  WARNING -  PROCESS-CRASH | dom/canvas/test/webgl-mochitest/test_webglcontextcreationerror.html | application crashed [@ mozilla::WebGLContext::MakeContextCurrent]
10:31:56     INFO -  Crash dump filename: /tmp/tmpE4vXKY.mozrunner/minidumps/3633302c-a995-89e4-504b9f8f-5aadf937.dmp
10:31:56     INFO -  Operating system: Linux
10:31:56     INFO -                    0.0.0 Linux 3.13.0-79-generic #123-Ubuntu SMP Fri Feb 19 14:27:58 UTC 2016 x86_64
10:31:56     INFO -  CPU: amd64
10:31:56     INFO -       family 6 model 62 stepping 4
10:31:56     INFO -       1 CPU
10:31:56     INFO -  Crash reason:  SIGSEGV
10:31:56     INFO -  Crash address: 0x0
10:31:56     INFO -  Thread 0 (crashed)
10:31:56     INFO -   0  libxul.so!mozilla::WebGLContext::MakeContextCurrent [GLContext.h:6725f1c8401b : 3205 + 0x0]
10:31:56     INFO -      rbx = 0x00007ff304dab5b0   r12 = 0x00007ff2f8c3c000
10:31:56     INFO -      r13 = 0x0000000000000000   r14 = 0x00007ff2f8c3cc60
10:31:56     INFO -      r15 = 0x0000000000000083   rip = 0x00007ff33db02882
10:31:56     INFO -      rsp = 0x00007fff1eb545f0   rbp = 0x00007fff1eb545f0
10:31:56     INFO -      Found by: given as instruction pointer in context
10:31:56     INFO -   1  libxul.so!mozilla::WebGLTimerQuery::Delete [WebGLTimerQuery.cpp:6725f1c8401b : 48 + 0x8]
10:31:56     INFO -      rbx = 0x00007ff304dab5b0   r12 = 0x00007ff2f8c3c000
10:31:56     INFO -      r13 = 0x0000000000000000   r14 = 0x00007ff2f8c3cc60
10:31:56     INFO -      r15 = 0x0000000000000083   rip = 0x00007ff33db37e8a
10:31:56     INFO -      rsp = 0x00007fff1eb54600   rbp = 0x00007fff1eb54610
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -   2  libxul.so!mozilla::WebGLTimerQuery::cycleCollection::DeleteCycleCollectable [WebGLObjectModel.h:6725f1c8401b : 142 + 0x7]
10:31:56     INFO -      rbx = 0x00007ff304dab5b0   r12 = 0x00007ff2f8c3c000
10:31:56     INFO -      r13 = 0x0000000000000000   r14 = 0x00007ff2f8c3cc60
10:31:56     INFO -      r15 = 0x0000000000000083   rip = 0x00007ff33db37ecc
10:31:56     INFO -      rsp = 0x00007fff1eb54620   rbp = 0x00007fff1eb54630
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -   3  libxul.so!nsCycleCollector::FreeSnowWhite [nsCycleCollector.cpp:6725f1c8401b : 2687 + 0x2]
10:31:56     INFO -      rbx = 0x00007ff304dab5e8   r12 = 0x00007ff2f8c3c000
10:31:56     INFO -      r13 = 0x0000000000000000   r14 = 0x00007ff2f8c3cc60
10:31:56     INFO -      r15 = 0x0000000000000083   rip = 0x00007ff33eaf920e
10:31:56     INFO -      rsp = 0x00007fff1eb54640   rbp = 0x00007fff1eb546f0
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -   4  libxul.so!AsyncFreeSnowWhite::Run [XPCJSRuntime.cpp:6725f1c8401b : 155 + 0x4]
10:31:56     INFO -      rbx = 0x00007ff331105e80   r12 = 0x0000033bcb5f0084
10:31:56     INFO -      r13 = 0x0000000000000000   r14 = 0x00007ff34804ab70
10:31:56     INFO -      r15 = 0x00007ff3310b0648   rip = 0x00007ff33ebb5822
10:31:56     INFO -      rsp = 0x00007fff1eb54700   rbp = 0x00007fff1eb54720
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -   5  libxul.so!nsThread::ProcessNextEvent [nsThread.cpp:6725f1c8401b : 1025 + 0x1]
10:31:56     INFO -      rbx = 0x00007ff34804ab88   r12 = 0x00007fff1eb547d0
10:31:56     INFO -      r13 = 0x0000000000000000   r14 = 0x00007ff34804ab70
10:31:56     INFO -      r15 = 0x00007ff3310b0648   rip = 0x00007ff33eb16352
10:31:56     INFO -      rsp = 0x00007fff1eb54730   rbp = 0x00007fff1eb547b0
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -   6  libxul.so!NS_ProcessNextEvent [nsThreadUtils.cpp:6725f1c8401b : 290 + 0xd]
10:31:56     INFO -      rbx = 0x00007ff34804ab70   r12 = 0x00007ff30074a200
10:31:56     INFO -      r13 = 0x0000000000000000   r14 = 0x00007ff33fd31fa0
10:31:56     INFO -      r15 = 0x00007fff1eb54840   rip = 0x00007ff33eb2969c
10:31:56     INFO -      rsp = 0x00007fff1eb547c0   rbp = 0x00007fff1eb547f0
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -   7  libxul.so!mozilla::dom::quota::QuotaManager::ShutdownObserver::Observe [ActorsParent.cpp:6725f1c8401b : 2340 + 0xc]
10:31:56     INFO -      rbx = 0x00007ff34804ab70   r12 = 0x00007ff30074a200
10:31:56     INFO -      r13 = 0x0000000000000000   r14 = 0x00007ff33fd31fa0
10:31:56     INFO -      r15 = 0x00007fff1eb54840   rip = 0x00007ff33f612808
10:31:56     INFO -      rsp = 0x00007fff1eb54800   rbp = 0x00007fff1eb54820
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -   8  libxul.so!nsObserverService::NotifyObservers [nsObserverList.cpp:6725f1c8401b : 112 + 0xb]
10:31:56     INFO -      rbx = 0x00007ff33f8e9126   r12 = 0x00007ff3367795d0
10:31:56     INFO -      r13 = 0x0000000000000000   r14 = 0x00007ff33fd31fa0
10:31:56     INFO -      r15 = 0x00007fff1eb54840   rip = 0x00007ff33eb00eb7
10:31:56     INFO -      rsp = 0x00007fff1eb54830   rbp = 0x00007fff1eb54880
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -   9  libxul.so!nsXREDirProvider::DoShutdown [nsXREDirProvider.cpp:6725f1c8401b : 1001 + 0x18]
10:31:56     INFO -      rbx = 0x00007ff3367795b0   r12 = 0x00007fff1eb549d0
10:31:56     INFO -      r13 = 0x0000000000000000   r14 = 0x0000000000000000
10:31:56     INFO -      r15 = 0x00007fff1eb54920   rip = 0x00007ff33e490c2b
10:31:56     INFO -      rsp = 0x00007fff1eb54890   rbp = 0x00007fff1eb548c0
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -  10  libxul.so!ScopedXPCOMStartup::~ScopedXPCOMStartup [nsAppRunner.cpp:6725f1c8401b : 1467 + 0xb]
10:31:56     INFO -      rbx = 0x00007ff3393472f8   r12 = 0x00007ff340b2ab30
10:31:56     INFO -      r13 = 0x0000000000000000   r14 = 0x0000000000000000
10:31:56     INFO -      r15 = 0x00007fff1eb54920   rip = 0x00007ff33e4878cb
10:31:56     INFO -      rsp = 0x00007fff1eb548d0   rbp = 0x00007fff1eb548f0
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -  11  libxul.so!mozilla::DefaultDelete<ScopedXPCOMStartup>::operator() [UniquePtr.h:6725f1c8401b : 528 + 0x6]
10:31:56     INFO -      rbx = 0x00007ff3393472f8   r12 = 0x00007ff340b2ab30
10:31:56     INFO -      r13 = 0x0000000000000000   r14 = 0x0000000000000000
10:31:56     INFO -      r15 = 0x00007fff1eb54920   rip = 0x00007ff33e487917
10:31:56     INFO -      rsp = 0x00007fff1eb54900   rbp = 0x00007fff1eb54910
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -  12  libxul.so!XREMain::XRE_main [UniquePtr.h:6725f1c8401b : 343 + 0x4]
10:31:56     INFO -      rbx = 0x00007fff1eb54990   r12 = 0x00007ff340b2ab30
10:31:56     INFO -      r13 = 0x0000000000000000   r14 = 0x0000000000000000
10:31:56     INFO -      r15 = 0x00007fff1eb54920   rip = 0x00007ff33e48c162
10:31:56     INFO -      rsp = 0x00007fff1eb54920   rbp = 0x00007fff1eb54980
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -  13  libxul.so!XRE_main [nsAppRunner.cpp:6725f1c8401b : 4586 + 0x10]
10:31:56     INFO -      rbx = 0x00007fff1eb54990   r12 = 0x0000000000000005
10:31:56     INFO -      r13 = 0x00007fff1eb55e28   r14 = 0x00007fff1eb54ba0
10:31:56     INFO -      r15 = 0x00007ff34805e540   rip = 0x00007ff33e48c34a
10:31:56     INFO -      rsp = 0x00007fff1eb54990   rbp = 0x00007fff1eb54b20
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -  14  firefox!do_main [nsBrowserApp.cpp:6725f1c8401b : 242 + 0x8]
10:31:56     INFO -      rbx = 0x00007fff1eb55e28   r12 = 0x00007fff1eb54ba0
10:31:56     INFO -      r13 = 0x00007ff34805e780   r14 = 0x0000000000000005
10:31:56     INFO -      r15 = 0x00007ff34805e540   rip = 0x00000000004105e1
10:31:56     INFO -      rsp = 0x00007fff1eb54b30   rbp = 0x00007fff1eb55bd0
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -  15  firefox!main [nsBrowserApp.cpp:6725f1c8401b : 382 + 0x14]
10:31:56     INFO -      rbx = 0x00007fff1eb55e28   r12 = 0x0000000000000005
10:31:56     INFO -      r13 = 0x00007fff1eb55e58   r14 = 0x0000000000000000
10:31:56     INFO -      r15 = 0x00000335b44c673c   rip = 0x000000000040ca13
10:31:56     INFO -      rsp = 0x00007fff1eb55be0   rbp = 0x00007fff1eb55d40
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -  16  libc-2.15.so + 0x2176c
10:31:56     INFO -      rbx = 0x0000000000000000   r12 = 0x000000000040ff98
10:31:56     INFO -      r13 = 0x00007fff1eb55e20   r14 = 0x0000000000000000
10:31:56     INFO -      r15 = 0x0000000000000000   rip = 0x00007ff3482e576d
10:31:56     INFO -      rsp = 0x00007fff1eb55d50   rbp = 0x0000000000000000
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -  17  firefox + 0xc95f
10:31:56     INFO -      rip = 0x000000000040c960   rsp = 0x00007fff1eb55d70
10:31:56     INFO -      Found by: stack scanning
10:31:56     INFO -  18  firefox!malloc_good_size [replace_malloc.c:6725f1c8401b : 243 + 0x4]
10:31:56     INFO -      rip = 0x000000000040ff98   rsp = 0x00007fff1eb55d88
10:31:56     INFO -      Found by: stack scanning
10:31:56     INFO -  19  0x7fff1eb55e1f
10:31:56     INFO -      rbx = 0x10a9d3ccafdc5f32   rip = 0x00007fff1eb55e20
10:31:56     INFO -      rsp = 0x00007fff1eb55d90   rbp = 0x000000000040ff98
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -  20  firefox!__libc_csu_fini + 0xf
10:31:56     INFO -      rip = 0x000000000041e310   rsp = 0x00007fff1eb55dd0
10:31:56     INFO -      Found by: stack scanning
10:31:56     INFO -  21  firefox!malloc_good_size [replace_malloc.c:6725f1c8401b : 243 + 0x4]
10:31:56     INFO -      rip = 0x000000000040ff98   rsp = 0x00007fff1eb55df8
10:31:56     INFO -      Found by: stack scanning
10:31:56     INFO -  22  0x7fff1eb55e1f
10:31:56     INFO -      rbx = 0x0000000000000000   rip = 0x00007fff1eb55e20
10:31:56     INFO -      rsp = 0x00007fff1eb55e00   rbp = 0x000000000040ff98
10:31:56     INFO -      Found by: call frame info
10:31:56     INFO -  23  firefox!_start + 0x28
10:31:56     INFO -      rip = 0x000000000040ffc1   rsp = 0x00007fff1eb55e10
10:31:56     INFO -      Found by: stack scanning
Whiteboard: [gfx-noted]
After Bug 1274769, I think we fix this problem.
Let me think more about this.
Assignee: nobody → hshih
Status: NEW → ASSIGNED
Even though we clean up the mActiveQuery, the the last RefCount is still held by someone.
And during CC, the WebGLTimerQuery::Delete() is called.
So, I think we should call DeleteOnce() inside OnMarkLost() to mark the deletion status.
Attachment #8757110 - Flags: review?(jgilbert)
Comment on attachment 8757110 [details] [diff] [review]
call WebGLTimerQuery::DeleteOnce() when GLContext gone. v1

Review of attachment 8757110 [details] [diff] [review]:
-----------------------------------------------------------------

I don't think this is the correct fix.
Instead, we should teardown all the WebGLTimerQuerys at the same time as we teardown all the other WebGL objects. I actually already have a patch for this.
Attachment #8757110 - Flags: review?(jgilbert) → review-
I forgot to assign this bug to me earlier, sorry!
Assignee: hshih → jgilbert
Attachment #8757110 - Attachment is obsolete: true
Attachment #8757514 - Flags: review?(hshih)
(In reply to Jeff Gilbert [:jgilbert] from comment #3)
> Comment on attachment 8757110 [details] [diff] [review]
> call WebGLTimerQuery::DeleteOnce() when GLContext gone. v1
> 
> Review of attachment 8757110 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> I don't think this is the correct fix.
> Instead, we should teardown all the WebGLTimerQuerys at the same time as we
> teardown all the other WebGL objects. I actually already have a patch for
> this.

Only WebGLExtensionDisjointTimerQuery will hold the WebGLTimerQuery object[1]. And when gl context is gone, it will clear all extensions including WebGLExtensionDisjointTimerQuery objects. All WebGLTimerQuerys teardown when gl context is gone. So I think this patch is still work.

But we still can do the similar thing as other webgl objects do. 

[1]
https://hg.mozilla.org/mozilla-central/annotate/4d63dde701b47b8661ab7990f197b6b60e543839/dom/canvas/WebGLExtensionDisjointTimerQuery.cpp#l36
Attachment #8757514 - Flags: review?(hshih) → review+
Summary: Intermittent crash test_webglcontextcreationerror.html | application crashed [@ mozilla::WebGLContext::MakeContextCurrent] → WebGLTimerQuery::Delete called after GLContext destroyed (was: Intermittent crash test_webglcontextcreationerror.html | application crashed [@ mozilla::WebGLContext::MakeContextCurrent])
What's the different between attachment 8759554 [details] and attachment 8757514 [details] [diff] [review]?
And could you please check comment 5?
Flags: needinfo?(jgilbert)
https://reviewboard.mozilla.org/r/57542/#review54378

Again, please separate out cosmetic changes from functional ones.
Comment on attachment 8759554 [details]
Bug 1275866 - Clear WebGLTimerQuerys on WebGL GLContext teardown. -

carries forward r=jerry
Flags: needinfo?(jgilbert)
Attachment #8759554 - Flags: review?(hshih)
(In reply to Jerry Shih[:jerry] (UTC+8) from comment #8)
> What's the different between attachment 8759554 [details] and attachment
> 8757514 [details] [diff] [review]?
> And could you please check comment 5?

It's the same, I should have carried forward your review. (I have now)

Comment 5 is not quite right, since JS can keep TimeyQuerys alive, not just the extension. This should be a more complete solution.
Duplicate of this bug: 1277720
Comment on attachment 8759554 [details]
Bug 1275866 - Clear WebGLTimerQuerys on WebGL GLContext teardown. -

https://reviewboard.mozilla.org/r/57542/#review54506
Attachment #8759554 - Flags: review?(jmuizelaar) → review+
Pushed by jgilbert@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/53de33ce847f
Clear WebGLTimerQuerys on WebGL GLContext teardown. - r=jerry,jrmuizel
https://hg.mozilla.org/mozilla-central/rev/53de33ce847f
Status: ASSIGNED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla49
Crash volume for signature 'mozilla::WebGLContext::MakeContextCurrent':
 - nightly (version 50): 1605 crashes from 2016-06-06.
 - aurora  (version 49): 0 crash from 2016-06-07.
 - beta    (version 48): 0 crash from 2016-06-06.
 - release (version 47): 0 crash from 2016-05-31.
 - esr     (version 45): 0 crash from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly        586        343        475         55          2          0          0
 - aurora           0          0          0          0          0          0          0
 - beta             0          0          0          0          0          0          0
 - release          0          0          0          0          0          0          0
 - esr              0          0          0          0          0          0          0

Affected platforms: Windows, Linux
You need to log in before you can comment on or make changes to this bug.