Last Comment Bug 754056 - Crash in gfxReusableSurfaceWrapper
: Crash in gfxReusableSurfaceWrapper
Status: RESOLVED FIXED
[native-crash]
: crash
Product: Core
Classification: Components
Component: Graphics (show other bugs)
: Trunk
: ARM Android
: -- critical (vote)
: mozilla15
Assigned To: Benoit Jacob [:bjacob] (mostly away)
:
Mentors:
Depends on:
Blocks: 743938 748649
  Show dependency treegraph
 
Reported: 2012-05-10 14:37 PDT by Kartikaya Gupta (email:kats@mozilla.com)
Modified: 2013-12-10 10:01 PST (History)
4 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
unaffected
fixed


Attachments
call ReadUnlock() before replacing tiles (781 bytes, patch)
2012-05-11 11:39 PDT, Benoit Jacob [:bjacob] (mostly away)
bgirard: review+
Details | Diff | Splinter Review

Description Kartikaya Gupta (email:kats@mozilla.com) 2012-05-10 14:37:56 PDT
Using a debug build off central, and every so often I get a crash with the following stack:

adb| ###!!! ABORT: Should not be locked when released: 'mReadCount == 0', file /Users/kats/zspace/mozilla-git/gfx/thebes/gfxReusableSurfaceWrapper.cpp, line 20

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 24562]
TouchBadMemory () at /Users/kats/zspace/mozilla-git/memory/mozalloc/mozalloc_abort.cpp:68
68	    gDummyCounter += *p;   // TODO annotation saying we know 
(gdb) bt
#0  TouchBadMemory () at /Users/kats/zspace/mozilla-git/memory/mozalloc/mozalloc_abort.cpp:68
#1  0x5bf2b770 in mozalloc_abort (msg=<optimized out>) at /Users/kats/zspace/mozilla-git/memory/mozalloc/mozalloc_abort.cpp:89
#2  0x61924b30 in Abort (aMsg=<optimized out>) at /Users/kats/zspace/mozilla-git/xpcom/base/nsDebugImpl.cpp:417
#3  NS_DebugBreak_P (aSeverity=3, aStr=<optimized out>, aExpr=<optimized out>, aFile=<optimized out>, aLine=20)
    at /Users/kats/zspace/mozilla-git/xpcom/base/nsDebugImpl.cpp:404
#4  0x619970ac in gfxReusableSurfaceWrapper::~gfxReusableSurfaceWrapper (this=0x661fffc0, __in_chrg=<optimized out>)
    at /Users/kats/zspace/mozilla-git/gfx/thebes/gfxReusableSurfaceWrapper.cpp:20
#5  0x619a5cca in gfxReusableSurfaceWrapper::Release (this=0x661fffc0) at ../../dist/include/gfxReusableSurfaceWrapper.h:31
#6  0x619b89d4 in ~nsRefPtr (this=<optimized out>, __in_chrg=<optimized out>) at ../../dist/include/nsAutoPtr.h:908
#7  ~BasicTiledLayerTile (this=<optimized out>, __in_chrg=<optimized out>) at ../../dist/include/BasicTiledThebesLayer.h:26
#8  Destruct (e=<optimized out>) at ../../dist/include/nsTArray.h:380
#9  DestructRange (count=<optimized out>, start=<optimized out>, this=<optimized out>) at ../../dist/include/nsTArray.h:1243
#10 ReplaceElementsAt<mozilla::layers::BasicTiledLayerTile> (arrayLen=<optimized out>, array=<optimized out>, count=<optimized out>, start=<optimized out>, 
    this=<optimized out>) at ../../dist/include/nsTArray.h:754
#11 operator= (other=<optimized out>, this=<optimized out>) at ../../dist/include/nsTArray.h:490
#12 operator= (this=<optimized out>) at /Users/kats/zspace/mozilla-git/gfx/layers/TiledLayerBuffer.h:69
#13 mozilla::layers::BasicTiledLayerBuffer::operator= (this=0x65360a24) at ../../dist/include/BasicTiledThebesLayer.h:78
#14 0x619b8a84 in mozilla::layers::TiledThebesLayerOGL::PaintedTiledLayerBuffer (this=0x65360800, mTiledBuffer=0x1612b08)
    at /Users/kats/zspace/mozilla-git/gfx/layers/opengl/TiledThebesLayerOGL.cpp:134
#15 0x619c1b0c in mozilla::layers::ShadowLayersParent::RecvUpdate (this=0x636c1fd0, cset=<optimized out>, isFirstPaint=<optimized out>, reply=<optimized out>)
    at /Users/kats/zspace/mozilla-git/gfx/layers/ipc/ShadowLayersParent.cpp:330
#16 0x619c12e6 in mozilla::layers::ShadowLayersParent::RecvUpdateNoSwap (this=0x636c1fd0, cset=..., isFirstPaint=@0x638ffb88)
    at /Users/kats/zspace/mozilla-git/gfx/layers/ipc/ShadowLayersParent.cpp:156
#17 0x6186c040 in mozilla::layers::PLayersParent::OnMessageReceived (this=0x636c1fd0, __msg=<optimized out>)
    at /Users/kats/zspace/mozilla-git/obj-android-debug/ipc/ipdl/PLayersParent.cpp:275
#18 0x6186729a in mozilla::layers::PCompositorParent::OnMessageReceived (this=0x636fa800, __msg=...)
    at /Users/kats/zspace/mozilla-git/obj-android-debug/ipc/ipdl/PCompositorParent.cpp:288
#19 0x6182d1fa in mozilla::ipc::AsyncChannel::OnDispatchMessage (this=0x636fa808, msg=...) at /Users/kats/zspace/mozilla-git/ipc/glue/AsyncChannel.cpp:495
#20 0x61832110 in mozilla::ipc::RPCChannel::OnMaybeDequeueOne (this=0x636fa808) at /Users/kats/zspace/mozilla-git/ipc/glue/RPCChannel.cpp:434
#21 0x6181a2c4 in DispatchToMethod<mozilla::plugins::PluginInstanceChild, void (mozilla::plugins::PluginInstanceChild::*)()> (arg=<optimized out>, 
    method=<optimized out>, obj=<optimized out>) at /Users/kats/zspace/mozilla-git/ipc/chromium/src/base/tuple.h:383
#22 RunnableMethod<mozilla::plugins::PluginInstanceChild, void (mozilla::plugins::PluginInstanceChild::*)(), Tuple0>::Run (this=<optimized out>)
    at /Users/kats/zspace/mozilla-git/ipc/chromium/src/base/task.h:307
#23 0x618304f2 in Run (this=<optimized out>) at ../../dist/include/mozilla/ipc/RPCChannel.h:462
#24 mozilla::ipc::RPCChannel::DequeueTask::Run (this=0x5e728640) at ../../dist/include/mozilla/ipc/RPCChannel.h:485
#25 0x6194d246 in MessageLoop::RunTask (this=0x638ffdd4, task=0x5e728640) at /Users/kats/zspace/mozilla-git/ipc/chromium/src/base/message_loop.cc:318
#26 0x6194da50 in MessageLoop::DeferOrRunPendingTask (this=0xa, pending_task=<optimized out>) at /Users/kats/zspace/mozilla-git/ipc/chromium/src/base/message_loop.cc:326
#27 0x6194e73e in MessageLoop::DoWork (this=0x638ffdd4) at /Users/kats/zspace/mozilla-git/ipc/chromium/src/base/message_loop.cc:426
#28 0x6194eaaa in base::MessagePumpDefault::Run (this=0x637b3600, delegate=0x638ffdd4) at /Users/kats/zspace/mozilla-git/ipc/chromium/src/base/message_pump_default.cc:23
#29 0x6194d7e2 in MessageLoop::RunInternal (this=0x638ffdd4) at /Users/kats/zspace/mozilla-git/ipc/chromium/src/base/message_loop.cc:208
#30 0x6194d842 in RunHandler (this=<optimized out>) at /Users/kats/zspace/mozilla-git/ipc/chromium/src/base/message_loop.cc:201
#31 MessageLoop::Run (this=0x638ffdd4) at /Users/kats/zspace/mozilla-git/ipc/chromium/src/base/message_loop.cc:175
#32 0x619572e8 in base::Thread::ThreadMain (this=0x636c1ac0) at /Users/kats/zspace/mozilla-git/ipc/chromium/src/base/thread.cc:156
#33 0x61964ae2 in ThreadFunc (closure=0xa) at /Users/kats/zspace/mozilla-git/ipc/chromium/src/base/platform_thread_posix.cc:27
#34 0x400f9c50 in pthread_setspecific () from /Users/kats/android/jdb/moz-gdb/lib/01466E640801401C/system/lib/libc.so
#35 0x400f9c50 in pthread_setspecific () from /Users/kats/android/jdb/moz-gdb/lib/01466E640801401C/system/lib/libc.so
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
Comment 1 Benoit Girard (:BenWa) 2012-05-10 14:43:37 PDT
This might explain some of the problem we see with tiling.
Comment 2 Benoit Girard (:BenWa) 2012-05-11 11:25:04 PDT
bjacob looked at this and found a plausible solution.
Comment 3 Benoit Jacob [:bjacob] (mostly away) 2012-05-11 11:39:13 PDT
Created attachment 623235 [details] [diff] [review]
call ReadUnlock() before replacing tiles

Patch really written by BenWa, but trivial enough that it should be OK to ask him to review it.
Comment 4 Benoit Girard (:BenWa) 2012-05-11 12:00:25 PDT
Comment on attachment 623235 [details] [diff] [review]
call ReadUnlock() before replacing tiles

Thanks!
Comment 5 Benoit Jacob [:bjacob] (mostly away) 2012-05-12 13:58:07 PDT
http://hg.mozilla.org/integration/mozilla-inbound/rev/3cf3f6ba83bf
Comment 6 Matt Brubeck (:mbrubeck) 2012-05-13 17:41:21 PDT
https://hg.mozilla.org/mozilla-central/rev/3cf3f6ba83bf
Comment 7 Kartikaya Gupta (email:kats@mozilla.com) 2012-05-14 07:06:17 PDT
Should this be uplifted to aurora?
Comment 8 Benoit Girard (:BenWa) 2012-05-14 08:10:25 PDT
Comment on attachment 623235 [details] [diff] [review]
call ReadUnlock() before replacing tiles

[Approval Request Comment]
Regression caused by (bug #): bug 739679
User impact if declined: leaks (assertion crashes in debug)
Testing completed (on m-c, etc.): on m-c
Risk to taking this patch (and alternatives if risky): low & mobile-only, code was missing an unlock
String changes made by this patch: none
Comment 9 Benoit Girard (:BenWa) 2012-05-14 08:11:10 PDT
Comment on attachment 623235 [details] [diff] [review]
call ReadUnlock() before replacing tiles

Actually no, we haven't uplifted noswap drawing. Aurora isn't affacted. But if we uplift that fix we should include this as well.

Note You need to log in before you can comment on or make changes to this bug.