1561976 - Crash with gfx.use-glx-texture-from-pixmap;true

Status: RESOLVED WONTFIX

(Core :: Graphics, defect, P3)

Description

[Darkspirit]

Debian Testing, KDE, X11, Macbook Pro A1502 (Qualified for WebRender on Nightly)

I wanted to check out the situation for bug 1010527 comment 25.

1. fresh profile
2. set gfx.use-glx-texture-from-pixmap to true
3. opened https://webglsamples.org/aquarium/aquarium.html
4. full browser crash regardless of GPU process.

This bug is for crash report bp-91749d7e-9d40-4622-989c-e987e0190627.

MOZ_CRASH(IPC FatalError in the parent process!)
IPCFatalErrorMsg Error deserializing 'textureParent' (PTexture) member of 'TimedTexture'

Top 10 frames of crashing thread:

0 libxul.so mozilla::ipc::FatalError ipc/glue/ProtocolUtils.cpp:259
1 libxul.so mozilla::ipc::IProtocol::HandleFatalError const ipc/glue/ProtocolUtils.cpp:495
2 libxul.so mozilla::ipc::IPDLParamTraits<mozilla::layers::TimedTexture>::Read ipc/ipdl/LayersMessages.cpp
3 libxul.so mozilla::ipc::IPDLParamTraits<nsTArray<mozilla::layers::TimedTexture> >::Read ipc/glue/IPDLParamTraits.h:182
4 libxul.so mozilla::ipc::IPDLParamTraits<mozilla::layers::OpUseTexture>::Read ipc/ipdl/LayersMessages.cpp:9739
5 libxul.so mozilla::ipc::IPDLParamTraits<mozilla::layers::CompositableOperationDetail>::Read ipc/ipdl/LayersMessages.cpp:10622
6 libxul.so mozilla::ipc::IPDLParamTraits<mozilla::layers::CompositableOperation>::Read ipc/ipdl/LayersMessages.cpp:10713
7 libxul.so mozilla::ipc::IPDLParamTraits<mozilla::layers::WebRenderParentCommand>::Read ipc/ipdl/WebRenderMessages.cpp:1543
8 libxul.so mozilla::ipc::IPDLParamTraits<nsTArray<mozilla::layers::WebRenderParentCommand> >::Read ipc/glue/IPDLParamTraits.h:182
9 libxul.so mozilla::ipc::IPDLParamTraits<mozilla::layers::RenderRootDisplayListData>::Read gfx/layers/wr/RenderRootTypes.cpp:33

Comment 1

[Darkspirit]

Crash also happens without GPU process and with WebRender force-disabled.

Last day working with "OpenGL" compositing was 2018-02-07, afterwards browser and/or tab crash.
mozregression --good 2018-01-17 --bad 2018-06-15 --pref security.sandbox.content.level:0 layers.acceleration.force-enabled:true gfx.webrender.all:false gfx.use-glx-texture-from-pixmap:true -a https://webglsamples.org/aquarium/aquarium.html

4:56.23 INFO: Last good revision: 4fe6f6560083f8c8257282bef1d4e0ced9d1b975 (2018-02-07)
4:56.23 INFO: First bad revision: c5120bcaf7bdcb5cdb06a02b60bd5bfe6a867d06 (2018-02-08)
4:56.23 INFO: Pushlog:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4fe6f6560083f8c8257282bef1d4e0ced9d1b975&tochange=c5120bcaf7bdcb5cdb06a02b60bd5bfe6a867d06

This securiy bug is within the range:
Bug 1388020: IPC: heap-buffer-overflow [@raw_fTexImage2D]
https://hg.mozilla.org/mozilla-central/rev/4f4d41bd1d6c

---

Oldest available debug build:
mozregression --launch 2018-06-27 --pref security.sandbox.content.level:0 layers.acceleration.force-enabled:true gfx.webrender.all:false gfx.use-glx-texture-from-pixmap:true -a https://webglsamples.org/aquarium/aquarium.html -B debug

0:35.29 INFO: [13257, Main Thread] WARNING: GLX_swap_control unsupported, ASAP mode may still block on buffer swaps.: file /builds/worker/workspace/build/src/gfx/gl/GLContextProviderGLX.cpp, line 219
0:35.30 INFO: [GLX] window 185 has VisualID 0x21
0:35.32 INFO: [13257, GLXVsyncThread] WARNING: robust_buffer_access_behavior marked as unsupported: file /builds/worker/workspace/build/src/gfx/gl/GLContextFeatures.cpp, line 915
[...]
0:36.67 INFO: [GLX] window d60001c has VisualID 0x138
0:36.69 INFO: [Parent 13257, Compositor] WARNING: robust_buffer_access_behavior marked as unsupported: file /builds/worker/workspace/build/src/gfx/gl/GLContextFeatures.cpp, line 915
[...]
0:38.01 INFO: [Parent 13257, Main Thread] WARNING: Attempt to Lock a texture that is being read by the compositor!: file /builds/worker/workspace/build/src/gfx/layers/client/TextureClient.cpp, line 508
[...]
0:38.49 INFO: ++DOMWINDOW == 3 (0x7f9a410efc00) [pid = 13312] [serial = 3] [outer = 0x7f9a4106ac00]
0:39.34 INFO: [Parent 13257, Main Thread] WARNING: Attempt to Lock a texture that is being read by the compositor!: file /builds/worker/workspace/build/src/gfx/layers/client/TextureClient.cpp, line 508
[...]
0:40.62 INFO: [Child 13312, Main Thread] WARNING: GLX_swap_control unsupported, ASAP mode may still block on buffer swaps.: file /builds/worker/workspace/build/src/gfx/gl/GLContextProviderGLX.cpp, line 219
0:40.63 INFO: [Child 13312, Main Thread] WARNING: robust_buffer_access_behavior marked as unsupported: file /builds/worker/workspace/build/src/gfx/gl/GLContextFeatures.cpp, line 915
0:41.01 INFO: Assertion failure: GetReadFB() == 0, at /builds/worker/workspace/build/src/gfx/gl/GLScreenBuffer.cpp:692
0:41.01 INFO: #01: ???[/tmp/tmpg4aOhl/firefox/libxul.so +0x14bb5a7]
[...]

---

12 months later, debug build from today. Same crash: "Assertion failure: GetReadFB() == 0"

mozregression --launch 2019-06-27 --pref layers.acceleration.force-enabled:true gfx.webrender.force-disabled:true gfx.use-glx-texture-from-pixmap:true -a https://webglsamples.org/aquarium/aquarium.html -B debug

0:52.43 INFO: [GLX] window d400010 has VisualID 0x17b
0:52.44 INFO: [GPU 14646, Compositor] WARNING: robust_buffer_access_behavior marked as unsupported: file /builds/worker/workspace/build/src/gfx/gl/GLContextFeatures.cpp, line 623
[...]
0:52.50 INFO: [14611, Main Thread] WARNING: Attempting to get a displayport from a content with no primary frame!: file /builds/worker/workspace/build/src/layout/base/nsLayoutUtils.cpp, line 848
[...]
0:53.23 INFO: [Parent 14611, Main Thread] WARNING: Need BrowserChild to get the nativeWindow from!: file /builds/worker/workspace/build/src/widget/PuppetWidget.cpp, line 1096
[...]
0:53.71 INFO: [Child 14691, Main Thread] WARNING: Fallback to BasicLayerManager: file /builds/worker/workspace/build/src/dom/ipc/BrowserChild.cpp, line 2637
0:53.71 INFO: [Child 14691, Main Thread] WARNING: No active window: file /builds/worker/workspace/build/src/js/xpconnect/src/XPCJSContext.cpp, line 662
[...]
0:56.09 INFO: [Parent 14611, Main Thread] WARNING: Cannot set transparency mode on non-popup windows.: file /builds/worker/workspace/build/src/widget/gtk/nsWindow.cpp, line 4373
0:56.54 INFO: [Parent 14611, Main Thread] WARNING: Cannot set transparency mode on non-popup windows.: file /builds/worker/workspace/build/src/widget/gtk/nsWindow.cpp, line 4373
0:57.05 INFO: [Parent 14611, Main Thread] WARNING: Attempt to Lock a texture that is being read by the compositor!: file /builds/worker/workspace/build/src/gfx/layers/client/TextureClient.cpp, line 656
0:57.13 INFO: [Parent 14611, Main Thread] WARNING: Cannot set transparency mode on non-popup windows.: file /builds/worker/workspace/build/src/widget/gtk/nsWindow.cpp, line 4373
[...]
0:57.50 INFO: [Child 14716, Main Thread] WARNING: GLX_swap_control unsupported, ASAP mode may still block on buffer swaps.: file /builds/worker/workspace/build/src/gfx/gl/GLContextProviderGLX.cpp, line 217
0:57.52 INFO: [Child 14716, Main Thread] WARNING: robust_buffer_access_behavior marked as unsupported: file /builds/worker/workspace/build/src/gfx/gl/GLContextFeatures.cpp, line 623
[...]
0:57.84 INFO: Assertion failure: GetReadFB() == 0, at /builds/worker/workspace/build/src/gfx/gl/GLScreenBuffer.cpp:565

---

Comment 2

[Calixte Denizet (:calixte)]

The crash number spiked in build 20190628161248 and the pushlog is:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=741452096055&tochange=8537d24d8aa8

Maybe it could be related to patches for bug 1561178.
:mattwoodrow, could you have a look please?

Comment 3

[Darkspirit]

There is an older bug with this signature: bug 1473600

Comment 4

[Marcia Knous [:marcia]]

I filed Bug 1562616 - I think that might be the Mac specific signature for this bug.

Comment 5

[Darkspirit]

(In reply to Marcia Knous [:marcia - needinfo? me] from comment #4)

for this bug.

GLX is X11-only. This pref is disabled by default. bug 1562616 should be different?

Comment 6

[Marcia Knous [:marcia]]

I think we need to retriage this - beta 3 has a significant amount of crashes (over 1800).

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Changing the priority to p1 as the bug is tracked by a release manager for the current beta.
See What Do You Triage for more information

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Yeah, this is exploding on Beta69. I think this needs to block unthrottling :(

Comment 9

[Jessie [:jbonisteel] pls NI]

I suspect the fix for bug 1562616 will help here, too

Comment 11

[Darkspirit]

Nothing was fixed nor verified. Beginning with comment 2 offtopic was added.
bp-d5df3b4c-a850-49c4-9335-b0ee30190715

Comment 12

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Comment 13

[Darkspirit]

Closing my irrelevant bug for now.
This was solved for Mesa by bug 1572697. bug 1580166 follows for X11. It works like a charm.
Proprietary Nvidia probably won't have this enhancement until Nvidia supports DMABUF. (bug 1129492 comment 24: "Remove X11 connections from content processes in all cases, for security")