1786440 - Assertion failure: CompositorThreadHolder::IsInCompositorThread(), at /builds/worker/checkouts/gecko/gfx/layers/RemoteTextureMap.cpp:281

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20220819-c9c314795ae8 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: CompositorThreadHolder::IsInCompositorThread(), at /builds/worker/checkouts/gecko/gfx/layers/RemoteTextureMap.cpp:281

#0 0x7f8e8326f1a6 in mozilla::layers::RemoteTextureMap::UnregisterTextureConsumer(mozilla::layers::RemoteTextureOwnerId, mozilla::layers::CompositableHandle const&, int) /builds/worker/checkouts/gecko/gfx/layers/RemoteTextureMap.cpp:281:3
#1 0x7f8e834e290a in operator() /builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h:459:5
#2 0x7f8e834e290a in reset /builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h:301:7
#3 0x7f8e834e290a in ~UniquePtr /builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h:249:18
#4 0x7f8e834e290a in mozilla::layers::WebRenderImageHost::~WebRenderImageHost() /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderImageHost.cpp:36:77
#5 0x7f8e834e2b6b in mozilla::layers::WebRenderImageHost::~WebRenderImageHost() /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderImageHost.cpp:36:43
#6 0x7f8e83530741 in Release /builds/worker/workspace/obj-build/dist/include/CompositableHost.h:68:3
#7 0x7f8e83530741 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50:40
#8 0x7f8e83530741 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381:36
#9 0x7f8e83530741 in ~RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:81:7
#10 0x7f8e83530741 in ~ /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderImageHost.cpp:117:25
#11 0x7f8e83530741 in _M_destroy /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:207:4
#12 0x7f8e83530741 in std::_Function_base::_Base_manager<mozilla::layers::WebRenderImageHost::UseRemoteTexture(mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, mozilla::layers::CompositableHandle const&, int, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits>, mozilla::layers::TextureFlags)::$_5>::_M_manager(std::_Any_data&, std::_Any_data const&, std::_Manager_operation) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:231:8
#13 0x7f8e832876ee in ~_Function_base /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:276:2
#14 0x7f8e832876ee in ~pair /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_pair.h:208:12
#15 0x7f8e832876ee in _Destroy<std::pair<mozilla::layers::RemoteTextureId, std::function<void (mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, int)> > > /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_construct.h:98:19
#16 0x7f8e832876ee in __destroy<std::pair<mozilla::layers::RemoteTextureId, std::function<void (mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, int)> > *> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_construct.h:108:6
#17 0x7f8e832876ee in _Destroy<std::pair<mozilla::layers::RemoteTextureId, std::function<void (mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, int)> > *> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_construct.h:136:7
#18 0x7f8e832876ee in _Destroy<std::pair<mozilla::layers::RemoteTextureId, std::function<void (mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, int)> > *, std::pair<mozilla::layers::RemoteTextureId, std::function<void (mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, int)> > > /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_construct.h:206:7
#19 0x7f8e832876ee in std::deque<std::pair<mozilla::layers::RemoteTextureId, std::function<void (mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, int)> >, std::allocator<std::pair<mozilla::layers::RemoteTextureId, std::function<void (mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, int)> > > >::_M_destroy_data_aux(std::_Deque_iterator<std::pair<mozilla::layers::RemoteTextureId, std::function<void (mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, int)> >, std::pair<mozilla::layers::RemoteTextureId, std::function<void (mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, int)> >&, std::pair<mozilla::layers::RemoteTextureId, std::function<void (mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, int)> >*>, std::_Deque_iterator<std::pair<mozilla::layers::RemoteTextureId, std::function<void (mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, int)> >, std::pair<mozilla::layers::RemoteTextureId, std::function<void (mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, int)> >&, std::pair<mozilla::layers::RemoteTextureId, std::function<void (mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, int)> >*>) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/deque.tcc:861:3
#20 0x7f8e83287218 in _M_destroy_data /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_deque.h:2072:4
#21 0x7f8e83287218 in std::deque<std::pair<mozilla::layers::RemoteTextureId, std::function<void (mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, int)> >, std::allocator<std::pair<mozilla::layers::RemoteTextureId, std::function<void (mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, int)> > > >::~deque() /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_deque.h:1045:9
#22 0x7f8e8327cc80 in ~queue /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_queue.h:96:11
#23 0x7f8e8327cc80 in ~TextureConsumer /builds/worker/workspace/obj-build/dist/include/mozilla/layers/RemoteTextureMap.h:214:10
#24 0x7f8e8327cc80 in operator() /builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h:459:5
#25 0x7f8e8327cc80 in reset /builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h:301:7
#26 0x7f8e8327cc80 in ~UniquePtr /builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h:249:18
#27 0x7f8e8327cc80 in ~pair /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_pair.h:208:12
#28 0x7f8e8327cc80 in destroy<std::pair<const std::pair<int, mozilla::layers::RemoteTextureOwnerId>, mozilla::UniquePtr<mozilla::layers::RemoteTextureMap::TextureConsumer, mozilla::DefaultDelete<mozilla::layers::RemoteTextureMap::TextureConsumer> > > > /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/ext/new_allocator.h:140:28
#29 0x7f8e8327cc80 in destroy<std::pair<const std::pair<int, mozilla::layers::RemoteTextureOwnerId>, mozilla::UniquePtr<mozilla::layers::RemoteTextureMap::TextureConsumer, mozilla::DefaultDelete<mozilla::layers::RemoteTextureMap::TextureConsumer> > > > /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/alloc_traits.h:487:8
#30 0x7f8e8327cc80 in _M_destroy_node /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_tree.h:650:2
#31 0x7f8e8327cc80 in _M_drop_node /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_tree.h:658:2
#32 0x7f8e8327cc80 in std::_Rb_tree<std::pair<int, mozilla::layers::RemoteTextureOwnerId>, std::pair<std::pair<int, mozilla::layers::RemoteTextureOwnerId> const, mozilla::UniquePtr<mozilla::layers::RemoteTextureMap::TextureConsumer, mozilla::DefaultDelete<mozilla::layers::RemoteTextureMap::TextureConsumer> > >, std::_Select1st<std::pair<std::pair<int, mozilla::layers::RemoteTextureOwnerId> const, mozilla::UniquePtr<mozilla::layers::RemoteTextureMap::TextureConsumer, mozilla::DefaultDelete<mozilla::layers::RemoteTextureMap::TextureConsumer> > > >, std::less<std::pair<int, mozilla::layers::RemoteTextureOwnerId> >, std::allocator<std::pair<std::pair<int, mozilla::layers::RemoteTextureOwnerId> const, mozilla::UniquePtr<mozilla::layers::RemoteTextureMap::TextureConsumer, mozilla::DefaultDelete<mozilla::layers::RemoteTextureMap::TextureConsumer> > > > >::_M_erase(std::_Rb_tree_node<std::pair<std::pair<int, mozilla::layers::RemoteTextureOwnerId> const, mozilla::UniquePtr<mozilla::layers::RemoteTextureMap::TextureConsumer, mozilla::DefaultDelete<mozilla::layers::RemoteTextureMap::TextureConsumer> > > >*) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_tree.h:1858:4
#33 0x7f8e832709c6 in ~_Rb_tree /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_tree.h:949:9
#34 0x7f8e832709c6 in ~map /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_map.h:294:22
#35 0x7f8e832709c6 in mozilla::layers::RemoteTextureMap::~RemoteTextureMap() /builds/worker/checkouts/gecko/gfx/layers/RemoteTextureMap.cpp:140:37
#36 0x7f8e83270866 in Assign /builds/worker/workspace/obj-build/dist/include/mozilla/StaticPtr.h:93:5
#37 0x7f8e83270866 in operator= /builds/worker/workspace/obj-build/dist/include/mozilla/StaticPtr.h:59:5
#38 0x7f8e83270866 in mozilla::layers::RemoteTextureMap::Shutdown() /builds/worker/checkouts/gecko/gfx/layers/RemoteTextureMap.cpp:134:15
#39 0x7f8e83560069 in gfxPlatform::ShutdownLayersIPC() /builds/worker/checkouts/gecko/gfx/thebes/gfxPlatform.cpp:1347:5
#40 0x7f8e82121248 in mozilla::ShutdownXPCOM(nsIServiceManager*) /builds/worker/checkouts/gecko/xpcom/build/XPCOMInit.cpp:598:5
#41 0x7f8e88ff7860 in ScopedXPCOMStartup::~ScopedXPCOMStartup() /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:2069:5
#42 0x7f8e89005a2a in operator() /builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h:459:5
#43 0x7f8e89005a2a in reset /builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h:301:7
#44 0x7f8e89005a2a in operator= /builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h:271:5
#45 0x7f8e89005a2a in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5940:16
#46 0x7f8e890061b9 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5975:21
#47 0x5610ce8ab32f in do_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:229:22
#48 0x5610ce8ab32f in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:433:16
#49 0x7f8e9891c082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
#50 0x5610ce8811cc in _start (/home/worker/builds/m-c-20220818232425-fuzzing-debug/firefox-bin+0x161cc) (BuildId: 5d4dfe11af5c030b9f4a240c79b6f791a6cf514c)

Comment 1

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220823024657-95412593f3f1.
The bug appears to have been introduced in the following build range:

Start: f089ee647e811f3c3e4e6346e92001e93ea6bbf5 (20220726195158)
End: e3ea81c6d654db2ac7bbcae3dfc4912339da9997 (20220726140355)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=f089ee647e811f3c3e4e6346e92001e93ea6bbf5&tochange=e3ea81c6d654db2ac7bbcae3dfc4912339da9997

Comment 2

[Sotaro Ikeda [:sotaro]]

Attachment: Bug 1786440 - Remove assert from RemoteTextureMap::UnregisterTextureConsumer()

Comment 3

[Sotaro Ikeda [:sotaro]]

Assert failure happens when RemoteTextureMap::UnregisterTextureConsumer() is called during shutdown. The assert could be removed since UnregisterTextureConsumer() works also on non-compositor thread. And the function is going to be removed by Bug 1781740.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/079d8864bca3
Remove assert from RemoteTextureMap::UnregisterTextureConsumer() r=gfx-reviewers,lsalzman

Comment 5

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/079d8864bca3

Comment 6

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Bug marked as FIXED but still reproduces on mozilla-central 20220824093620-d3dc65398cce. If you believe this to be incorrect, please remove the bugmon keyword to prevent further analysis.

Comment 7

[Tyson Smith [:tsmith]]

The test case new triggers bug 1783923. I'll add it over there.

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Based on comment #1, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.

:sotaro, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit auto_nag documentation.