Closed Bug 858942 Opened 13 years ago Closed 4 years ago

Consistent wrong-thread release calls on mozilla::gl::TextureImage

Categories

(Core :: Graphics, defect)

Product:
Core
Component:
Graphics
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: bzbarsky, Unassigned)

Details

My debug build reliably crashes at shutdown, and in various other cases as well, with stacks like this: 0 XUL 0x0000000104f69919 mozilla::gl::TextureImage::Release() + 457 (GLTextureImage.h:38) 1 XUL 0x0000000104f69739 nsRefPtr<mozilla::gl::TextureImage>::assign_assuming_AddRef(mozilla::gl::TextureImage*) + 57 (nsAutoPtr.h:868) 2 XUL 0x0000000104f69fcf nsRefPtr<mozilla::gl::TextureImage>::assign_with_AddRef(mozilla::gl::TextureImage*) + 63 (nsAutoPtr.h:853) 3 XUL 0x0000000104f67cff nsRefPtr<mozilla::gl::TextureImage>::operator=(mozilla::gl::TextureImage*) + 47 (nsAutoPtr.h:937) 4 XUL 0x0000000104f4f872 nsChildView::~nsChildView() + 402 (nsChildView.mm:273) and then chaining up to presshell and device context destruction from GC. The crash is happening because we're doing a Release on the wrong thread: Assertion failure: _mOwningThread.GetThread() == PR_GetCurrentThread() (TextureImage not thread-safe), at ../../dist/include/GLTextureImage.h:38 In particular, the release is clearly happening on the main thread in this case. Not sure yet what the owning thread is.
I can't figure out what the owning thread is. It has no name, and no obvious startFunc, so there's nothing to really go on. :(
Ah, here we go. The allocation stack for this TextureImage is: mozilla::gl::TextureImage::TextureImage(nsIntSize const&, unsigned int, gfxASurface::gfxContentType, mozilla::gl::TextureImage::Flags)+0x000000C5 [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x0311D225] mozilla::gl::BasicTextureImage::BasicTextureImage(unsigned int, nsIntSize const&, unsigned int, gfxASurface::gfxContentType, mozilla::gl::GLContext*, mozilla::gl::TextureImage::Flags)+0x00000044 [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x0311D0F4] mozilla::gl::TextureImageCGL::TextureImageCGL(unsigned int, nsIntSize const&, unsigned int, gfxASurface::gfxContentType, mozilla::gl::GLContext*, mozilla::gl::TextureImage::Flags)+0x00000052 [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x03137A52] mozilla::gl::TextureImageCGL::TextureImageCGL(unsigned int, nsIntSize const&, unsigned int, gfxASurface::gfxContentType, mozilla::gl::GLContext*, mozilla::gl::TextureImage::Flags)+0x00000045 [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x03136245] mozilla::gl::GLContextCGL::CreateBasicTextureImage(unsigned int, nsIntSize const&, unsigned int, gfxASurface::gfxContentType, mozilla::gl::GLContext*, mozilla::gl::TextureImage::Flags)+0x0000006F [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x031358BF] mozilla::gl::GLContext::CreateTextureImage(nsIntSize const&, gfxASurface::gfxContentType, unsigned int, mozilla::gl::TextureImage::Flags)+0x0000011A [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x03110A0A] nsChildView::MaybeDrawRoundedBottomCorners(mozilla::layers::LayerManagerOGL*, nsIntRect)+0x000001A0 [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x02233100] nsChildView::DrawWindowOverlay(mozilla::layers::LayerManager*, nsIntRect)+0x00000089 [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x022328D9] mozilla::layers::LayerManagerOGL::Render()+0x00000688 [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x030BCD58] mozilla::layers::LayerManagerOGL::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags)+0x0000042A [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x030BC17A] mozilla::layers::LayerManagerOGL::EndEmptyTransaction(mozilla::layers::LayerManager::EndTransactionFlags)+0x000000EF [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x030BBD2F] mozilla::layers::CompositorParent::Composite()+0x0000033C [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x030E678C] void DispatchToMethod<mozilla::layers::CompositorParent, void (mozilla::layers::CompositorParent::*)()>(mozilla::layers::CompositorParent*, void (mozilla::layers::CompositorParent::*)(), Tuple0 const&)+0x00000083 [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x030ED7F3] RunnableMethod<mozilla::layers::CompositorParent, void (mozilla::layers::CompositorParent::*)(), Tuple0>::Run()+0x0000004E [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x030ED6EE] MessageLoop::RunTask(Task*)+0x00000060 [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x02F67230] MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&)+0x0000004F [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x02F677AF] MessageLoop::DoWork()+0x00000128 [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x02F67978] base::MessagePumpDefault::Run(base::MessagePump::Delegate*)+0x0000007C [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x02F702EC] MessageLoop::RunInternal()+0x00000076 [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x02F67116] MessageLoop::RunHandler()+0x00000015 [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x02F67025] MessageLoop::Run()+0x0000002D [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x02F66FCD] base::Thread::ThreadMain()+0x000000C3 [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x02F932F3] ThreadFunc(void*)+0x0000002C [/Users/bzbarsky/mozilla/inbound/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x02FCE70C] _pthread_start+0x00000147 [/usr/lib/system/libsystem_c.dylib +0x000147A2] Is that perhaps happening on the compositor thread?
Looks like I have "layers.offmainthreadcomposition.enabled" set to true in about:Config, probably from testing off-main-thread animations....
And turning that off makes the problem go away.
I think this is fixed with the layers refactoring (graphics branch), we should fix it there if not.
This bug does not seem to be fixed in the refactoring. What happens is that we call DrawWindowOverlay from the compositor thread which internally allocates the TextureImages mResizerImage and mCornerMaskImage. These two TextureImages thus "belong" to the compositor thread but they actually belong to the widget which is more of a ContentThread thing. I don't like that we use widgets from the compositor thread, we should find a way to do the rounded border thingy from the compositor thread without talking to the widget other than through ipc. In the mean time a faster way to fix this would be to pre-allocate the two texture images, and add some comments over DrawWindowOverlay and the other methods called inside of it, saying "this method can be called from the CompositorThread, make sure not to mutate or allocate resources in here" or something like that... We aren't close to shipping OMTC on mac so we have some time to sit down and think of a better solution.

Hey Boris,
Can you still reproduce this issue or should we close it?

Flags: needinfo?(bzbarsky)

OMTC on Mac shipped, I think, so probably this is not an issue anymore?

But this is really a question for the gfx team, not me. I no longer have debug builds on hand to test this sort of thing.

Flags: needinfo?(bzbarsky)

Marking this as Resolved > Worksforme as per reporter last response.
If anyone can still reproduce this issue re-open it or file a new bug.

Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.