Last Comment Bug 608391 - crash on exit: assertion failure: ABORT: X_GLXMakeCurrent: GLXBadDrawable
: crash on exit: assertion failure: ABORT: X_GLXMakeCurrent: GLXBadDrawable
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: Graphics (show other bugs)
: Trunk
: x86_64 Linux
: -- normal (vote)
: ---
Assigned To: Nobody; OK to take it and work on it
:
Mentors:
http://audioscene.org/scene-files/hum...
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2010-10-29 14:32 PDT by Benoit Jacob [:bjacob] (mostly away)
Modified: 2011-10-07 08:55 PDT (History)
0 users
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
patch from bug 604044 (908 bytes, patch)
2010-11-21 10:55 PST, Benoit Jacob [:bjacob] (mostly away)
no flags Details | Diff | Review

Description Benoit Jacob [:bjacob] (mostly away) 2010-10-29 14:32:32 PDT
STR:
  1. go to URL http://audioscene.org/scene-files/humph/VideoShaderSandbox/video_shader_sandbox.html
  2. enjoy a minute of bruce lee entertainment
  3. close firefox

Result: crash on exit. Backtrace obtained with MOZ_X_SYNC=1 MOZ_GL_DEBUG=1:

#0  0x000000385bea6a6d in nanosleep () from /lib64/libc.so.6
#1  0x000000385bea68e0 in sleep () from /lib64/libc.so.6
#2  0x00007f8c359a15b4 in ah_crap_handler (signum=6)
    at /home/bjacob/mozilla-central/toolkit/xre/nsSigHandlers.cpp:132
#3  0x00007f8c359a5dee in nsProfileLock::FatalSignalHandler (signo=6, info=0x7fffd008ab30, 
    context=0x7fffd008aa00) at nsProfileLock.cpp:221
#4  <signal handler called>
#5  0x000000385be329a5 in raise () from /lib64/libc.so.6
#6  0x000000385be34185 in abort () from /lib64/libc.so.6
#7  0x00007f8c34e7b321 in mozalloc_abort (msg=
    0x7fffd008b010 "###!!! ABORT: X_GLXMakeCurrent: GLXBadDrawable; id=0x48000f6: file /home/bjacob/mozilla-central/toolkit/xre/nsX11ErrorHandler.cpp, line 190")
    at /home/bjacob/mozilla-central/memory/mozalloc/mozalloc_abort.cpp:75
#8  0x00007f8c3702b7df in Abort (aMsg=
    0x7fffd008b010 "###!!! ABORT: X_GLXMakeCurrent: GLXBadDrawable; id=0x48000f6: file /home/bjacob/mozilla-central/toolkit/xre/nsX11ErrorHandler.cpp, line 190")
    at /home/bjacob/mozilla-central/xpcom/base/nsDebugImpl.cpp:379
#9  0x00007f8c3702b701 in NS_DebugBreak_P (aSeverity=3, aStr=
    0x7fffd008bcb0 "X_GLXMakeCurrent: GLXBadDrawable; id=0x48000f6", aExpr=0x0, aFile=
    0x7f8c3767e608 "/home/bjacob/mozilla-central/toolkit/xre/nsX11ErrorHandler.cpp", aLine=
    190) at /home/bjacob/mozilla-central/xpcom/base/nsDebugImpl.cpp:337
#10 0x00007f8c359a58fc in X11Error (display=0x104c600, event=0x7fffd008bd40)
    at /home/bjacob/mozilla-central/toolkit/xre/nsX11ErrorHandler.cpp:190
#11 0x000000385da46b24 in _XError (dpy=0x104c600, rep=0x296e2c0) at XlibInt.c:3103
#12 0x000000385da4d6a6 in _XReply (dpy=0x104c600, rep=<value optimized out>, extra=0, discard=
    0) at xcb_io.c:513
#13 0x0000003134282728 in ?? () from /usr/lib64/nvidia/libGL.so.1
#14 0x0000003134283fbf in ?? () from /usr/lib64/nvidia/libGL.so.1
#15 0x00007f8c37156a74 in mozilla::gl::GLContextGLX::MakeCurrentImpl (this=0x2477130, aForce=
    0) at /home/bjacob/mozilla-central/gfx/thebes/GLContextProviderGLX.cpp:264
#16 0x00007f8c36076d87 in mozilla::gl::GLContext::MakeCurrent (this=0x2477130, aForce=0)
    at ../../../dist/include/GLContext.h:408
#17 0x00007f8c3716c263 in mozilla::layers::GLTexture::Release (this=0x7f8bec0138f8)
    at /home/bjacob/mozilla-central/gfx/layers/opengl/ImageLayerOGL.cpp:115
---Type <return> to continue, or q <return> to quit---
#18 0x00007f8c3716f1fa in mozilla::layers::GLTexture::~GLTexture (this=0x7f8bec0138f8, 
    __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/gfx/layers/opengl/ImageLayerOGL.h:71
#19 0x00007f8c3716ff35 in nsTArrayElementTraits<mozilla::layers::GLTexture>::Destruct (e=
    0x7f8bec0138f8) at ../../dist/include/nsTArray.h:204
#20 0x00007f8c3716fe81 in nsTArray<mozilla::layers::GLTexture>::DestructRange (this=
    0x2a77da8, start=0, count=2) at ../../dist/include/nsTArray.h:987
#21 0x00007f8c3716fc4e in nsTArray<mozilla::layers::GLTexture>::RemoveElementsAt (this=
    0x2a77da8, start=0, count=2) at ../../dist/include/nsTArray.h:718
#22 0x00007f8c3716f7d9 in nsTArray<mozilla::layers::GLTexture>::Clear (this=0x2a77da8)
    at ../../dist/include/nsTArray.h:729
#23 0x00007f8c3716f66e in nsTArray<mozilla::layers::GLTexture>::~nsTArray (this=0x2a77da8, 
    __in_chrg=<value optimized out>) at ../../dist/include/nsTArray.h:274
#24 0x00007f8c3716f309 in mozilla::layers::RecycleBin::~RecycleBin (this=0x2a77d70, 
    __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/gfx/layers/opengl/ImageLayerOGL.h:101
#25 0x00007f8c3716f3c9 in mozilla::layers::RecycleBin::Release (this=0x2a77d70)
    at /home/bjacob/mozilla-central/gfx/layers/opengl/ImageLayerOGL.h:102
#26 0x00007f8c3716f8e5 in nsRefPtr<mozilla::layers::RecycleBin>::~nsRefPtr (this=0x25258e8, 
    __in_chrg=<value optimized out>) at ../../dist/include/nsAutoPtr.h:969
#27 0x00007f8c3716c93e in mozilla::layers::ImageContainerOGL::~ImageContainerOGL (this=
    0x25258d0, __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/gfx/layers/opengl/ImageLayerOGL.cpp:205
#28 0x00007f8c3716c982 in mozilla::layers::ImageContainerOGL::~ImageContainerOGL (this=
    0x25258d0, __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/gfx/layers/opengl/ImageLayerOGL.cpp:205
#29 0x00007f8c35d8ec0a in mozilla::layers::ImageContainer::Release (this=0x25258d0)
    at ../../dist/include/ImageLayers.h:114
#30 0x00007f8c35d8f62d in nsRefPtr<mozilla::layers::ImageContainer>::~nsRefPtr (this=
    0x258d178, __in_chrg=<value optimized out>) at ../../dist/include/nsAutoPtr.h:969
#31 0x00007f8c3618c910 in nsHTMLMediaElement::~nsHTMLMediaElement (this=0x258d100, 
    __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/content/html/content/src/nsHTMLMediaElement.cpp:1333
#32 0x00007f8c36194bb1 in nsHTMLVideoElement::~nsHTMLVideoElement (this=0x258d100, 
---Type <return> to continue, or q <return> to quit---
    __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/content/html/content/src/nsHTMLVideoElement.cpp:111
#33 0x00007f8c36194be8 in nsHTMLVideoElement::~nsHTMLVideoElement (this=0x258d100, 
    __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/content/html/content/src/nsHTMLVideoElement.cpp:111
#34 0x00007f8c35ff62cc in nsNodeUtils::LastRelease (aNode=0x258d100)
    at /home/bjacob/mozilla-central/content/base/src/nsNodeUtils.cpp:326
#35 0x00007f8c35fded87 in nsGenericElement::Release (this=0x258d100)
    at /home/bjacob/mozilla-central/content/base/src/nsGenericElement.cpp:4512
#36 0x00007f8c36188f4a in nsHTMLMediaElement::Release (this=0x258d100)
    at /home/bjacob/mozilla-central/content/html/content/src/nsHTMLMediaElement.cpp:364
#37 0x00007f8c36194676 in nsHTMLVideoElement::Release (this=0x258d100)
    at /home/bjacob/mozilla-central/content/html/content/src/nsHTMLVideoElement.cpp:72
#38 0x00007f8c3684596e in XPCWrappedNative::~XPCWrappedNative (this=0x2a32bc0, 
    __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/js/src/xpconnect/src/xpcwrappednative.cpp:932
#39 0x00007f8c368459e6 in XPCWrappedNative::~XPCWrappedNative (this=0x2a32bc0, 
    __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/js/src/xpconnect/src/xpcwrappednative.cpp:935
#40 0x00007f8c36846b7a in XPCWrappedNative::Release (this=0x2a32bc0)
    at /home/bjacob/mozilla-central/js/src/xpconnect/src/xpcwrappednative.cpp:1238
#41 0x00007f8c36846f23 in XPCWrappedNative::FlatJSObjectFinalized (this=0x2a32bc0, cx=
    0x1e22370) at /home/bjacob/mozilla-central/js/src/xpconnect/src/xpcwrappednative.cpp:1399
#42 0x00007f8c36855d58 in XPC_WN_NoHelper_Finalize (cx=0x1e22370, obj=0x7f8c240e17f8)
    at /home/bjacob/mozilla-central/js/src/xpconnect/src/xpcwrappednativejsops.cpp:674
#43 0x00007f8c37257d18 in JSObject::finalize (this=0x7f8c240e17f8, cx=0x1e22370, thingKind=1)
    at /home/bjacob/mozilla-central/js/src/jsobjinlines.h:134
#44 0x00007f8c3725357a in FinalizeArenaList<JSObject_Slots2> (comp=0x2400000, cx=0x1e22370, 
    thingKind=1) at /home/bjacob/mozilla-central/js/src/jsgc.cpp:1878
#45 0x00007f8c3725175e in MarkAndSweep (cx=0x1e22370, gckind=GC_NORMAL)
    at /home/bjacob/mozilla-central/js/src/jsgc.cpp:2236
#46 0x00007f8c3725203f in GCUntilDone (cx=0x1e22370, gckind=GC_NORMAL)
    at /home/bjacob/mozilla-central/js/src/jsgc.cpp:2529
#47 0x00007f8c372521ca in js_GC (cx=0x1e22370, gckind=GC_NORMAL)
---Type <return> to continue, or q <return> to quit---
    at /home/bjacob/mozilla-central/js/src/jsgc.cpp:2587
#48 0x00007f8c371c9dd0 in JS_GC (cx=0x1e22370)
    at /home/bjacob/mozilla-central/js/src/jsapi.cpp:2568
#49 0x00007f8c367f6919 in nsXPConnect::Collect (this=0x12c2500)
    at /home/bjacob/mozilla-central/js/src/xpconnect/src/nsXPConnect.cpp:400
#50 0x00007f8c37033dfa in nsCycleCollector::Collect (this=0x10b7ec0, aTryCollections=5, 
    aListener=0x0) at /home/bjacob/mozilla-central/xpcom/base/nsCycleCollector.cpp:2479
#51 0x00007f8c370342fa in nsCycleCollector::Shutdown (this=0x10b7ec0)
    at /home/bjacob/mozilla-central/xpcom/base/nsCycleCollector.cpp:2726
#52 0x00007f8c37034591 in nsCycleCollector_shutdown ()
    at /home/bjacob/mozilla-central/xpcom/base/nsCycleCollector.cpp:3221
#53 0x00007f8c36fb2d38 in mozilla::ShutdownXPCOM (servMgr=0x0)
    at /home/bjacob/mozilla-central/xpcom/build/nsXPComInit.cpp:685
#54 0x00007f8c36fb290e in NS_ShutdownXPCOM_P (servMgr=0x10b7cf8)
    at /home/bjacob/mozilla-central/xpcom/build/nsXPComInit.cpp:587
#55 0x00007f8c3598aa04 in ScopedXPCOMStartup::~ScopedXPCOMStartup (this=0x7fffd0094ce0, 
    __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/toolkit/xre/nsAppRunner.cpp:1117
#56 0x00007f8c3599329f in XRE_main (argc=5, argv=0x7fffd00953c8, aAppData=0x102dcc0)
    at /home/bjacob/mozilla-central/toolkit/xre/nsAppRunner.cpp:3700
#57 0x000000000040121f in main (argc=5, argv=0x7fffd00953c8)
    at /home/bjacob/mozilla-central/browser/app/nsBrowserApp.cpp:158
Comment 1 timeless 2010-10-30 13:15:34 PDT
JavaScript held a reference to a dom object and it outlived some of shutdown? 
if so, this sounds more like a bug in dom, you shouldn't have been held this late.

You probably should stop holding stuff at:
                NotifyObservers(nsnull, NS_XPCOM_WILL_SHUTDOWN_OBSERVER_ID,
-- You might consider complaining for each thing you find still alive at this point, I believe each would be a bug.

See the comment describing shutdown behavior for NS_ShutdownXPCOM.
Comment 2 Benoit Jacob [:bjacob] (mostly away) 2010-11-18 08:21:45 PST
(In reply to comment #1)
> JavaScript held a reference to a dom object and it outlived some of shutdown? 
> if so, this sounds more like a bug in dom, you shouldn't have been held this
> late.
> 
> You probably should stop holding stuff at:
>                 NotifyObservers(nsnull, NS_XPCOM_WILL_SHUTDOWN_OBSERVER_ID,
> -- You might consider complaining for each thing you find still alive at this
> point, I believe each would be a bug.
> 
> See the comment describing shutdown behavior for NS_ShutdownXPCOM.

I tried following your suggestion but that requires more knowledge of internals than I have. For starters, I wasn't able to find that comment on shutdown behavior that you're referring to.

So currently, not being able to do better, I'm just tracking down this particular crash.
Comment 3 Benoit Jacob [:bjacob] (mostly away) 2010-11-18 08:23:00 PST
Taking 'on exit' out of bug title because it has happened to me earlier than at exit, too.
Comment 4 timeless 2010-11-21 02:21:24 PST
so, roughly you can have a singleton (or not, your choice) listen to NS_XPCOM_WILL_SHUTDOWN_OBSERVER_ID, for any objects which are dom backed this is probably the latest they should let go of things (force release + whine).

http://mxr.mozilla.org/mozilla-central/source/xpcom/build/nsXPComInit.cpp#570

571 // NS_ShutdownXPCOM()
572 //
573 // The shutdown sequence for xpcom would be
574 //
575 // - Notify "xpcom-shutdown" for modules to release primary (root) references

you more or less want to let go of things <here>

576 // - Shutdown XPCOM timers
577 // - Notify "xpcom-shutdown-threads" for thread joins
578 // - Shutdown the event queues
579 // - Release the Global Service Manager
580 //   - Release all service instances held by the global service manager
581 //   - Release the Global Service Manager itself
582 // - Release the Component Manager
583 //   - Release all factories cached by the Component Manager
584 //   - Notify module loaders to shut down
585 //   - Unload Libraries
586 //   - Release Contractid Cache held by Component Manager
587 //   - Release dll abstraction held by Component Manager
588 //   - Release the Registry held by Component Manager
589 //   - Finally, release the component manager itself
590 //
Comment 5 Benoit Jacob [:bjacob] (mostly away) 2010-11-21 07:51:28 PST
Sorry for the noise: I must have wrongly remembered, it is definitely a crash on exit; any non-exit crash would be a separate one.
Comment 6 Benoit Jacob [:bjacob] (mostly away) 2010-11-21 10:55:04 PST
Created attachment 492202 [details] [diff] [review]
patch from bug 604044

Not asking for review here since it's already under review at bug 604044.

This patch seems to fix both this bug and bug 604044.

Note You need to log in before you can comment on or make changes to this bug.