1875272 - Crash in [@ mozilla::layers::CanvasTranslator::SetDataSurfaceBuffer]

Status: RESOLVED FIXED

(Core :: Graphics: Canvas2D, defect)

Description

[Andrew Osmond [:aosmond] (he/him)]

Crash report: https://crash-stats.mozilla.org/report/index/2c6b44cc-8646-4639-ad91-4312e0240115

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT(mHeader->readerState == State::Paused)

Top 10 frames of crashing thread:

0  libxul.so  mozilla::layers::CanvasTranslator::SetDataSurfaceBuffer  gfx/layers/ipc/CanvasTranslator.cpp:278
1  libxul.so  mozilla::detail::RunnableMethodArguments<mozilla::UniquePtr<int, mozilla::detail::FileHandleDeleter>&&, unsigned long>::apply<mozilla::layers::CanvasTranslator, void  const  xpcom/threads/nsThreadUtils.h:1164
1  libxul.so  std::__invoke_impl<void, mozilla::detail::RunnableMethodArguments<mozilla::UniquePtr<int, mozilla::detail::FileHandleDeleter>&&, unsigned long>::apply<mozilla::layers::CanvasTranslator, void   /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/include/c++/8/bits/invoke.h:60
1  libxul.so  std::__invoke<mozilla::detail::RunnableMethodArguments<mozilla::UniquePtr<int, mozilla::detail::FileHandleDeleter>&&, unsigned long>::apply<mozilla::layers::CanvasTranslator, void   /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/include/c++/8/bits/invoke.h:95
1  libxul.so  std::__apply_impl<mozilla::detail::RunnableMethodArguments<mozilla::UniquePtr<int, mozilla::detail::FileHandleDeleter>&&, unsigned long>::apply<mozilla::layers::CanvasTranslator, void   /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/include/c++/8/tuple:1678
1  libxul.so  std::apply<mozilla::detail::RunnableMethodArguments<mozilla::UniquePtr<int, mozilla::detail::FileHandleDeleter>&&, unsigned long>::apply<mozilla::layers::CanvasTranslator, void   /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/include/c++/8/tuple:1687
1  libxul.so  mozilla::detail::RunnableMethodArguments<mozilla::UniquePtr<int, mozilla::detail::FileHandleDeleter>&&, unsigned long>::apply<mozilla::layers::CanvasTranslator, void   xpcom/threads/nsThreadUtils.h:1162
1  libxul.so  mozilla::detail::RunnableMethodImpl<mozilla::layers::CanvasTranslator*, void   xpcom/threads/nsThreadUtils.h:1213
2  libxul.so  nsThread::ProcessNextEvent  xpcom/threads/nsThread.cpp:1193
2  libxul.so  NS_ProcessNextEvent  xpcom/threads/nsThreadUtils.cpp:480

Comment 1

[Andrew Osmond [:aosmond] (he/him)]

This still seems to be happening....any ideas? Crashing the parent process is a bad idea. Probably better to take away accelerated canvas if we can't figure it out, and change it to a MOZ_DIAGNOSTIC_ASSERT?

Comment 2

[Andrew Osmond [:aosmond] (he/him)]

We use the parent process on Linux/OSX/Android with DrawTargetWebgl. Only seeing the crashes on Linux right now.

Comment 3

[Andrew Osmond [:aosmond] (he/him)]

https://crash-stats.mozilla.org/report/index/d3663168-d82d-423a-9073-f200d0240120

Critical log is:
"|[G0][GFX1-]: [D3D11] 2 CreateTexture2D failure Size: Size(1,1)texture11: false Code: 0x8007000e (t=87137.3) |[G1][GFX1-]: GFX: CanvasTranslator failed to get device (t=87137.3) |[G2][GFX1-]: CanvasTranslator::SetDataSurfaceBuffer bad state 0 (t=87137.3) "

which means the state is Processing
https://searchfox.org/mozilla-central/rev/85679f95a634d08307e115fb365ea287198bd4d2/gfx/layers/CanvasDrawEventRecorder.h#37

I'm not sure I believe it. Make we should add an Invalid state to occupy 0 so that we should never see it.

Comment 4

[Bob Owen (:bobowen)]

(In reply to Andrew Osmond [:aosmond] (he/him) from comment #3)

https://crash-stats.mozilla.org/report/index/d3663168-d82d-423a-9073-f200d0240120

Critical log is:
"|[G0][GFX1-]: [D3D11] 2 CreateTexture2D failure Size: Size(1,1)texture11: false Code: 0x8007000e (t=87137.3) |[G1][GFX1-]: GFX: CanvasTranslator failed to get device (t=87137.3) |[G2][GFX1-]: CanvasTranslator::SetDataSurfaceBuffer bad state 0 (t=87137.3) "

which means the state is Processing
https://searchfox.org/mozilla-central/rev/85679f95a634d08307e115fb365ea287198bd4d2/gfx/layers/CanvasDrawEventRecorder.h#37

I'm not sure I believe it. Make we should add an Invalid state to occupy 0 so that we should never see it.

I think this must be:

• This create texture failing apparently on OOM.
• Which is the failure to create the reference texture in this where we get the current device, because we don't have one.
• However we've already set the header and the reader state starts as Processing

So, I think that actually we should start the reader state as Paused, because that means we won't try and start it from the writer as we know we've sent the message to start it. This is consistent with the use for SetDataSurfaceBuffer and AddBuffer.
We should also set it to Failed when the device check fails or actually probably in CreateReferenceTexture whenever we return false.

Comment 5

[Bob Owen (:bobowen)]

Attachment: Bug 1875272: Deactivate remote canvas if reference texture create fails. r=#gfx-reviewers,aosmond

Depends on D199222

Comment 6

[Bob Owen (:bobowen)]

https://treeherder.mozilla.org/jobs?repo=try&duplicate_jobs=visible&revision=d5bbdb3f79877c3d5677eac518f77a61992ced60

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a3d6b7811061
Deactivate remote canvas if reference texture create fails. r=aosmond,gfx-reviewers

Comment 8

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/a3d6b7811061

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:bobowen, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox123 to wontfix.

For more information, please visit BugBot documentation.

Comment 10

[Bob Owen (:bobowen)]

Comment on attachment 9375767 [details]
Bug 1875272: Deactivate remote canvas if reference texture create fails. r=#gfx-reviewers,aosmond

Beta/Release Uplift Approval Request

• User impact if declined: This is a diagnostic crash, but this fix not only catches the issue earlier and behaves more gracefully, it also seems to have improved the crashes for bug 1875656.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Change mainly consists of deactivating remote canvas more consistently when an unrecoverable error has occurred.
• String changes made/needed: None
• Is Android affected?: Yes

Comment 11

[Pascal Chevrel:pascalc]

Comment on attachment 9375767 [details]
Bug 1875272: Deactivate remote canvas if reference texture create fails. r=#gfx-reviewers,aosmond

Approved for 123 beta 4, thanks.

Comment 12

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/ffb98b9c0703

Comment 13

[Pascal Chevrel:pascalc]

https://hg.mozilla.org/releases/mozilla-beta/rev/ffb98b9c0703