Closed Bug 1600595 Opened 3 months ago Closed 2 months ago

Crash in [@ mozilla::layers::ImageBridgeParent::RecvReadbackAsyncPluginSurface]

Categories

(Core :: Graphics: Layers, defect, P1)

Unspecified
Windows 10
defect

Tracking

()

VERIFIED FIXED
mozilla73
Tracking Status
firefox-esr68 --- unaffected
firefox71 --- unaffected
firefox72 + verified
firefox73 + verified

People

(Reporter: pascalc, Assigned: handyman)

References

(Regression)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(5 files, 1 obsolete file)

This bug is for crash report bp-9db236e3-3959-41e6-a7a5-8af210191202.

Top 10 frames of crashing thread:

0 xul.dll mozilla::layers::ImageBridgeParent::RecvReadbackAsyncPluginSurface gfx/layers/ipc/ImageBridgeParent.cpp:592
1 xul.dll mozilla::layers::PImageBridgeParent::OnMessageReceived ipc/ipdl/PImageBridgeParent.cpp:866
2 xul.dll void mozilla::ipc::MessageChannel::DispatchSyncMessage ipc/glue/MessageChannel.cpp:2177
3 xul.dll void mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:2126
4 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:2003
5 xul.dll MessageLoop::DoWork ipc/chromium/src/base/message_loop.cc:523
6 xul.dll void base::MessagePumpForUI::DoRunLoop ipc/chromium/src/base/message_pump_win.cc:203
7 xul.dll base::MessagePumpWin::Run ipc/chromium/src/base/message_pump_win.h:79
8 xul.dll void MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:308
9 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:290

We have crashes on Nightly since November 22

David, does it fall into your bucket?

Flags: needinfo?(davidp99)

Crashes started in 72 in 20191121214422 . Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=76e20a306bc262843ec06d59c54416131af030cb&tochange=2c912e46295e4f8a3fa5824a7f378e06760ec7dd. Looks like Bug 1577336 is in that changeset.

Regressed by: 1577336

Bug 1598680 comment 10 mentions that this can be reproduced occasionally with tab drag-and-drop. I haven't seen that yet but it as repro it is better than nothing.

Assignee: nobody → davidp99
Flags: needinfo?(davidp99)

Hi,

I have managed to reproduce the issue on latest Nightly 73.0a1 (2019-12-02), but I got a different crash signature from the description.
Here is my crash report: https://crash-stats.mozilla.org/report/index/fd2f05b2-44b8-44bd-99b9-d27450191203
Based on comment 2, I will remove the regressionwindow-wanted keyword.

Thanks.

That's the signature from bug 1600032 which is at least related.

Through some luck reproducing this in the debugger, I've narrowed this to graphics operations happening on the wrong thread. The implementation of RecvReadback.... uses gfx::Factory methods that aren't thread safe here as they pair the Compositor thread and the wrong DX device. I'm going to reimplement it to use the D3D11TextureData more directly like the rest of the Recv plugin methods there.

Priority: -- → P1

ISurfaceAllocator was introduced in bug 1272018 as a planned replacement for SurfaceAllocator. They are essentially the same interface. This patch removes SurfaceAllocator.

The only reason BufferTexture needs a LayersIPCChannel instead of the IShmemAllocator base interface is that it needs to know if the allocator is cross-process or not. Both LayersIPCChannel and ISurfaceAllocator use IsSameProcess() for this but without a common interface for it. Rather than further complicate the inheritance diagram for the layers and IPDL core classes, this patch makes BufferTexture handle both with generic code.

Depends on D56224

Currently plugin readback, which happens in a number of cases including sometimes when tabs are dragged and dropped, crashes due to failed graphics operations. One of the reasons for this is that graphics operations are happening on the Compositor thread of the compositor process but they are using incompatible DX devices from gfx::Factory. This patch properly uses the device context.

Depends on D56225

Attachment #9114219 - Attachment description: Bug 1600595: Part 1 - Consolidate SurfaceAllocator and ISurfaceAllocator into one class → Bug 1600595: Part 1 - Consolidate ShmemAllocator and IShmemAllocator into one class

These patches fix this bug -- they will be folded into the coming replacement for the backed-out patches in bug 1577336.

Attachment #9114219 - Attachment description: Bug 1600595: Part 1 - Consolidate ShmemAllocator and IShmemAllocator into one class → Bug 1600595: Part 1 - Consolidate ShmemAllocator and IShmemAllocator into one class r=nical!
Attachment #9114220 - Attachment description: Bug 1600595: Part 2 - Change BufferTexture to allow any IShmemAllocator owner → Bug 1600595: Part 2 - Change BufferTexture to allow any IShmemAllocator owner r=mattwoodrow!
Attachment #9114223 - Attachment description: Bug 1600595: Part 3 - Perform plugin surface readback using correct DirectX device → Bug 1600595: Part 3 - Perform plugin surface readback using correct DirectX device r=mattwoodrow!

Reproducible on latest Nightly 73.0a1 (Build id: 20191208213628) and Beta 72.0b3.
Verified - fixed on latest Beta 72.0b4 (Build id: 20191206183317).

CreateBGRA8DataSourceSurfaceForD3D11Texture is added to create a CPU texture with the same data as the given D3D11 texture. ReadbackTexture reads a D3D11 texture into a pre-existing CPU texture. ToPixelFormat is extended to cover DXGI_FORMAT values.

Depends on D56225

Refactor D3D11ShareHandleImage::GetAsSourceSurface to use the new utility method added in Part 3.

Depends on D57562

Attachment #9114223 - Attachment is obsolete: true

Use the new utility function, introduced in Part 3, to implement async plugin surface's read to CPU texture.

Depends on D57563

Attachment #9116748 - Attachment description: Bug 1600595: Part 5 - Make RecvReadbackAsyncPluginSurface use ReadbackTexture r=mattwoodrow! → Bug 1600595: Part 5 - Make RecvReadbackAsyncPluginSurface use ReadbackSharedTexture r=mattwoodrow!
Pushed by daparks@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/27fd9a1b31f0
Part 1 - Consolidate ShmemAllocator and IShmemAllocator into one class r=nical
https://hg.mozilla.org/integration/autoland/rev/c497070467dd
Part 2 - Change BufferTexture to allow any IShmemAllocator owner r=mattwoodrow
https://hg.mozilla.org/integration/autoland/rev/e905d5af4919
Part 3 - Add D3D11 utilities for creating CPU textures and converting format enums r=jrmuizel
https://hg.mozilla.org/integration/autoland/rev/c6712886b650
Part 4 - Make D3D11ShareHandleImage use CreateBGRA8DataSourceSurfaceForD3D11Texture r=mattwoodrow
https://hg.mozilla.org/integration/autoland/rev/2f3a6a8e47bc
Part 5 - Make RecvReadbackAsyncPluginSurface use ReadbackSharedTexture r=mattwoodrow

Thanks. I've got a fix for this that is passing tests. I'll make sure it passes that one, too. The issue is that the retry command in patch 3 creates a source texture that lacks a lock, which causes the retry to abort without finishing, which causes the test to fail to complete.

Flags: needinfo?(davidp99)
Attachment #9116748 - Attachment description: Bug 1600595: Part 5 - Make RecvReadbackAsyncPluginSurface use ReadbackSharedTexture r=mattwoodrow! → Bug 1600595: Part 5 - Make RecvReadbackAsyncPluginSurface use ReadbackTexture r=mattwoodrow!
Pushed by daparks@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/40a8f46b2286
Part 1 - Consolidate ShmemAllocator and IShmemAllocator into one class r=nical
https://hg.mozilla.org/integration/autoland/rev/164a412c769b
Part 2 - Change BufferTexture to allow any IShmemAllocator owner r=mattwoodrow
https://hg.mozilla.org/integration/autoland/rev/0438a77d10b1
Part 3 - Add D3D11 utilities for creating CPU textures and converting format enums r=jrmuizel
https://hg.mozilla.org/integration/autoland/rev/be48fa6b35ed
Part 4 - Make D3D11ShareHandleImage use CreateBGRA8DataSourceSurfaceForD3D11Texture r=mattwoodrow
https://hg.mozilla.org/integration/autoland/rev/6948b162ef2e
Part 5 - Make RecvReadbackAsyncPluginSurface use ReadbackTexture r=mattwoodrow

Verified - Fixed in our latest Nightly 73.0a1 (Build id: 20200105214143) using Windows 10.

Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.