ABORT: X_GLXVendorPrivate: BadValue in mozilla::layers::X11TextureSourceOGL::BindTexture w/nvidia proprietary drivers

RESOLVED FIXED in mozilla30

Status

()

defect
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: johns, Assigned: mattwoodrow)

Tracking

({crash, reproducible})

unspecified
mozilla30
All
Linux
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments, 3 obsolete attachments)

This bug was filed from the Socorro interface and is 
report bp-d22b400f-eef1-43e2-adb3-e4b9f2140220.
=============================================================

As of bug 973227, starting nightly with acceleration enabled results in an immediate abort on the nvidia proprietary drivers (331.38, newest stable)

> [5466] ###!!! ABORT: X_GLXVendorPrivate: BadValue (integer parameter out of range for operation); 1201 requests ago: file /mnt/N/moz/moz-git-build-refox/toolkit/xre/nsX11ErrorHandler.cpp, line 

Backtrace in linked report. This doesn't reproduce on systems with other drivers -- I'm able to test patches if needed.
Oh I guess we need to call xReleaseTexImage in the X11TextureSourceOGL destructor or somewhere else. The driver probably OOMs. Just to be sure we might also want to add a null check to GetGLXPixmap. Can ::Bind be called multiple times?
The browser was working for me but suddenly stopped and now crashes at start up. It appears to be happening on the second frame.
Looking at nvidia's spec (http://developer.download.nvidia.com/opengl/specs/GLX_EXT_texture_from_pixmap.txt), it looks like BadValue should only be generated for glXBindTexImageEXT if the buffer parameter is invalid.

We always pass GLX_FRONT_LEFT_EXT, which is listed as being valid, and our local define matches the integer value from the spec.
Does not reproduce for me on Intel drivers.
Reproduces on nvidia-304, 319 and 331.
Assignee: nobody → evilpies
Blocks: e10s
Bug 885100 comment 0 by :billm seems relevant:
===
I've been trying to get hardware acceleration working with OMTC on my Linux machine. Without this patch, I was getting errors about "X ERROR: BadValue" from a call to glXBindTexImageEXT. My nVidia driver doesn't like it when you call glXBindTexImageEXT twice on the same pixmap/buffer combination without a call to glXReleaseTexImageEXT in between.

This patch just does the release calls. It allows me to run with OMTC and accelerated layers enabled.
===

Bug 942506 seems to have removed the calls to UnbindTexture from AutoBindTexture in this commit:
https://hg.mozilla.org/mozilla-central/rev/01df0b7dcd8f


FWIW, I did try adding the unbind in the X11TextureSourceOGL as per comment 1, but that did not fix the problem.  Presumably another bind call happens before that release.
a (maybe overkill?) workaround for those affected is to add the following pref to your profile:
pref("layers.acceleration.disabled", true);
If you are using GTK gfx.xrender.enabled should work.
(In reply to Tom Schuster [:evilpie] from comment #8)
> If you are using GTK gfx.xrender.enabled should work.

Yes, works, thanks!:
pref("gfx.xrender.enabled", false);
I'll try fix this.
Assignee: evilpies → matt.woodrow
Depends on: 680817
Not tested yet, but this should fix it. Requires the patch from bug 680817.
Assignee: matt.woodrow → ajones
Status: NEW → ASSIGNED
bzexport!
Assignee: ajones → matt.woodrow
This fixes the startup crash issue for me. I'm now seeing an occasional black tab bar, but I'll regression-hunt that separately and open another bug.
(In reply to Matt Woodrow (:mattwoodrow) from comment #11)
> Not tested yet, but this should fix it. Requires the patch from bug 680817.

I can confirm the current (:k17e) patch on top of the patch from bug 680817 fixes things for me on a b2g-desktop build with nvidida 331 drivers on Ubuntu 13.10 on x64 on a GTX 660.  (And if I pop the stack and rebuild, the crashes come back, so I didn't screw up the preferences.)
Er, but I am seeing a crash from b2g-desktop on shutdown with this patch that seems related to the changes.  (Note that this is after Gaia fails to start up right, but that could be any number of things related to recent OOP changes, etc.)

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffd22ff700 (LWP 27795)]
mozilla::layers::X11TextureSourceOGL::DeallocateDeviceData (this=0x7fffd418aba0) at mozilla-central/gfx/layers/opengl/X11TextureSourceOGL.cpp:33
33	    if (gl()->MakeCurrent()) {
(gdb) bt
#0  mozilla::layers::X11TextureSourceOGL::DeallocateDeviceData (this=0x7fffd418aba0) at mozilla-central/gfx/layers/opengl/X11TextureSourceOGL.cpp:33
#1  0x00007ffff41f0c10 in mozilla::layers::X11TextureSourceOGL::~X11TextureSourceOGL (this=0x7fffd418aba0, __in_chrg=<optimized out>) at mozilla-central/gfx/layers/opengl/X11TextureSourceOGL.cpp:26
#2  0x00007ffff41f0c41 in mozilla::layers::X11TextureSourceOGL::~X11TextureSourceOGL (this=0x7fffd418aba0, __in_chrg=<optimized out>) at mozilla-central/gfx/layers/opengl/X11TextureSourceOGL.cpp:27
#3  0x00007ffff41f06a0 in unref (t=<optimized out>) at ../../dist/include/mozilla/RefPtr.h:203
#4  ~RefPtr (this=0x7fffdf8aa930, __in_chrg=<optimized out>) at ../../dist/include/mozilla/RefPtr.h:153
#5  mozilla::layers::X11TextureHost::~X11TextureHost (this=0x7fffdf8aa910, __in_chrg=<optimized out>) at mozilla-central/gfx/layers/composite/X11TextureHost.h:19
#6  0x00007ffff41f06b3 in mozilla::layers::X11TextureHost::~X11TextureHost (this=0x7fffdf8aa910, __in_chrg=<optimized out>) at mozilla-central/gfx/layers/composite/X11TextureHost.h:19
#7  0x00007ffff4220832 in unref (t=<optimized out>) at ../../dist/include/mozilla/RefPtr.h:203
#8  mozilla::RefPtr<mozilla::layers::TextureHost>::assign (this=0x7fffd47c3d78, t=0x0) at ../../dist/include/mozilla/RefPtr.h:189
#9  0x00007ffff3fb48ea in mozilla::layers::PLayerTransactionParent::DestroySubtree (this=0x7fffdf890620, why=why@entry=mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::Deletion) at mozilla-central/obj-b2g/ipc/ipdl/PLayerTransactionParent.cpp:890
#10 0x00007ffff3fb4f74 in mozilla::layers::PLayerTransactionParent::OnMessageReceived (this=0x7fffdf890620, __msg=...) at mozilla-central/obj-b2g/ipc/ipdl/PLayerTransactionParent.cpp:535
#11 0x00007ffff3f4c66a in mozilla::layers::PCompositorParent::OnMessageReceived (this=0x7fffe3873800, __msg=...) at mozilla-central/obj-b2g/ipc/ipdl/PCompositorParent.cpp:371
...
Does this fix the shutdown crash?
Attachment #8379413 - Attachment is obsolete: true
Attachment #8379413 - Flags: review?(nical.bugzilla)
Attachment #8380155 - Flags: review?(nical.bugzilla)
(In reply to Matt Woodrow (:mattwoodrow) from comment #17)
> Created attachment 8380155 [details] [diff] [review]
> Use a separate texture for each X11TextureSource and keep the pixmap bound
> 
> Does this fix the shutdown crash?

No, still crashy with exactly the same stack trace.  I've attached "p *mCompositor" and "bt full" at crash time if that helps at all.  mCompositor is fine, its mGLContext is null; probably obvious.

Also, the revised patch is netting me worse graphical artifacts.  On the previous patch (attachment 8379413 [details] [diff] [review]) the B2G lock screen looks and works fine and the home screen looks fine.  When you drag between cards/screens on the home screen the areas with the icons go black while draggin them.  When you release, they paint again, get replaced with black again for a split second, then become correct again.

With the new patch the lock screen displays incorrectly; the slider widget (which is done using canvas, I believe) is all black.  When I try and unlock the screen, weird glitchy stuff happens although I do end up seeing the unlock canvas animation.  But then things go all black.  If I drag around to slide the homescreen cards, the various layers will appear for fractional seconds before disappearing.  Presumably the texture is getting destroyed too eagerly?
Comment on attachment 8380155 [details] [diff] [review]
Use a separate texture for each X11TextureSource and keep the pixmap bound

Review of attachment 8380155 [details] [diff] [review]:
-----------------------------------------------------------------

Canceling the review since a comment on the bug indicates that it doesn't work.
Attachment #8380155 - Flags: review?(nical.bugzilla)
This should fix the crash and most of the rendering issues.

It looks like component alpha layers are still broken (they render black), but that's an existing problem.
Attachment #8380155 - Attachment is obsolete: true
Attachment #8381148 - Flags: review?(nical.bugzilla)
Attachment #8381148 - Flags: review?(nical.bugzilla) → review+
(In reply to Matt Woodrow (:mattwoodrow) from comment #20)
> This should fix the crash and most of the rendering issues.

Confirming.  No more crashes on shutdown.  Graphical behaviour is improved from the v1 patch.  The icon-holding divs/whatever on the home-screen turn black when dragging between pages, but once the animation stops and they paint, they stay painted.  (There is no longer an additional flash of black.)
https://hg.mozilla.org/mozilla-central/rev/5ae2a4860eca
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
Depends on: 978282
You need to log in before you can comment on or make changes to this bug.