974709 - ABORT: X_GLXVendorPrivate: BadValue in mozilla::layers::X11TextureSourceOGL::BindTexture w/nvidia proprietary drivers

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[John Schoenick [:johns]]

This bug was filed from the Socorro interface and is 
report bp-d22b400f-eef1-43e2-adb3-e4b9f2140220.
=============================================================

As of bug 973227, starting nightly with acceleration enabled results in an immediate abort on the nvidia proprietary drivers (331.38, newest stable)

> [5466] ###!!! ABORT: X_GLXVendorPrivate: BadValue (integer parameter out of range for operation); 1201 requests ago: file /mnt/N/moz/moz-git-build-refox/toolkit/xre/nsX11ErrorHandler.cpp, line 

Backtrace in linked report. This doesn't reproduce on systems with other drivers -- I'm able to test patches if needed.

Comment 1

[Tom S [:evilpie]]

Oh I guess we need to call xReleaseTexImage in the X11TextureSourceOGL destructor or somewhere else. The driver probably OOMs. Just to be sure we might also want to add a null check to GetGLXPixmap. Can ::Bind be called multiple times?

Comment 2

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

The browser was working for me but suddenly stopped and now crashes at start up. It appears to be happening on the second frame.

Comment 3

[Matt Woodrow (:mattwoodrow)]

Looking at nvidia's spec (http://developer.download.nvidia.com/opengl/specs/GLX_EXT_texture_from_pixmap.txt), it looks like BadValue should only be generated for glXBindTexImageEXT if the buffer parameter is invalid.

We always pass GLX_FRONT_LEFT_EXT, which is listed as being valid, and our local define matches the integer value from the spec.

Comment 4

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

Does not reproduce for me on Intel drivers.

Comment 5

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

Reproduces on nvidia-304, 319 and 331.

Comment 6

[Andrew Sutherland [:asuth] (he/him)]

Bug 885100 comment 0 by :billm seems relevant:
===
I've been trying to get hardware acceleration working with OMTC on my Linux machine. Without this patch, I was getting errors about "X ERROR: BadValue" from a call to glXBindTexImageEXT. My nVidia driver doesn't like it when you call glXBindTexImageEXT twice on the same pixmap/buffer combination without a call to glXReleaseTexImageEXT in between.

This patch just does the release calls. It allows me to run with OMTC and accelerated layers enabled.
===

Bug 942506 seems to have removed the calls to UnbindTexture from AutoBindTexture in this commit:
https://hg.mozilla.org/mozilla-central/rev/01df0b7dcd8f


FWIW, I did try adding the unbind in the X11TextureSourceOGL as per comment 1, but that did not fix the problem.  Presumably another bind call happens before that release.

Comment 7

[Andrew Sutherland [:asuth] (he/him)]

a (maybe overkill?) workaround for those affected is to add the following pref to your profile:
pref("layers.acceleration.disabled", true);

Comment 8

[Tom S [:evilpie]]

If you are using GTK gfx.xrender.enabled should work.

Comment 9

[Andrew Sutherland [:asuth] (he/him)]

(In reply to Tom Schuster [:evilpie] from comment #8)
> If you are using GTK gfx.xrender.enabled should work.

Yes, works, thanks!:
pref("gfx.xrender.enabled", false);

Comment 10

[Matt Woodrow (:mattwoodrow)]

I'll try fix this.

Comment 11

[Matt Woodrow (:mattwoodrow)]

Attachment: Use a separate texture for each X11TextureSource and keep the pixmap bound

Not tested yet, but this should fix it. Requires the patch from bug 680817.

Comment 12

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

Attachment: Use a separate texture for each X11TextureSource and keep the pixmap bound;

Comment 13

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

bzexport!

Comment 14

[John Schoenick [:johns]]

This fixes the startup crash issue for me. I'm now seeing an occasional black tab bar, but I'll regression-hunt that separately and open another bug.

Comment 15

[Andrew Sutherland [:asuth] (he/him)]

(In reply to Matt Woodrow (:mattwoodrow) from comment #11)
> Not tested yet, but this should fix it. Requires the patch from bug 680817.

I can confirm the current (:k17e) patch on top of the patch from bug 680817 fixes things for me on a b2g-desktop build with nvidida 331 drivers on Ubuntu 13.10 on x64 on a GTX 660.  (And if I pop the stack and rebuild, the crashes come back, so I didn't screw up the preferences.)

Comment 16

[Andrew Sutherland [:asuth] (he/him)]

Er, but I am seeing a crash from b2g-desktop on shutdown with this patch that seems related to the changes.  (Note that this is after Gaia fails to start up right, but that could be any number of things related to recent OOP changes, etc.)

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffd22ff700 (LWP 27795)]
mozilla::layers::X11TextureSourceOGL::DeallocateDeviceData (this=0x7fffd418aba0) at mozilla-central/gfx/layers/opengl/X11TextureSourceOGL.cpp:33
33	    if (gl()->MakeCurrent()) {
(gdb) bt
#0  mozilla::layers::X11TextureSourceOGL::DeallocateDeviceData (this=0x7fffd418aba0) at mozilla-central/gfx/layers/opengl/X11TextureSourceOGL.cpp:33
#1  0x00007ffff41f0c10 in mozilla::layers::X11TextureSourceOGL::~X11TextureSourceOGL (this=0x7fffd418aba0, __in_chrg=<optimized out>) at mozilla-central/gfx/layers/opengl/X11TextureSourceOGL.cpp:26
#2  0x00007ffff41f0c41 in mozilla::layers::X11TextureSourceOGL::~X11TextureSourceOGL (this=0x7fffd418aba0, __in_chrg=<optimized out>) at mozilla-central/gfx/layers/opengl/X11TextureSourceOGL.cpp:27
#3  0x00007ffff41f06a0 in unref (t=<optimized out>) at ../../dist/include/mozilla/RefPtr.h:203
#4  ~RefPtr (this=0x7fffdf8aa930, __in_chrg=<optimized out>) at ../../dist/include/mozilla/RefPtr.h:153
#5  mozilla::layers::X11TextureHost::~X11TextureHost (this=0x7fffdf8aa910, __in_chrg=<optimized out>) at mozilla-central/gfx/layers/composite/X11TextureHost.h:19
#6  0x00007ffff41f06b3 in mozilla::layers::X11TextureHost::~X11TextureHost (this=0x7fffdf8aa910, __in_chrg=<optimized out>) at mozilla-central/gfx/layers/composite/X11TextureHost.h:19
#7  0x00007ffff4220832 in unref (t=<optimized out>) at ../../dist/include/mozilla/RefPtr.h:203
#8  mozilla::RefPtr<mozilla::layers::TextureHost>::assign (this=0x7fffd47c3d78, t=0x0) at ../../dist/include/mozilla/RefPtr.h:189
#9  0x00007ffff3fb48ea in mozilla::layers::PLayerTransactionParent::DestroySubtree (this=0x7fffdf890620, why=why@entry=mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::Deletion) at mozilla-central/obj-b2g/ipc/ipdl/PLayerTransactionParent.cpp:890
#10 0x00007ffff3fb4f74 in mozilla::layers::PLayerTransactionParent::OnMessageReceived (this=0x7fffdf890620, __msg=...) at mozilla-central/obj-b2g/ipc/ipdl/PLayerTransactionParent.cpp:535
#11 0x00007ffff3f4c66a in mozilla::layers::PCompositorParent::OnMessageReceived (this=0x7fffe3873800, __msg=...) at mozilla-central/obj-b2g/ipc/ipdl/PCompositorParent.cpp:371
...

Comment 17

[Matt Woodrow (:mattwoodrow)]

Attachment: Use a separate texture for each X11TextureSource and keep the pixmap bound

Does this fix the shutdown crash?

Comment 18

[Andrew Sutherland [:asuth] (he/him)]

Attachment: gdb "p *mCompositor" at crash time, followed by "bt full"

(In reply to Matt Woodrow (:mattwoodrow) from comment #17)
> Created attachment 8380155 [details] [diff] [review]
> Use a separate texture for each X11TextureSource and keep the pixmap bound
> 
> Does this fix the shutdown crash?

No, still crashy with exactly the same stack trace.  I've attached "p *mCompositor" and "bt full" at crash time if that helps at all.  mCompositor is fine, its mGLContext is null; probably obvious.

Also, the revised patch is netting me worse graphical artifacts.  On the previous patch (attachment 8379413 [details] [diff] [review]) the B2G lock screen looks and works fine and the home screen looks fine.  When you drag between cards/screens on the home screen the areas with the icons go black while draggin them.  When you release, they paint again, get replaced with black again for a split second, then become correct again.

With the new patch the lock screen displays incorrectly; the slider widget (which is done using canvas, I believe) is all black.  When I try and unlock the screen, weird glitchy stuff happens although I do end up seeing the unlock canvas animation.  But then things go all black.  If I drag around to slide the homescreen cards, the various layers will appear for fractional seconds before disappearing.  Presumably the texture is getting destroyed too eagerly?

Comment 19

[Nicolas Silva [:nical]]

Comment on attachment 8380155 [details] [diff] [review]
Use a separate texture for each X11TextureSource and keep the pixmap bound

Review of attachment 8380155 [details] [diff] [review]:
-----------------------------------------------------------------

Canceling the review since a comment on the bug indicates that it doesn't work.

Comment 20

[Matt Woodrow (:mattwoodrow)]

Attachment: Use a separate texture for each X11TextureSource and keep the pixmap bound

This should fix the crash and most of the rendering issues.

It looks like component alpha layers are still broken (they render black), but that's an existing problem.

Comment 21

[Andrew Sutherland [:asuth] (he/him)]

(In reply to Matt Woodrow (:mattwoodrow) from comment #20)
> This should fix the crash and most of the rendering issues.

Confirming.  No more crashes on shutdown.  Graphical behaviour is improved from the v1 patch.  The icon-holding divs/whatever on the home-screen turn black when dragging between pages, but once the animation stops and they paint, they stay painted.  (There is no longer an additional flash of black.)

Comment 22

[Matt Woodrow (:mattwoodrow)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5ae2a4860eca

Comment 23

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/5ae2a4860eca