1779570 - Intermittent SUMMARY: ThreadSanitizer: data race /builds/worker/checkouts/gecko/gfx/2d/DrawTargetSkia.cpp:1837:14 in mozilla::gfx::DrawTargetSkia::SetTransform(mozilla::gfx::BaseMatrix<float> const&)

Status: RESOLVED FIXED

(Core :: Graphics: Text, defect)

Description

Filed by: bszekely [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=384335177&repo=mozilla-central
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/TeKQmE0ST7Ww_QSnIrf4ug/runs/0/artifacts/public/logs/live_backing.log

---

task 2022-07-14T10:55:44.365Z] 10:55:44     INFO - TEST-START | /html/canvas/offscreen/text/2d.text.drawing.style.measure.textAlign.worker.html
[task 2022-07-14T10:55:44.442Z] 10:55:44     INFO - Closing window 762b975f-c02e-4fb6-8e4e-690c56af81a6
[task 2022-07-14T10:55:46.435Z] 10:55:46     INFO - PID 5295 | ==================
[task 2022-07-14T10:55:46.435Z] 10:55:46     INFO - PID 5295 | WARNING: ThreadSanitizer: data race (pid=5615)
[task 2022-07-14T10:55:46.445Z] 10:55:46     INFO - PID 5295 |   Write of size 8 at 0x7b3000001520 by main thread:
[task 2022-07-14T10:55:46.446Z] 10:55:46     INFO - PID 5295 |     #0 memcpy /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/../../sanitizer_common/sanitizer_common_interceptors.inc:827:5 (firefox+0x6824e) (BuildId: 470f711c5f2c1e008b825dd2c3dfc6d14b4e467b)
[task 2022-07-14T10:55:46.448Z] 10:55:46     INFO - PID 5295 |     #1 mozilla::gfx::DrawTargetSkia::SetTransform(mozilla::gfx::BaseMatrix<float> const&) /builds/worker/checkouts/gecko/gfx/2d/DrawTargetSkia.cpp:1837:14 (libxul.so+0x227584d) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
[task 2022-07-14T10:55:46.450Z] 10:55:46     INFO - PID 5295 |     #2 gfxContext::gfxContext(mozilla::gfx::DrawTarget*, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float> const&) /builds/worker/checkouts/gecko/gfx/thebes/gfxContext.cpp:62:8 (libxul.so+0x26e49f1) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
[task 2022-07-14T10:55:46.451Z] 10:55:46     INFO - PID 5295 |     #3 gfxContext::CreateOrNull(mozilla::gfx::DrawTarget*, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float> const&) /builds/worker/checkouts/gecko/gfx/thebes/gfxContext.cpp:74:35 (libxul.so+0x26de955) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
[task 2022-07-14T10:55:46.453Z] 10:55:46     INFO - PID 5295 |     #4 mozilla::PresShell::CreateReferenceRenderingContext() /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:3144:10 (libxul.so+0x5eaabac) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
[task 2022-07-14T10:55:46.454Z] 10:55:46     INFO - PID 5295 |     #5 mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9541:26 (libxul.so+0x5ea548d) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
[task 2022-07-14T10:55:46.456Z] 10:55:46     INFO - PID 5295 |     #6 mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9792:24 (libxul.so+0x5eb0aa7) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
[task 2022-07-14T10:55:46.457Z] 10:55:46     INFO - PID 5295 |     #7 mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4376:11 (libxul.so+0x5eafca8) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
[task 2022-07-14T10:55:46.458Z] 10:55:46     INFO - PID 5295 |     #8 FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1457:5 (libxul.so+0x5e6979e) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
[task 2022-07-14T10:55:46.460Z] 10:55:46     INFO - PID 5295 |     #9 nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2584:20 (libxul.so+0x5e6979e)
<...>
Previous read of size 4 at 0x7b3000001524 by thread T825 (mutexes: write M0):
  #0 GetTransform /builds/worker/workspace/obj-build/dist/include/mozilla/gfx/2D.h:1813:40 (libxul.so+0x26f1add) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
  #1 gfxFont::GetRoundOffsetsToPixels(mozilla::gfx::DrawTarget*) /builds/worker/checkouts/gecko/gfx/thebes/gfxFont.cpp:928:20 (libxul.so+0x26f1add)
  #2 bool gfxFont::SplitAndInitTextRun<char16_t>(mozilla::gfx::DrawTarget*, gfxTextRun*, char16_t const*, unsigned int, unsigned int, mozilla::intl::Script, nsAtom*, mozilla::gfx::ShapedTextFlags) /builds/worker/checkouts/gecko/gfx/thebes/gfxFont.cpp:3226:28 (libxul.so+0x26ffef5) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
  #3 void gfxFontGroup::InitScriptRun<char16_t>(mozilla::gfx::DrawTarget*, gfxTextRun*, char16_t const*, unsigned int, unsigned int, mozilla::intl::Script, gfxMissingFontRecorder*) /builds/worker/checkouts/gecko/gfx/thebes/gfxTextRun.cpp (libxul.so+0x277a051) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
  #4 void gfxFontGroup::InitTextRun<char16_t>(mozilla::gfx::DrawTarget*, gfxTextRun*, char16_t const*, unsigned int, gfxMissingFontRecorder*) /builds/worker/checkouts/gecko/gfx/thebes/gfxTextRun.cpp:2649:9 (libxul.so+0x275fb99) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
  #5 gfxFontGroup::MakeTextRun(char16_t const*, unsigned int, gfxTextRunFactory::Parameters const*, mozilla::gfx::ShapedTextFlags, nsTextFrameUtils::Flags, gfxMissingFontRecorder*) /builds/worker/checkouts/gecko/gfx/thebes/gfxTextRun.cpp:2525:3 (libxul.so+0x275f3ef) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
  #6 MakeTextRun<char16_t> /builds/worker/workspace/obj-build/dist/include/gfxTextRun.h:1003:12 (libxul.so+0x3e702bf) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
  #7 mozilla::dom::CanvasBidiProcessor::SetText(char16_t const*, int, mozilla::intl::BidiDirection) /builds/worker/checkouts/gecko/dom/canvas/CanvasRenderingContext2D.cpp:3883:26 (libxul.so+0x3e702bf)
  #8 nsBidiPresUtils::ProcessText(char16_t const*, unsigned long, mozilla::intl::BidiEmbeddingLevel, nsPresContext*, nsBidiPresUtils::BidiProcessor&, nsBidiPresUtils::Mode, nsBidiPositionResolve*, int, int*, mozilla::intl::Bidi*) /builds/worker/checkouts/gecko/layout/base/nsBidiPresUtils.cpp:2234:18 (libxul.so+0x5ef0249) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
  #9 mozilla::dom::CanvasRenderingContext2D::DrawOrMeasureText(nsTSubstring<char16_t> const&, float, float, mozilla::dom::Optional<double> const&, mozilla::dom::CanvasRenderingContext2D::TextDrawOperation, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/canvas/CanvasRenderingContext2D.cpp:4254:12 (libxul.so+0x3de36cf) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
  #10 mozilla::dom::CanvasRenderingContext2D::MeasureText(nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/canvas/CanvasRenderingContext2D.cpp:3739:10 (libxul.so+0x3de4089) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
  #11 mozilla::dom::OffscreenCanvasRenderingContext2D_Binding::measureText(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/OffscreenCanvasRenderingContext2DBinding.cpp:4019:78 (libxul.so+0x317665c) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
  #12 bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3285:13 (libxul.so+0x3d0872e) (BuildId: 75bd3a266a3ce18c16c6059b9fcb09efb391de01)
<...>
[task 2022-07-14T10:55:46.667Z] 10:55:46     INFO - PID 5295 | SUMMARY: ThreadSanitizer: data race /builds/worker/checkouts/gecko/gfx/2d/DrawTargetSkia.cpp:1837:14 in mozilla::gfx::DrawTargetSkia::SetTransform(mozilla::gfx::BaseMatrix<float> const&)

Comment 1

[Andrew McCreight [:mccr8]]

It looks like this is an off-main-thread read on a DOM worker thread, so maybe this is related to offscreen canvas?

Comment 2

[Andrew Osmond [:aosmond] (he/him)]

This code isn't exposed to WebIDL before 104, even for Zoom. It appears to be using the reference draw target/context from the pres shell on a worker, but it shouldn't have had access to the pres shell on a worker. Odd.

Comment 3

[Andrew Osmond [:aosmond] (he/him)]

Okay this is just using gfxPlatform::ScreenReferenceDrawTarget off the main thread. There are only a half dozen calls sites in the canvas/text code. We should use MOZ_THREAD_LOCAL to save some DrawTargets, perhaps with WeakWorkerRef so that we clean them up after.

Comment 4

[Andrew Osmond [:aosmond] (he/him)]

Attachment: Bug 1779570.

Comment 5

[Andrew Osmond [:aosmond] (he/him)]

This is a recent regression from bug 1746110, landed in 104. We can land this without sec-approval since no release branches are impacted.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1746110

Comment 7

[Andrew Osmond [:aosmond] (he/him)]

Attachment: Bug 1779570 - Fix hybrid builds.

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

r=jrmuizel
https://hg.mozilla.org/integration/autoland/rev/8fcdbac598aa0164316bc5f431082caeb2981ef2
https://hg.mozilla.org/mozilla-central/rev/8fcdbac598aa

Fix hybrid builds. r=gfx-reviewers,lsalzman
https://hg.mozilla.org/integration/autoland/rev/bcf1a9c73816421fd6f4e1bfd6edc140c67b6c07
https://hg.mozilla.org/mozilla-central/rev/bcf1a9c73816