Crash in gpu::gles2::TextureManager::~TextureManager()

Bug #1398354 reported by Olivier Tilloy
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Oxide
New
Undecided
Unassigned

Bug Description

I’m seeing an oxide crash when running webapp-container autopilot tests on a phone (oxide 1.3.5-0ubuntu1 on vivid).
Here’s the backtrace:

#0 0xb5cd98e6 in ?? () from /lib/arm-linux-gnueabihf/libc.so.6
#1 0xb5ce7e5e in raise () from /lib/arm-linux-gnueabihf/libc.so.6
#2 0xb5ce8b4e in abort () from /lib/arm-linux-gnueabihf/libc.so.6
#3 0xae0264be in base::debug::BreakDebugger ()
    at ../../../../third_party/chromium/src/base/debug/debugger_posix.cc:241
#4 0xae042ed6 in logging::LogMessage::~LogMessage (this=0xb5dad0ac, __in_chrg=<optimized out>)
    at ../../../../third_party/chromium/src/base/logging.cc:644
#5 0xae1484ee in gpu::gles2::TextureManager::~TextureManager (this=0xb1fcc6d8, __in_chrg=<optimized out>)
    at ../../../../third_party/chromium/src/gpu/command_buffer/service/texture_manager.cc:36
#6 0xae104aac in operator() (this=0xb1f5503c, ptr=0xb1fcc6d8)
    at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:137
#7 reset (p=0x0, this=0xb1f5503c) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:246
#8 reset (p=0x0, this=0xb1f5503c) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:367
#9 gpu::gles2::ContextGroup::Destroy (this=0xb1f54ff0, decoder=decoder@entry=0xb1f3dbc8,
    have_context=have_context@entry=true)
    at ../../../../third_party/chromium/src/gpu/command_buffer/service/context_group.cc:315
#10 0xae12cbfe in gpu::gles2::GLES2DecoderImpl::Destroy (this=0xb1f3dbc8, have_context=<optimized out>)
    at ../../../../third_party/chromium/src/gpu/command_buffer/service/gles2_cmd_decoder.cc:3546
#11 0xae594802 in content::GpuCommandBufferStub::Destroy (this=this@entry=0xb1f2b8d0)
    at ../../../../third_party/chromium/src/content/common/gpu/gpu_command_buffer_stub.cc:438
#12 0xae594942 in content::GpuCommandBufferStub::~GpuCommandBufferStub (this=0xb1f2b8d0, __in_chrg=<optimized out>)
    at ../../../../third_party/chromium/src/content/common/gpu/gpu_command_buffer_stub.cc:204
#13 0xae594ab0 in content::GpuCommandBufferStub::~GpuCommandBufferStub (this=0xb1f2b8d0, __in_chrg=<optimized out>)
    at ../../../../third_party/chromium/src/content/common/gpu/gpu_command_buffer_stub.cc:208
#14 0xae5908f6 in release_all (table=0xb1f0a510) at ../../../../third_party/chromium/src/base/id_map.h:224
#15 ~IDMap (this=0xb1f0a4f0, __in_chrg=<optimized out>) at ../../../../third_party/chromium/src/base/id_map.h:53
#16 content::GpuChannel::~GpuChannel (this=0xb1f0a458, __in_chrg=<optimized out>)
    at ../../../../third_party/chromium/src/content/common/gpu/gpu_channel.cc:425
#17 0xae590ab8 in content::GpuChannel::~GpuChannel (this=0xb1f0a458, __in_chrg=<optimized out>)
    at ../../../../third_party/chromium/src/content/common/gpu/gpu_channel.cc:429
#18 0xae591ab2 in STLDeleteValues<__gnu_cxx::hash_map<int, content::GpuChannel*, __gnu_cxx::hash<int>, std::equal_to<int>, std::allocator<content::GpuChannel*> > > (container=container@entry=0xb1f09c0c)
    at ../../../../third_party/chromium/src/base/stl_util.h:152
#19 0xae591ae4 in clear (this=0xb1f09c0c)
    at ../../../../third_party/chromium/src/base/containers/scoped_ptr_hash_map.h:122
#20 content::GpuChannelManager::~GpuChannelManager (this=0xb1f09bf8, __in_chrg=<optimized out>)
    at ../../../../third_party/chromium/src/content/common/gpu/gpu_channel_manager.cc:105
#21 0xae591c40 in content::GpuChannelManager::~GpuChannelManager (this=0xb1f09bf8, __in_chrg=<optimized out>)
    at ../../../../third_party/chromium/src/content/common/gpu/gpu_channel_manager.cc:110
#22 0xaf938428 in operator() (this=0xb1f05184, ptr=<optimized out>)
    at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:137
#23 ~scoped_ptr_impl (this=0xb1f05184, __in_chrg=<optimized out>)
    at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:220
#24 ~scoped_ptr (this=0xb1f05184, __in_chrg=<optimized out>)
    at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:310
#25 content::GpuChildThread::~GpuChildThread (this=0xb1f050d0, __in_chrg=<optimized out>)
    at ../../../../third_party/chromium/src/content/gpu/gpu_child_thread.cc:93
#26 0xaf938498 in content::GpuChildThread::~GpuChildThread (this=0xb1f050d0, __in_chrg=<optimized out>)
    at ../../../../third_party/chromium/src/content/gpu/gpu_child_thread.cc:95
#27 0xaf8ed534 in operator() (this=0xb1f04d04, ptr=<optimized out>)
    at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:137
#28 reset (p=0x0, this=0xb1f04d04) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:246
#29 reset (p=0x0, this=0xb1f04d04) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:367
#30 content::ChildProcess::~ChildProcess (this=0xb1f04cd8, __in_chrg=<optimized out>)
    at ../../../../third_party/chromium/src/content/child/child_process.cc:68
#31 0xaf937b48 in ~GpuProcess (this=0xb1f04cd8, __in_chrg=<optimized out>)
    at ../../../../third_party/chromium/src/content/gpu/gpu_process.cc:13
#32 content::GpuProcess::~GpuProcess (this=0xb1f04cd8, __in_chrg=<optimized out>)
    at ../../../../third_party/chromium/src/content/gpu/gpu_process.cc:13
#33 0xae063310 in base::Thread::ThreadMain (this=0xac21a028)
    at ../../../../third_party/chromium/src/base/threading/thread.cc:232
#34 0xae060992 in base::(anonymous namespace)::ThreadFunc (params=<optimized out>)
    at ../../../../third_party/chromium/src/base/threading/platform_thread_posix.cc:80
#35 0xb5ca4f98 in start_thread () from /lib/arm-linux-gnueabihf/libpthread.so.0
#36 0xb5d5533c in ?? () from /lib/arm-linux-gnueabihf/libc.so.6
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

The check that causes the abort is the following:

    CHECK_EQ(texture_count_, 0u);

(when that happens, texture_count_ equals 1).

Revision history for this message
Olivier Tilloy (osomon) wrote :
Revision history for this message
Olivier Tilloy (osomon) wrote :

Note that the autopilot tests still succeed, so the crash probably happens when killing the application, after the test has run.

Revision history for this message
Olivier Tilloy (osomon) wrote :

I just observed the crash again, and texture_count_ was equal to 2.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.