Closed Bug 1991871 Opened 9 months ago Closed 8 months ago

WARNING: ThreadSanitizer: unlock of an unlocked mutex (or by a wrong thread) [ @gfxFcPlatformFontList::AddPatternToFontList]

Categories

(Core :: Graphics, defect, P3)

Product:
Core
Component:
Graphics
Type:
defect
Points:
1

Tracking

()

Status:
RESOLVED FIXED
Milestone:
146 Branch
Tracking Flags:
Tracking Status
firefox146 --- fixed

People

(Reporter: whimboo, Assigned: whimboo)

References

(Blocks 2 open bugs)

Details

(Whiteboard: [webdriver:m18])

Attachments

(1 file)

Bug 1991871 - [gfx] Use shared font list for Safe Mode as well.
48 bytes, text/x-phabricator-request
Details | Review

I can see this ThreadSanitizer issue all the time when running the Marionette test which is restarting Firefox in safe mode (see bug 1925308), but also with just starting Firefox with the --safe-mode argument.

Here is the full stack:

WARNING: ThreadSanitizer: unlock of an unlocked mutex (or by a wrong thread) (pid=106222)
    #0 pthread_mutex_unlock /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:1387:3 (firefox-bin+0xc664e) (BuildId: 220c74d5fb8ba86873f33d2387f44ef343cdc22c)
    #1 Release /builds/worker/checkouts/gecko/gfx/thebes/gfxFcPlatformFontList.h:38:41 (libxul.so+0x52198cb) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #2 Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:409:36 (libxul.so+0x52198cb)
    #3 assign_assuming_AddRef /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:68:7 (libxul.so+0x52198cb)
    #4 operator=<_FcPattern, void> /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:228:5 (libxul.so+0x52198cb)
    #5 Update<RefPtr<_FcPattern> > /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:754:14 (libxul.so+0x52198cb)
    #6 InsertOrUpdate<RefPtr<_FcPattern> > /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:799:9 (libxul.so+0x52198cb)
    #7 operator()<nsBaseHashtable<nsCStringHashKey, RefPtr<_FcPattern>, RefPtr<_FcPattern>, nsDefaultConverter<RefPtr<_FcPattern>, RefPtr<_FcPattern> > >::EntryHandle> /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:478:26 (libxul.so+0x52198cb)
    #8 operator()<nsTHashtable<nsBaseHashtableET<nsCStringHashKey, RefPtr<_FcPattern> > >::EntryHandle> /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:849:18 (libxul.so+0x52198cb)
    #9 operator()<PLDHashTable::EntryHandle> /builds/worker/workspace/obj-build/dist/include/nsTHashtable.h:439:18 (libxul.so+0x52198cb)
    #10 std::invoke_result<RefPtr<_FcPattern>, PLDHashTable::EntryHandle&&>::type PLDHashTable::WithEntryHandle<std::invoke_result<RefPtr<_FcPattern>, nsTHashtable<nsBaseHashtableET<nsCStringHashKey, RefPtr<_FcPattern>>>::EntryHandle&&>::type nsTHashtable<nsBaseHashtableET<nsCStringHashKey, RefPtr<_FcPattern>>>::WithEntryHandle<std::invoke_result<RefPtr<_FcPattern>, nsBaseHashtable<nsCStringHashKey, RefPtr<_FcPattern>, RefPtr<_FcPattern>, nsDefaultConverter<RefPtr<_FcPattern>, RefPtr<_FcPattern>>>::EntryHandle&&>::type nsBaseHashtable<nsCStringHashKey, RefPtr<_FcPattern>, RefPtr<_FcPattern>, nsDefaultConverter<RefPtr<_FcPattern>, RefPtr<_FcPattern>>>::WithEntryHandle<RefPtr<_FcPattern>& nsBaseHashtable<nsCStringHashKey, RefPtr<_FcPattern>, RefPtr<_FcPattern>, nsDefaultConverter<RefPtr<_FcPattern>, RefPtr<_FcPattern>>>::InsertOrUpdate<RefPtr<_FcPattern>>(nsTSubstring<char> const&, RefPtr<_FcPattern>&&)::'lambda'(RefPtr<_FcPattern>)>(nsTSubstring<char> const&, RefPtr<_FcPattern>&&)::'lambda'(RefPtr<_FcPattern>)>(nsTSubstring<char> const&, RefPtr<_FcPattern>&&)::'lambda'(RefPtr<_FcPattern>)>(void const*, RefPtr<_FcPattern>&&) /builds/worker/workspace/obj-build/dist/include/PLDHashTable.h:605:12 (libxul.so+0x52198cb)
    #11 WithEntryHandle<(lambda at /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:848:15)> /builds/worker/workspace/obj-build/dist/include/nsTHashtable.h:436:25 (libxul.so+0x521098c) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #12 WithEntryHandle<(lambda at /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:477:34)> /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:847:18 (libxul.so+0x521098c)
    #13 InsertOrUpdate<RefPtr<_FcPattern> > /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:477:12 (libxul.so+0x521098c)
    #14 gfxFcPlatformFontList::AddPatternToFontList(_FcPattern*, unsigned char*&, nsTSubstring<char>&, RefPtr<gfxFontconfigFontFamily>&, bool) /builds/worker/checkouts/gecko/gfx/thebes/gfxFcPlatformFontList.cpp:1538:19 (libxul.so+0x521098c)
    #15 gfxFcPlatformFontList::AddFontSetFamilies(_FcFontSet*, gfxFcPlatformFontList::SandboxPolicy const*, bool) /builds/worker/checkouts/gecko/gfx/thebes/gfxFcPlatformFontList.cpp:1443:5 (libxul.so+0x5210122) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #16 gfxFcPlatformFontList::InitFontListForPlatform() /builds/worker/checkouts/gecko/gfx/thebes/gfxFcPlatformFontList.cpp:1659:3 (libxul.so+0x5211261) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #17 gfxPlatformFontList::InitFontList() /builds/worker/checkouts/gecko/gfx/thebes/gfxPlatformFontList.cpp:710:9 (libxul.so+0x52b214d) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #18 gfxPlatformFontList::Initialize(gfxPlatformFontList*) /builds/worker/checkouts/gecko/gfx/thebes/gfxPlatformFontList.cpp:290:14 (libxul.so+0x52b1606) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #19 gfxPlatformGtk::CreatePlatformFontList() /builds/worker/checkouts/gecko/gfx/thebes/gfxPlatformGtk.cpp:427:10 (libxul.so+0x5233347) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #20 gfxPlatform::Init() /builds/worker/checkouts/gecko/gfx/thebes/gfxPlatform.cpp:989:19 (libxul.so+0x5222cc7) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #21 GetPlatform /builds/worker/workspace/obj-build/dist/include/gfxPlatform.h:189:7 (libxul.so+0x92f05b2) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #22 mozilla::widget::GfxInfoBase::GetContentBackend(nsTSubstring<char16_t>&) /builds/worker/checkouts/gecko/widget/GfxInfoBase.cpp:1932:25 (libxul.so+0x92f05b2)
    #23 NS_InvokeByIndex /builds/worker/checkouts/gecko/xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_x86_64_unix.S:101 (libxul.so+0x3b09bd5) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #24 GetAttribute /builds/worker/checkouts/gecko/js/xpconnect/src/xpcprivate.h:1450:12 (libxul.so+0x47bdbc8) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #25 XPC_WN_GetterSetter(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1006:10 (libxul.so+0x47bdbc8)
    #26 CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:490:13 (libxul.so+0xa680b4b) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #27 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:586:12 (libxul.so+0xa680b4b)
    #28 InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:653:10 (libxul.so+0xa6817f0) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #29 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:685:8 (libxul.so+0xa6817f0)
    #30 js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:807:10 (libxul.so+0xa6824cf) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #31 CallGetter /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2141:12 (libxul.so+0xa8999af) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #32 GetExistingProperty<(js::AllowGC)1> /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2169:12 (libxul.so+0xa8999af)
    #33 NativeGetPropertyInline<(js::AllowGC)1> /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2312:14 (libxul.so+0xa8999af)
    #34 js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2342:10 (libxul.so+0xa8999af)
    #35 GetElementOperationWithStackIndex /builds/worker/checkouts/gecko/js/src/vm/Interpreter-inl.h (libxul.so+0xa68d9ae) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #36 js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3066:12 (libxul.so+0xa68d9ae)
    #37 MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:384:10 (libxul.so+0xa6800a5) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #38 js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:460:13 (libxul.so+0xa6800a5)
    #39 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:618:13 (libxul.so+0xa680c30) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #40 InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:653:10 (libxul.so+0xa6817f0) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #41 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:685:8 (libxul.so+0xa6817f0)
    #42 js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:807:10 (libxul.so+0xa6824cf) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #43 CallGetter /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2141:12 (libxul.so+0xa8999af) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #44 GetExistingProperty<(js::AllowGC)1> /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2169:12 (libxul.so+0xa8999af)
    #45 NativeGetPropertyInline<(js::AllowGC)1> /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2312:14 (libxul.so+0xa8999af)
    #46 js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2342:10 (libxul.so+0xa8999af)
    #47 GetProperty /builds/worker/checkouts/gecko/js/src/vm/ObjectOperations-inl.h:113:10 (libxul.so+0xa698a1f) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #48 GetProperty /builds/worker/checkouts/gecko/js/src/vm/ObjectOperations-inl.h:120:10 (libxul.so+0xa698a1f)
    #49 js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:4620:10 (libxul.so+0xa698a1f)
    #50 js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:2931:12 (libxul.so+0xa68c181) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #51 MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:384:10 (libxul.so+0xa6800a5) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #52 js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:460:13 (libxul.so+0xa6800a5)
    #53 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:618:13 (libxul.so+0xa680c30) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #54 InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:653:10 (libxul.so+0xa6817f0) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #55 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:685:8 (libxul.so+0xa6817f0)
    #56 JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:55:10 (libxul.so+0xa72ebd9) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #57 nsXPCWrappedJS::CallMethod(unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) /builds/worker/checkouts/gecko/js/xpconnect/src/XPCWrappedJSClass.cpp:918:17 (libxul.so+0x47b3b51) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #58 PrepareAndDispatch /builds/worker/checkouts/gecko/xpcom/reflect/xptcall/md/unix/xptcstubs_x86_64_linux.cpp:115:37 (libxul.so+0x3b0abff) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #59 SharedStub xptcstubs_x86_64_linux.cpp (libxul.so+0x3b09f32) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #60 nsXREDirProvider::DoStartup() /builds/worker/checkouts/gecko/toolkit/xre/nsXREDirProvider.cpp:654:11 (libxul.so+0xa532a15) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #61 XREMain::XRE_mainRun() /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5702:18 (libxul.so+0xa51f1fc) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #62 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:6178:8 (libxul.so+0xa52033b) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #63 XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:6251:21 (libxul.so+0xa520b1d) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #64 mozilla::BootstrapImpl::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/Bootstrap.cpp:46:12 (libxul.so+0xa52f882) (BuildId: 00b7553bc6b4572aa950005b1fe4dc0ee68db7eb)
    #65 do_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:229:22 (firefox-bin+0x147d66) (BuildId: 220c74d5fb8ba86873f33d2387f44ef343cdc22c)
    #66 main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:487:16 (firefox-bin+0x147d66)

Jonathan, any idea what this could be?

Flags: needinfo?(jfkthame)
Severity: -- → S3
Blocks: tsan

This must be related to the old per-process platform font list, which we don't use these days except that Safe Mode still falls back to it. We've added a bunch of locking to various font objects in order to support offscreen-canvas workers doing text rendering, and apparently the old font-list code is mismanaging something around that.

At this point we've had the cross-process shared font list long enough that we could probably leave it enabled in Safe Mode as well, which would avoid this. Initially the concern was that it was new/untested/perhaps fragile, so Safe Mode used the old, stable implementation, but by now it's probably the old version that is less trustworthy as it's no longer being extensively tested and maintained.

Removing the check for Safe Mode here would probably fix this.

Flags: needinfo?(jfkthame)

Lets see if it works. I pushed a try build including unskipping the Marionette test which caused this TSAN warning:
https://treeherder.mozilla.org/jobs?repo=try&landoCommitID=159903

Assignee: nobody → hskupin
Status: NEW → ASSIGNED
Blocks: 1995967

Jonathan, before landing the patch I wonder if manual checks by QA would be necessary. Would a regression easy to be visible when the fonts aren't correctly displayed in Safe Mode? Or what specifically would have to be checked? Thanks.

Flags: needinfo?(jfkthame)

As long as the browser can start in Safe Mode and isn't completely lacking any text, or something like that, it should be fine. If it's broken, it should be really obvious.

Flags: needinfo?(jfkthame)
Points: --- → 1
Priority: -- → P3
Whiteboard: [webdriver:m18]

https://hg.mozilla.org/mozilla-central/rev/b9839afcf6ea

Status: ASSIGNED → RESOLVED
Closed: 8 months ago
status-firefox146: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 146 Branch
QA Whiteboard: [qa-triage-done-c147/b146]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: