967505 - TextureClientD3D11 sometimes crash in its destructor

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Nicolas Silva [:nical]]

Destroying the texture's DrawTarget sometimes trigger some code inside D2D that tries to access the underlying D3D texture which is inaccessible (and crashes). We need to make sure that the surface is accessible when that happens.

Comment 1

[Nicolas Silva [:nical]]

Attachment: Ensure that the texture is accessible when the draw target gets destroy

Comment 2

[Bas Schouten (:bas.schouten)]

Comment on attachment 8370053 [details] [diff] [review]
Ensure that the texture is accessible when the draw target gets destroy

Review of attachment 8370053 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/layers/d3d11/TextureD3D11.cpp
@@ +154,5 @@
> +  if (mDrawTarget) {
> +    MOZ_ASSERT(!mIsLocked);
> +    MOZ_ASSERT(mTexture);
> +    MOZ_ASSERT(mDrawTarget->refcount() == 1);
> +    // DrawTarget's dtor may trigger code paths that want to access the texture

Hrm, it shouldn't as long as we just flush is every time we unlock..?

Comment 3

[Nicolas Silva [:nical]]

We already do flush on unlock.
The code that crashes in ~DrawTargetD2D is mRT->EndDraw() which is called regardless of flush, but doesn't always crash (I have hit the crash very rarely).
http://dxr.mozilla.org/mozilla-central/source/gfx/2d/DrawTargetD2D.cpp#185

Comment 4

[Bas Schouten (:bas.schouten)]

(In reply to Nicolas Silva [:nical] from comment #3)
> We already do flush on unlock.
> The code that crashes in ~DrawTargetD2D is mRT->EndDraw() which is called
> regardless of flush, but doesn't always crash (I have hit the crash very
> rarely).
> http://dxr.mozilla.org/mozilla-central/source/gfx/2d/DrawTargetD2D.cpp#185

We need to figure out how drawing commands ended up in the buffer. I worry the cost of this change is too high.

Comment 5

[Nicolas Silva [:nical]]

Attachment: Ensure that the texture is accessible when the DrawTarget is destroyed to avoid crash in debug mode

Comment 6

[Nicolas Silva [:nical]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/542f9093ec36

Comment 7

[Nicolas Silva [:nical]]

fix build bustage on inbound https://hg.mozilla.org/integration/mozilla-inbound/rev/5741926de900

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/542f9093ec36
https://hg.mozilla.org/mozilla-central/rev/5741926de900