1688296 - Assertion failure: [GFX1]: Texture deallocated too late during shutdown, at /builds/worker/checkouts/gecko/gfx/2d/Logging.h:754

Status: NEW

(Core :: Graphics: Canvas2D, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev a2507ffc9d4d (built with --enable-debug).

    #0 0x7f6c853c823f in mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::WriteLog(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /builds/worker/checkouts/gecko/gfx/2d/Logging.h:755:9
    #1 0x7f6c853c814e in mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::Flush() /builds/worker/checkouts/gecko/gfx/2d/Logging.h:277:7
    #2 0x7f6c85511da1 in ~Log /builds/worker/workspace/obj-build/dist/include/mozilla/gfx/Logging.h:270:12
    #3 0x7f6c85511da1 in mozilla::layers::DeallocateTextureClient(mozilla::layers::TextureDeallocParams) /builds/worker/checkouts/gecko/gfx/layers/client/TextureClient.cpp:524:7
    #4 0x7f6c85512da8 in mozilla::layers::TextureClient::Destroy() /builds/worker/checkouts/gecko/gfx/layers/client/TextureClient.cpp:626:5
    #5 0x7f6c85514807 in mozilla::layers::TextureClient::~TextureClient() /builds/worker/checkouts/gecko/gfx/layers/client/TextureClient.cpp:804:3
    #6 0x7f6c85514d1b in mozilla::layers::TextureClient::~TextureClient() /builds/worker/checkouts/gecko/gfx/layers/client/TextureClient.cpp:799:33
    #7 0x7f6c854eb5ac in mozilla::AtomicRefCountedWithFinalize<mozilla::layers::TextureClient>::Release() /builds/worker/workspace/obj-build/dist/include/mozilla/layers/AtomicRefCountedWithFinalize.h:152:7
    #8 0x7f6c8579e213 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50:40
    #9 0x7f6c8579e213 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381:36
    #10 0x7f6c8579e213 in ~RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:81:7
    #11 0x7f6c8579e213 in ~TextureClientHolder /builds/worker/checkouts/gecko/gfx/layers/client/TextureClientRecycleAllocator.cpp:20:34
    #12 0x7f6c8579e213 in mozilla::layers::TextureClientHolder::Release() /builds/worker/checkouts/gecko/gfx/layers/client/TextureClientRecycleAllocator.cpp:23:3
    #13 0x7f6c857942ef in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50:40
    #14 0x7f6c857942ef in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381:36
    #15 0x7f6c857942ef in ~RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:81:7
    #16 0x7f6c857942ef in mozilla::layers::TextureClientRecycleAllocator::RecycleTextureClient(mozilla::layers::TextureClient*) /builds/worker/checkouts/gecko/gfx/layers/client/TextureClientRecycleAllocator.cpp:243:1
    #17 0x7f6c854eb32a in mozilla::AtomicRefCountedWithFinalize<mozilla::layers::TextureClient>::Release() /builds/worker/workspace/obj-build/dist/include/mozilla/layers/AtomicRefCountedWithFinalize.h:159:7
    #18 0x7f6c855bbc9f in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50:40
    #19 0x7f6c855bbc9f in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381:36
    #20 0x7f6c855bbc9f in ~RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:81:7
    #21 0x7f6c855bbc9f in mozilla::layers::SharedPlanarYCbCrImage::~SharedPlanarYCbCrImage() /builds/worker/checkouts/gecko/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp:44:1
    #22 0x7f6c855bbd6b in mozilla::layers::SharedPlanarYCbCrImage::~SharedPlanarYCbCrImage() /builds/worker/checkouts/gecko/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp:42:51
    #23 0x7f6c878fb200 in Release /builds/worker/workspace/obj-build/dist/include/ImageContainer.h:99:3
    #24 0x7f6c878fb200 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50:40
    #25 0x7f6c878fb200 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381:36
    #26 0x7f6c878fb200 in ~RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:81:7
    #27 0x7f6c878fb200 in mozilla::VP8TrackEncoder::~VP8TrackEncoder() /builds/worker/checkouts/gecko/dom/media/encoder/VP8TrackEncoder.cpp:49:1
    #28 0x7f6c878fb260 in mozilla::VP8TrackEncoder::~VP8TrackEncoder() /builds/worker/checkouts/gecko/dom/media/encoder/VP8TrackEncoder.cpp:46:37
    #29 0x7f6c878ed748 in Release /builds/worker/workspace/obj-build/dist/include/TrackEncoder.h:58:3
    #30 0x7f6c878ed748 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50:40
    #31 0x7f6c878ed748 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381:36
    #32 0x7f6c878ed748 in ~RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:81:7
    #33 0x7f6c878ed748 in mozilla::MediaEncoder::~MediaEncoder() /builds/worker/checkouts/gecko/dom/media/encoder/MediaEncoder.cpp:416:1
    #34 0x7f6c87764635 in mozilla::MediaEncoder::Release() /builds/worker/workspace/obj-build/dist/include/MediaEncoder.h:112:3
    #35 0x7f6c87756513 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50:40
    #36 0x7f6c87756513 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381:36
    #37 0x7f6c87756513 in ~RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:81:7
    #38 0x7f6c87756513 in mozilla::dom::MediaRecorder::Session::~Session() /builds/worker/checkouts/gecko/dom/media/MediaRecorder.cpp:976:3
    #39 0x7f6c877568cb in mozilla::dom::MediaRecorder::Session::~Session() /builds/worker/checkouts/gecko/dom/media/MediaRecorder.cpp:971:22
    #40 0x7f6c8776711d in Release /builds/worker/checkouts/gecko/dom/media/MediaRecorder.cpp:583:3
    #41 0x7f6c8776711d in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50:40
    #42 0x7f6c8776711d in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381:36
    #43 0x7f6c8776711d in ~RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:81:7
    #44 0x7f6c8776711d in ~Blocker /builds/worker/checkouts/gecko/dom/media/MediaRecorder.cpp:1063:11
    #45 0x7f6c8776711d in mozilla::dom::MediaRecorder::Session::InitEncoder(unsigned char, int)::Blocker::~Blocker() /builds/worker/checkouts/gecko/dom/media/MediaRecorder.cpp:1063:11
    #46 0x7f6c87b86471 in mozilla::media::ShutdownBlocker::Release() /builds/worker/checkouts/gecko/dom/media/systemservices/MediaUtils.cpp:28:1
    #47 0x7f6c83fb033e in ~nsCOMPtr_base /builds/worker/checkouts/gecko/xpcom/base/nsCOMPtr.h:328:7
    #48 0x7f6c83fb033e in mozilla::SegmentedVector<nsCOMPtr<nsISupports>, 4096ul, mozilla::MallocAllocPolicy>::SegmentImpl<509ul>::~SegmentImpl() /builds/worker/workspace/obj-build/dist/include/mozilla/SegmentedVector.h:78:21
    #49 0x7f6c83fb0142 in mozilla::SegmentedVector<nsCOMPtr<nsISupports>, 4096ul, mozilla::MallocAllocPolicy>::PopLastN(unsigned int) /builds/worker/workspace/obj-build/dist/include/mozilla/SegmentedVector.h:246:14
    #50 0x7f6c83f94f27 in mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/BindingUtils.h:2737:15
    #51 0x7f6c83f9574b in mozilla::IncrementalFinalizeRunnable::ReleaseNow(bool) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSRuntime.cpp:1630:17
    #52 0x7f6c83f95d9d in mozilla::CycleCollectedJSRuntime::FinalizeDeferredThings(mozilla::CycleCollectedJSContext::DeferredFinalizeType) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSRuntime.cpp:1706:24
    #53 0x7f6c83f933cd in mozilla::CycleCollectedJSRuntime::OnGC(JSContext*, JSGCStatus, JS::GCReason) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSRuntime.cpp:1776:7
    #54 0x7f6c8a943bdd in js::gc::GCRuntime::maybeCallGCCallback(JSGCStatus, JS::GCReason) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:7248:3
    #55 0x7f6c8a944659 in ~AutoCallGCCallbacks /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:7227:32
    #56 0x7f6c8a944659 in js::gc::GCRuntime::gcCycle(bool, js::SliceBudget, mozilla::Maybe<JSGCInvocationKind> const&, JS::GCReason) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:7323:1
    #57 0x7f6c8a945608 in js::gc::GCRuntime::collect(bool, js::SliceBudget, mozilla::Maybe<JSGCInvocationKind> const&, JS::GCReason) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:7520:9
    #58 0x7f6c8a94bf21 in gc /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:7596:3
    #59 0x7f6c8a94bf21 in JS::NonIncrementalGC(JSContext*, JSGCInvocationKind, JS::GCReason) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:8474:21
    #60 0x7f6c83fbfc5c in nsCycleCollector::FixGrayBits(bool, TimeLog&) /builds/worker/checkouts/gecko/xpcom/base/nsCycleCollector.cpp:3279:19
    #61 0x7f6c83fc07d8 in nsCycleCollector::BeginCollection(ccType, nsICycleCollectorListener*) /builds/worker/checkouts/gecko/xpcom/base/nsCycleCollector.cpp:3586:3
    #62 0x7f6c83fc0385 in nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*, bool) /builds/worker/checkouts/gecko/xpcom/base/nsCycleCollector.cpp:3414:9
    #63 0x7f6c83fc0147 in nsCycleCollector::ShutdownCollect() /builds/worker/checkouts/gecko/xpcom/base/nsCycleCollector.cpp:3357:20
    #64 0x7f6c83fc1356 in nsCycleCollector::Shutdown(bool) /builds/worker/checkouts/gecko/xpcom/base/nsCycleCollector.cpp:3652:5
    #65 0x7f6c83fc2e12 in nsCycleCollector_shutdown(bool) /builds/worker/checkouts/gecko/xpcom/base/nsCycleCollector.cpp:3967:18
    #66 0x7f6c840dd132 in mozilla::ShutdownXPCOM(nsIServiceManager*) /builds/worker/checkouts/gecko/xpcom/build/XPCOMInit.cpp:717:3
    #67 0x7f6c89f3364c in XRE_TermEmbedding() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:212:3
    #68 0x7f6c849b772e in mozilla::ipc::ScopedXREEmbed::Stop() /builds/worker/checkouts/gecko/ipc/glue/ScopedXREEmbed.cpp:90:5
    #69 0x7f6c89f33d42 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:737:16
    #70 0x55cf69122f26 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #71 0x55cf69122f26 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:306:18
    #72 0x7f6c98e0c0b2 in __libc_start_main /build/glibc-ZN95T4/glibc-2.31/csu/../csu/libc-start.c:308:16

Comment 1

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210122212755-5dc361e890c3.
Failed to bisect testcase (Testcase reproduces on start build!):

Start: f7f534f08b4827c90ed4ec421c14355cb81dfaaa (20200125094527)
End: a6b9acc070e90823268b73db5bd5d62b286b2ffa (20210122043737)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False)

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
The bug appears to have been fixed in the following build range:

Start: 1c9c0c0c5fd05a1cf1eb611fbfa90de4953d4273 (20210211130440)
End: af570005d5939fe037c87a285856597ba502a95b (20210211134312)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=1c9c0c0c5fd05a1cf1eb611fbfa90de4953d4273&tochange=af570005d5939fe037c87a285856597ba502a95b
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.