608391 - crash on exit: assertion failure: ABORT: X_GLXMakeCurrent: GLXBadDrawable

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Benoit Jacob [:bjacob] (mostly away)]

STR:
  1. go to URL http://audioscene.org/scene-files/humph/VideoShaderSandbox/video_shader_sandbox.html
  2. enjoy a minute of bruce lee entertainment
  3. close firefox

Result: crash on exit. Backtrace obtained with MOZ_X_SYNC=1 MOZ_GL_DEBUG=1:

#0  0x000000385bea6a6d in nanosleep () from /lib64/libc.so.6
#1  0x000000385bea68e0 in sleep () from /lib64/libc.so.6
#2  0x00007f8c359a15b4 in ah_crap_handler (signum=6)
    at /home/bjacob/mozilla-central/toolkit/xre/nsSigHandlers.cpp:132
#3  0x00007f8c359a5dee in nsProfileLock::FatalSignalHandler (signo=6, info=0x7fffd008ab30, 
    context=0x7fffd008aa00) at nsProfileLock.cpp:221
#4  <signal handler called>
#5  0x000000385be329a5 in raise () from /lib64/libc.so.6
#6  0x000000385be34185 in abort () from /lib64/libc.so.6
#7  0x00007f8c34e7b321 in mozalloc_abort (msg=
    0x7fffd008b010 "###!!! ABORT: X_GLXMakeCurrent: GLXBadDrawable; id=0x48000f6: file /home/bjacob/mozilla-central/toolkit/xre/nsX11ErrorHandler.cpp, line 190")
    at /home/bjacob/mozilla-central/memory/mozalloc/mozalloc_abort.cpp:75
#8  0x00007f8c3702b7df in Abort (aMsg=
    0x7fffd008b010 "###!!! ABORT: X_GLXMakeCurrent: GLXBadDrawable; id=0x48000f6: file /home/bjacob/mozilla-central/toolkit/xre/nsX11ErrorHandler.cpp, line 190")
    at /home/bjacob/mozilla-central/xpcom/base/nsDebugImpl.cpp:379
#9  0x00007f8c3702b701 in NS_DebugBreak_P (aSeverity=3, aStr=
    0x7fffd008bcb0 "X_GLXMakeCurrent: GLXBadDrawable; id=0x48000f6", aExpr=0x0, aFile=
    0x7f8c3767e608 "/home/bjacob/mozilla-central/toolkit/xre/nsX11ErrorHandler.cpp", aLine=
    190) at /home/bjacob/mozilla-central/xpcom/base/nsDebugImpl.cpp:337
#10 0x00007f8c359a58fc in X11Error (display=0x104c600, event=0x7fffd008bd40)
    at /home/bjacob/mozilla-central/toolkit/xre/nsX11ErrorHandler.cpp:190
#11 0x000000385da46b24 in _XError (dpy=0x104c600, rep=0x296e2c0) at XlibInt.c:3103
#12 0x000000385da4d6a6 in _XReply (dpy=0x104c600, rep=<value optimized out>, extra=0, discard=
    0) at xcb_io.c:513
#13 0x0000003134282728 in ?? () from /usr/lib64/nvidia/libGL.so.1
#14 0x0000003134283fbf in ?? () from /usr/lib64/nvidia/libGL.so.1
#15 0x00007f8c37156a74 in mozilla::gl::GLContextGLX::MakeCurrentImpl (this=0x2477130, aForce=
    0) at /home/bjacob/mozilla-central/gfx/thebes/GLContextProviderGLX.cpp:264
#16 0x00007f8c36076d87 in mozilla::gl::GLContext::MakeCurrent (this=0x2477130, aForce=0)
    at ../../../dist/include/GLContext.h:408
#17 0x00007f8c3716c263 in mozilla::layers::GLTexture::Release (this=0x7f8bec0138f8)
    at /home/bjacob/mozilla-central/gfx/layers/opengl/ImageLayerOGL.cpp:115
---Type <return> to continue, or q <return> to quit---
#18 0x00007f8c3716f1fa in mozilla::layers::GLTexture::~GLTexture (this=0x7f8bec0138f8, 
    __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/gfx/layers/opengl/ImageLayerOGL.h:71
#19 0x00007f8c3716ff35 in nsTArrayElementTraits<mozilla::layers::GLTexture>::Destruct (e=
    0x7f8bec0138f8) at ../../dist/include/nsTArray.h:204
#20 0x00007f8c3716fe81 in nsTArray<mozilla::layers::GLTexture>::DestructRange (this=
    0x2a77da8, start=0, count=2) at ../../dist/include/nsTArray.h:987
#21 0x00007f8c3716fc4e in nsTArray<mozilla::layers::GLTexture>::RemoveElementsAt (this=
    0x2a77da8, start=0, count=2) at ../../dist/include/nsTArray.h:718
#22 0x00007f8c3716f7d9 in nsTArray<mozilla::layers::GLTexture>::Clear (this=0x2a77da8)
    at ../../dist/include/nsTArray.h:729
#23 0x00007f8c3716f66e in nsTArray<mozilla::layers::GLTexture>::~nsTArray (this=0x2a77da8, 
    __in_chrg=<value optimized out>) at ../../dist/include/nsTArray.h:274
#24 0x00007f8c3716f309 in mozilla::layers::RecycleBin::~RecycleBin (this=0x2a77d70, 
    __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/gfx/layers/opengl/ImageLayerOGL.h:101
#25 0x00007f8c3716f3c9 in mozilla::layers::RecycleBin::Release (this=0x2a77d70)
    at /home/bjacob/mozilla-central/gfx/layers/opengl/ImageLayerOGL.h:102
#26 0x00007f8c3716f8e5 in nsRefPtr<mozilla::layers::RecycleBin>::~nsRefPtr (this=0x25258e8, 
    __in_chrg=<value optimized out>) at ../../dist/include/nsAutoPtr.h:969
#27 0x00007f8c3716c93e in mozilla::layers::ImageContainerOGL::~ImageContainerOGL (this=
    0x25258d0, __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/gfx/layers/opengl/ImageLayerOGL.cpp:205
#28 0x00007f8c3716c982 in mozilla::layers::ImageContainerOGL::~ImageContainerOGL (this=
    0x25258d0, __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/gfx/layers/opengl/ImageLayerOGL.cpp:205
#29 0x00007f8c35d8ec0a in mozilla::layers::ImageContainer::Release (this=0x25258d0)
    at ../../dist/include/ImageLayers.h:114
#30 0x00007f8c35d8f62d in nsRefPtr<mozilla::layers::ImageContainer>::~nsRefPtr (this=
    0x258d178, __in_chrg=<value optimized out>) at ../../dist/include/nsAutoPtr.h:969
#31 0x00007f8c3618c910 in nsHTMLMediaElement::~nsHTMLMediaElement (this=0x258d100, 
    __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/content/html/content/src/nsHTMLMediaElement.cpp:1333
#32 0x00007f8c36194bb1 in nsHTMLVideoElement::~nsHTMLVideoElement (this=0x258d100, 
---Type <return> to continue, or q <return> to quit---
    __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/content/html/content/src/nsHTMLVideoElement.cpp:111
#33 0x00007f8c36194be8 in nsHTMLVideoElement::~nsHTMLVideoElement (this=0x258d100, 
    __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/content/html/content/src/nsHTMLVideoElement.cpp:111
#34 0x00007f8c35ff62cc in nsNodeUtils::LastRelease (aNode=0x258d100)
    at /home/bjacob/mozilla-central/content/base/src/nsNodeUtils.cpp:326
#35 0x00007f8c35fded87 in nsGenericElement::Release (this=0x258d100)
    at /home/bjacob/mozilla-central/content/base/src/nsGenericElement.cpp:4512
#36 0x00007f8c36188f4a in nsHTMLMediaElement::Release (this=0x258d100)
    at /home/bjacob/mozilla-central/content/html/content/src/nsHTMLMediaElement.cpp:364
#37 0x00007f8c36194676 in nsHTMLVideoElement::Release (this=0x258d100)
    at /home/bjacob/mozilla-central/content/html/content/src/nsHTMLVideoElement.cpp:72
#38 0x00007f8c3684596e in XPCWrappedNative::~XPCWrappedNative (this=0x2a32bc0, 
    __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/js/src/xpconnect/src/xpcwrappednative.cpp:932
#39 0x00007f8c368459e6 in XPCWrappedNative::~XPCWrappedNative (this=0x2a32bc0, 
    __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/js/src/xpconnect/src/xpcwrappednative.cpp:935
#40 0x00007f8c36846b7a in XPCWrappedNative::Release (this=0x2a32bc0)
    at /home/bjacob/mozilla-central/js/src/xpconnect/src/xpcwrappednative.cpp:1238
#41 0x00007f8c36846f23 in XPCWrappedNative::FlatJSObjectFinalized (this=0x2a32bc0, cx=
    0x1e22370) at /home/bjacob/mozilla-central/js/src/xpconnect/src/xpcwrappednative.cpp:1399
#42 0x00007f8c36855d58 in XPC_WN_NoHelper_Finalize (cx=0x1e22370, obj=0x7f8c240e17f8)
    at /home/bjacob/mozilla-central/js/src/xpconnect/src/xpcwrappednativejsops.cpp:674
#43 0x00007f8c37257d18 in JSObject::finalize (this=0x7f8c240e17f8, cx=0x1e22370, thingKind=1)
    at /home/bjacob/mozilla-central/js/src/jsobjinlines.h:134
#44 0x00007f8c3725357a in FinalizeArenaList<JSObject_Slots2> (comp=0x2400000, cx=0x1e22370, 
    thingKind=1) at /home/bjacob/mozilla-central/js/src/jsgc.cpp:1878
#45 0x00007f8c3725175e in MarkAndSweep (cx=0x1e22370, gckind=GC_NORMAL)
    at /home/bjacob/mozilla-central/js/src/jsgc.cpp:2236
#46 0x00007f8c3725203f in GCUntilDone (cx=0x1e22370, gckind=GC_NORMAL)
    at /home/bjacob/mozilla-central/js/src/jsgc.cpp:2529
#47 0x00007f8c372521ca in js_GC (cx=0x1e22370, gckind=GC_NORMAL)
---Type <return> to continue, or q <return> to quit---
    at /home/bjacob/mozilla-central/js/src/jsgc.cpp:2587
#48 0x00007f8c371c9dd0 in JS_GC (cx=0x1e22370)
    at /home/bjacob/mozilla-central/js/src/jsapi.cpp:2568
#49 0x00007f8c367f6919 in nsXPConnect::Collect (this=0x12c2500)
    at /home/bjacob/mozilla-central/js/src/xpconnect/src/nsXPConnect.cpp:400
#50 0x00007f8c37033dfa in nsCycleCollector::Collect (this=0x10b7ec0, aTryCollections=5, 
    aListener=0x0) at /home/bjacob/mozilla-central/xpcom/base/nsCycleCollector.cpp:2479
#51 0x00007f8c370342fa in nsCycleCollector::Shutdown (this=0x10b7ec0)
    at /home/bjacob/mozilla-central/xpcom/base/nsCycleCollector.cpp:2726
#52 0x00007f8c37034591 in nsCycleCollector_shutdown ()
    at /home/bjacob/mozilla-central/xpcom/base/nsCycleCollector.cpp:3221
#53 0x00007f8c36fb2d38 in mozilla::ShutdownXPCOM (servMgr=0x0)
    at /home/bjacob/mozilla-central/xpcom/build/nsXPComInit.cpp:685
#54 0x00007f8c36fb290e in NS_ShutdownXPCOM_P (servMgr=0x10b7cf8)
    at /home/bjacob/mozilla-central/xpcom/build/nsXPComInit.cpp:587
#55 0x00007f8c3598aa04 in ScopedXPCOMStartup::~ScopedXPCOMStartup (this=0x7fffd0094ce0, 
    __in_chrg=<value optimized out>)
    at /home/bjacob/mozilla-central/toolkit/xre/nsAppRunner.cpp:1117
#56 0x00007f8c3599329f in XRE_main (argc=5, argv=0x7fffd00953c8, aAppData=0x102dcc0)
    at /home/bjacob/mozilla-central/toolkit/xre/nsAppRunner.cpp:3700
#57 0x000000000040121f in main (argc=5, argv=0x7fffd00953c8)
    at /home/bjacob/mozilla-central/browser/app/nsBrowserApp.cpp:158

Comment 1

[timeless]

JavaScript held a reference to a dom object and it outlived some of shutdown? 
if so, this sounds more like a bug in dom, you shouldn't have been held this late.

You probably should stop holding stuff at:
                NotifyObservers(nsnull, NS_XPCOM_WILL_SHUTDOWN_OBSERVER_ID,
-- You might consider complaining for each thing you find still alive at this point, I believe each would be a bug.

See the comment describing shutdown behavior for NS_ShutdownXPCOM.

Comment 2

[Benoit Jacob [:bjacob] (mostly away)]

(In reply to comment #1)
> JavaScript held a reference to a dom object and it outlived some of shutdown? 
> if so, this sounds more like a bug in dom, you shouldn't have been held this
> late.
> 
> You probably should stop holding stuff at:
>                 NotifyObservers(nsnull, NS_XPCOM_WILL_SHUTDOWN_OBSERVER_ID,
> -- You might consider complaining for each thing you find still alive at this
> point, I believe each would be a bug.
> 
> See the comment describing shutdown behavior for NS_ShutdownXPCOM.

I tried following your suggestion but that requires more knowledge of internals than I have. For starters, I wasn't able to find that comment on shutdown behavior that you're referring to.

So currently, not being able to do better, I'm just tracking down this particular crash.

Comment 3

[Benoit Jacob [:bjacob] (mostly away)]

Taking 'on exit' out of bug title because it has happened to me earlier than at exit, too.

Comment 4

[timeless]

so, roughly you can have a singleton (or not, your choice) listen to NS_XPCOM_WILL_SHUTDOWN_OBSERVER_ID, for any objects which are dom backed this is probably the latest they should let go of things (force release + whine).

http://mxr.mozilla.org/mozilla-central/source/xpcom/build/nsXPComInit.cpp#570

571 // NS_ShutdownXPCOM()
572 //
573 // The shutdown sequence for xpcom would be
574 //
575 // - Notify "xpcom-shutdown" for modules to release primary (root) references

you more or less want to let go of things <here>

576 // - Shutdown XPCOM timers
577 // - Notify "xpcom-shutdown-threads" for thread joins
578 // - Shutdown the event queues
579 // - Release the Global Service Manager
580 //   - Release all service instances held by the global service manager
581 //   - Release the Global Service Manager itself
582 // - Release the Component Manager
583 //   - Release all factories cached by the Component Manager
584 //   - Notify module loaders to shut down
585 //   - Unload Libraries
586 //   - Release Contractid Cache held by Component Manager
587 //   - Release dll abstraction held by Component Manager
588 //   - Release the Registry held by Component Manager
589 //   - Finally, release the component manager itself
590 //

Comment 5

[Benoit Jacob [:bjacob] (mostly away)]

Sorry for the noise: I must have wrongly remembered, it is definitely a crash on exit; any non-exit crash would be a separate one.

Comment 6

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: patch from bug 604044

Not asking for review here since it's already under review at bug 604044.

This patch seems to fix both this bug and bug 604044.