Closed Bug 1362144 Opened 3 years ago Closed 2 years ago

RenderTextureHost destroyed before render thread is finished using it

Categories

(Core :: Graphics: WebRender, defect)

defect
Not set

Tracking

()

RESOLVED WORKSFORME
mozilla57
Tracking Status
firefox56 --- unaffected
firefox57 --- unaffected

People

(Reporter: aosmond, Assigned: aosmond)

References

Details

(Whiteboard: [gfx-noted])

Attachments

(1 file)

I tripped a sanity assert in SourceSurfaceRawData which ensures there are no active mappings left before destroying it:

#0  0x00007f4ce740f75d in nanosleep () at ../sysdeps/unix/syscall-template.S:84
#1  0x00007f4ce740f6aa in __sleep (seconds=0) at ../sysdeps/posix/sleep.c:55
#2  0x00007f4cdb0a82a8 in ah_crap_handler (signum=11) at gecko-dev/toolkit/xre/nsSigHandlers.cpp:103
#3  0x00007f4cdb08e25a in nsProfileLock::FatalSignalHandler (signo=11, info=0x7f4cc52fcdf0, context=0x7f4cc52fccc0)
    at gecko-dev/toolkit/profile/nsProfileLock.cpp:191
#4  0x00007f4cdb8e2341 in js::UnixExceptionHandler (signum=11, info=0x7f4cc52fcdf0, context=0x7f4cc52fccc0)
    at gecko-dev/js/src/ds/MemoryProtectionExceptionHandler.cpp:263
#5  0x00007f4cdbc4e044 in WasmFaultHandler<(Signal)0> (signum=11, info=0x7f4cc52fcdf0, context=0x7f4cc52fccc0)
    at gecko-dev/js/src/wasm/WasmSignalHandlers.cpp:1294
#6  <signal handler called>
#7  mozilla::gfx::SourceSurfaceRawData::~SourceSurfaceRawData (this=0x7f4cba0e1580, __in_chrg=<optimized out>)
    at gecko-dev/gfx/2d/SourceSurfaceRawData.h:41
#8  mozilla::gfx::SourceSurfaceRawData::~SourceSurfaceRawData (this=0x7f4cba0e1580, __in_chrg=<optimized out>)
    at gecko-dev/gfx/2d/SourceSurfaceRawData.h:42
#9  0x00007f4cd7cf632a in mozilla::detail::RefCounted<mozilla::gfx::SourceSurface, (mozilla::detail::RefCountAtomicity)0>::Release (this=0x7f4cba0e1588)
    at gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefCounted.h:138
#10 mozilla::RefPtrTraits<mozilla::gfx::DataSourceSurface>::Release (aPtr=0x7f4cba0e1580)
    at gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:40
#11 RefPtr<mozilla::gfx::DataSourceSurface>::ConstRemovingRefPtrTraits<mozilla::gfx::DataSourceSurface>::Release (aPtr=0x7f4cba0e1580)
    at gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:395
#12 RefPtr<mozilla::gfx::DataSourceSurface>::~RefPtr (this=0x7f4ca82676d8, __in_chrg=<optimized out>)
    at gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:78
#13 mozilla::wr::RenderBufferTextureHost::~RenderBufferTextureHost (this=0x7f4ca8267680, __in_chrg=<optimized out>)
    at gecko-dev/gfx/webrender_bindings/RenderBufferTextureHost.cpp:41
#14 0x00007f4cd7cf635b in mozilla::wr::RenderBufferTextureHost::~RenderBufferTextureHost (this=0x7f4ca8267680, __in_chrg=<optimized out>)
    at gecko-dev/gfx/webrender_bindings/RenderBufferTextureHost.cpp:44
#15 0x00007f4cd7d006de in mozilla::wr::RenderTextureHost::Release (this=0x7f4ca8267680) at gecko-dev/gfx/webrender_bindings/RenderTextureHost.h:22
#16 mozilla::RefPtrTraits<mozilla::wr::RenderTextureHost>::Release (aPtr=0x7f4ca8267680)
    at gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:40
#17 RefPtr<mozilla::wr::RenderTextureHost>::ConstRemovingRefPtrTraits<mozilla::wr::RenderTextureHost>::Release (aPtr=0x7f4ca8267680)
    at gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:395
#18 RefPtr<mozilla::wr::RenderTextureHost>::~RefPtr (this=<optimized out>, __in_chrg=<optimized out>)
    at gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/RefPtr.h:78
#19 nsBaseHashtableET<nsUint64HashKey, RefPtr<mozilla::wr::RenderTextureHost> >::~nsBaseHashtableET (this=<optimized out>, __in_chrg=<optimized out>)
    at gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/nsBaseHashtable.h:268
#20 0x00007f4cd7d006f0 in nsTHashtable<nsBaseHashtableET<nsUint64HashKey, RefPtr<mozilla::wr::RenderTextureHost> > >::s_ClearEntry (aTable=<optimized out>, 
    aEntry=<optimized out>) at gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/nsTHashtable.h:406
#21 0x00007f4cd698371f in PLDHashTable::RawRemove (this=this@entry=0x7f4cc5c28590, aEntry=0x7f4c9bb84170) at gecko-dev/xpcom/ds/PLDHashTable.cpp:649
#22 0x00007f4cd6986135 in PLDHashTable::Remove (this=this@entry=0x7f4cc5c28590, aKey=aKey@entry=0x7f4cc52fd3a8)
    at gecko-dev/xpcom/ds/PLDHashTable.cpp:619
#23 0x00007f4cd7cf6b1f in nsTHashtable<nsBaseHashtableET<nsUint64HashKey, RefPtr<mozilla::wr::RenderTextureHost> > >::RemoveEntry (aKey=@0x7f4cc52fd3a8: 25769805125, 
    this=0x7f4cc5c28590) at gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/nsTHashtable.h:171
#24 nsBaseHashtable<nsUint64HashKey, RefPtr<mozilla::wr::RenderTextureHost>, RefPtr<mozilla::wr::RenderTextureHost> >::Remove (aKey=@0x7f4cc52fd3a8: 25769805125, 
    this=0x7f4cc5c28590) at gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/nsBaseHashtable.h:164
#25 mozilla::wr::RenderThread::UnregisterExternalImage (this=0x7f4cc5c28500, aExternalImageId=aExternalImageId@entry=25769805125)
    at gecko-dev/gfx/webrender_bindings/RenderThread.cpp:240
#26 0x00007f4cd7aa5b5f in mozilla::layers::WebRenderTextureHost::~WebRenderTextureHost (this=0x7f4ca74af240, __in_chrg=<optimized out>)
    at gecko-dev/gfx/layers/wr/WebRenderTextureHost.cpp:39
#27 0x00007f4cd7aa5b8f in mozilla::layers::WebRenderTextureHost::~WebRenderTextureHost (this=0x7f4ca74af240, __in_chrg=<optimized out>)
    at gecko-dev/gfx/layers/wr/WebRenderTextureHost.cpp:40

Meanwhile the render thread was running in update_texture_cache:

#0  __lll_lock_wait () at ../sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:135
#1  0x00007f4ce81bbdbd in __GI___pthread_mutex_lock (mutex=0x7f4cc5c28548) at ../nptl/pthread_mutex_lock.c:80
#2  0x00000000004072b6 in mozilla::detail::MutexImpl::lock (this=this@entry=0x7f4cc5c28548) at gecko-dev/mozglue/misc/Mutex_posix.cpp:74
#3  0x00007f4cd69e7cb0 in mozilla::OffTheBooksMutex::Lock (this=0x7f4cc5c28548) at gecko-dev/xpcom/threads/BlockingResourceBase.cpp:382
#4  0x00007f4cd7cf6be4 in mozilla::BaseAutoLock<mozilla::Mutex>::BaseAutoLock(mozilla::Mutex&, mozilla::detail::GuardObjectNotifier&&) (
    _notifier=<unknown type in gecko-dev/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so, CU 0x9b182c7, DIE 0x9b80639>, aLock=..., this=0x7f4cc5afdd50)
    at gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/Mutex.h:163
#5  mozilla::wr::RenderThread::GetRenderTexture (this=0x7f4cc5c28500, aExternalImageId=...) at gecko-dev/gfx/webrender_bindings/RenderThread.cpp:246
#6  0x00007f4cd7cf715b in mozilla::wr::RendererOGL::GetRenderTexture (this=<optimized out>, aExternalImageId=...)
    at gecko-dev/gfx/webrender_bindings/RendererOGL.cpp:179
#7  0x00007f4cd7cf7166 in mozilla::wr::UnlockExternalImage (aObj=<optimized out>, aId=..., aChannelIndex=<optimized out>)
    at gecko-dev/gfx/webrender_bindings/RendererOGL.cpp:48
#8  0x00007f4cdbf5d51e in webrender::renderer::{{impl}}::update_texture_cache (self=<optimized out>) at gecko-dev/gfx/webrender/src/renderer.rs:1410
#9  0x00007f4cdbf5cf71 in webrender::renderer::{{impl}}::render::{{closure}} () at gecko-dev/gfx/webrender/src/renderer.rs:1236
Assignee: nobody → aosmond
Status: NEW → ASSIGNED
Priority: -- → P3
Whiteboard: gfx-noted
Sorry for delayed response. I was in PTOs and public holidays.

:aosmond, how do you produce the crash? Is it possible to reproduce the crash? Current implementation should not hit the assert, since WebRenderCompositableHolder holds compositable ref of TextureHosts until the TextureHost are not used by Render thread.

And attachment 8864612 [details] [diff] [review] seems not work since BufferTextureHost controls life time of its buffer. RenderBufferTextureHost does not control the buffer's life time.
Flags: needinfo?(aosmond)
Attachment #8864612 - Flags: review?(sotaro.ikeda.g)
See Also: → 1362393
(In reply to Sotaro Ikeda [:sotaro] from comment #3)
> Sorry for delayed response. I was in PTOs and public holidays.
> 
> :aosmond, how do you produce the crash? Is it possible to reproduce the
> crash? Current implementation should not hit the assert, since
> WebRenderCompositableHolder holds compositable ref of TextureHosts until the
> TextureHost are not used by Render thread.
> 
> And attachment 8864612 [details] [diff] [review] seems not work since
> BufferTextureHost controls life time of its buffer. RenderBufferTextureHost
> does not control the buffer's life time.

Just happened to me at my desk once, I wish I had kept the session open. Looks like there are a few related intermittents. I understand why the patch won't help now and why this shouldn't be happening. I'm still investigating as I would ideally land bug 1331944 after understanding what went wrong here and avoiding the same.
Flags: needinfo?(aosmond)
Thanks for the info! I seems to find the problem Bug 1364302. It might address the problem.
See Also: → 1364302
Priority: P3 → P1
Whiteboard: gfx-noted → [wr-mvp] gfx-noted
Target Milestone: --- → mozilla57
I did not encounter this assert again, and so much has changed since May.
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
Resolution: --- → WORKSFORME
Priority: P1 → --
Whiteboard: [wr-mvp] gfx-noted → [gfx-noted]
You need to log in before you can comment on or make changes to this bug.