So, despite us ensuring that the client-side doesn't delete its command buffer as long as we hold a TextureRef (which should keep the service-side command buffer, ContextGroup and associated TextureManager alive, thus preventing this crash), it looks like the service-side gets shut-down before the client-side has cleaned up:
#0 0x00007ffff1348d27 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1 0x00007ffff134a418 in __GI_abort () at abort.c:89
#2 0x00007ffff255ee69 in base::debug::BreakDebugger () at ../../../../third_party/chromium/src/base/debug/debugger_posix.cc:241
#3 0x00007ffff2586ed5 in logging::LogMessage::~LogMessage (this=0x7fffa080a920, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/base/logging.cc:640
#4 0x00007ffff27272cb in gpu::gles2::TextureManager::~TextureManager (this=0x7fff81400170, __in_chrg=<optimised out>)
at ../../../../third_party/chromium/src/gpu/command_buffer/service/texture_manager.cc:103
#5 0x00007ffff26c3521 in operator() (this=0x7fff80010268, ptr=0x7fff81400170) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:127
#6 reset (p=0x0, this=0x7fff80010268) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:247
#7 reset (p=0x0, this=0x7fff80010268) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:376
#8 gpu::gles2::ContextGroup::Destroy (this=0x7fff800101f0, decoder=decoder@entry=0x7fff829140e0, have_context=have_context@entry=true)
at ../../../../third_party/chromium/src/gpu/command_buffer/service/context_group.cc:312
#9 0x00007ffff26f4a84 in gpu::gles2::GLES2DecoderImpl::Destroy (this=0x7fff829140e0, have_context=<optimised out>)
at ../../../../third_party/chromium/src/gpu/command_buffer/service/gles2_cmd_decoder.cc:3684
#10 0x00007ffff319ae56 in content::GpuCommandBufferStub::Destroy (this=this@entry=0x7fff8140f2f0)
at ../../../../third_party/chromium/src/content/common/gpu/gpu_command_buffer_stub.cc:437
#11 0x00007ffff319b0e2 in content::GpuCommandBufferStub::~GpuCommandBufferStub (this=this@entry=0x7fff8140f2f0, __in_chrg=<optimised out>)
at ../../../../third_party/chromium/src/content/common/gpu/gpu_command_buffer_stub.cc:205
#12 0x00007ffff319b2f9 in content::GpuCommandBufferStub::~GpuCommandBufferStub (this=0x7fff8140f2f0, __in_chrg=<optimised out>)
at ../../../../third_party/chromium/src/content/common/gpu/gpu_command_buffer_stub.cc:209
#13 0x00007ffff319326c in release_all (table=0x7fff8000a530) at ../../../../third_party/chromium/src/base/id_map.h:224
#14 ~IDMap (this=0x7fff8000a4f0, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/base/id_map.h:53
#15 content::GpuChannel::~GpuChannel (this=this@entry=0x7fff8000a3c0, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/content/common/gpu/gpu_channel.cc:430
#16 0x00007ffff31934d9 in content::GpuChannel::~GpuChannel (this=0x7fff8000a3c0, __in_chrg=<optimised out>)
at ../../../../third_party/chromium/src/content/common/gpu/gpu_channel.cc:434
#17 0x00007ffff31950bf in STLDeleteValues<__gnu_cxx::hash_map<int, content::GpuChannel*, base_hash::hash<int>, std::equal_to<int>, std::allocator<std::pair<int const, content::GpuChannel*> > > > (container=0x29d3, container@entry=0x7fff80009308) at ../../../../third_party/chromium/src/base/stl_util.h:152
#18 0x00007ffff3195118 in clear (this=0x7fff80009308) at ../../../../third_party/chromium/src/base/containers/scoped_ptr_hash_map.h:122
#19 content::GpuChannelManager::~GpuChannelManager (this=0x7fff800092e0, __in_chrg=<optimised out>)
at ../../../../third_party/chromium/src/content/common/gpu/gpu_channel_manager.cc:122
#20 0x00007ffff3195329 in content::GpuChannelManager::~GpuChannelManager (this=0x7fff800092e0, __in_chrg=<optimised out>)
at ../../../../third_party/chromium/src/content/common/gpu/gpu_channel_manager.cc:127
#21 0x00007ffff4ccada7 in operator() (this=0x7fff800025b8, ptr=<optimised out>) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:127
#22 ~scoped_ptr_impl (this=0x7fff800025b8, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:221
#23 ~scoped_ptr (this=0x7fff800025b8, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:311
#24 content::GpuChildThread::~GpuChildThread (this=0x7fff80002430, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/content/gpu/gpu_child_thread.cc:92
#25 0x00007ffff4ccae49 in content::GpuChildThread::~GpuChildThread (this=0x7fff80002430, __in_chrg=<optimised out>)
at ../../../../third_party/chromium/src/content/gpu/gpu_child_thread.cc:94
#26 0x00007ffff4c533f3 in operator() (this=0x7fff80002028, ptr=<optimised out>) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:127
#27 reset (p=0x0, this=0x7fff80002028) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:247
#28 reset (p=0x0, this=0x7fff80002028) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:376
#29 content::ChildProcess::~ChildProcess (this=0x7fff80001fd0, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/content/child/child_process.cc:68
#30 0x00007ffff4cca8f3 in ~GpuProcess (this=0x7fff80001fd0, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/content/gpu/gpu_process.cc:12
#31 content::GpuProcess::~GpuProcess (this=0x7fff80001fd0, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/content/gpu/gpu_process.cc:13
#32 0x00007ffff25b9035 in base::Thread::ThreadMain (this=0x7fff84022600) at ../../../../third_party/chromium/src/base/threading/thread.cc:232
#33 0x00007ffff25b561e in base::(anonymous namespace)::ThreadFunc (params=<optimised out>) at ../../../../third_party/chromium/src/base/threading/platform_thread_posix.cc:80
#34 0x00007ffff10fc0a5 in start_thread (arg=0x7fffa080b700) at pthread_create.c:309
#35 0x00007ffff140c77d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
So, despite us ensuring that the client-side doesn't delete its command buffer as long as we hold a TextureRef (which should keep the service-side command buffer, ContextGroup and associated TextureManager alive, thus preventing this crash), it looks like the service-side gets shut-down before the client-side has cleaned up:
#0 0x00007ffff1348d27 in __GI_raise (sig=sig@entry=6) at ../nptl/ sysdeps/ unix/sysv/ linux/raise. c:56 :BreakDebugger () at ../../. ./../third_ party/chromium/ src/base/ debug/debugger_ posix.cc: 241 :LogMessage: :~LogMessage (this=0x7fffa08 0a920, __in_chrg= <optimised out>) at ../../. ./../third_ party/chromium/ src/base/ logging. cc:640 :TextureManager ::~TextureManag er (this=0x7fff814 00170, __in_chrg= <optimised out>) ./../third_ party/chromium/ src/gpu/ command_ buffer/ service/ texture_ manager. cc:103 10268, ptr=0x7fff81400170) at ../../. ./../third_ party/chromium/ src/base/ memory/ scoped_ ptr.h:127 0268) at ../../. ./../third_ party/chromium/ src/base/ memory/ scoped_ ptr.h:247 0268) at ../../. ./../third_ party/chromium/ src/base/ memory/ scoped_ ptr.h:376 :ContextGroup: :Destroy (this=0x7fff800 101f0, decoder= decoder@ entry=0x7fff829 140e0, have_context= have_context@ entry=true) ./../third_ party/chromium/ src/gpu/ command_ buffer/ service/ context_ group.cc: 312 :GLES2DecoderIm pl::Destroy (this=0x7fff829 140e0, have_context= <optimised out>) ./../third_ party/chromium/ src/gpu/ command_ buffer/ service/ gles2_cmd_ decoder. cc:3684 :GpuCommandBuff erStub: :Destroy (this=this@ entry=0x7fff814 0f2f0) ./../third_ party/chromium/ src/content/ common/ gpu/gpu_ command_ buffer_ stub.cc: 437 :GpuCommandBuff erStub: :~GpuCommandBuf ferStub (this=this@ entry=0x7fff814 0f2f0, __in_chrg= <optimised out>) ./../third_ party/chromium/ src/content/ common/ gpu/gpu_ command_ buffer_ stub.cc: 205 :GpuCommandBuff erStub: :~GpuCommandBuf ferStub (this=0x7fff814 0f2f0, __in_chrg= <optimised out>) ./../third_ party/chromium/ src/content/ common/ gpu/gpu_ command_ buffer_ stub.cc: 209 0x7fff8000a530) at ../../. ./../third_ party/chromium/ src/base/ id_map. h:224 0a4f0, __in_chrg= <optimised out>) at ../../. ./../third_ party/chromium/ src/base/ id_map. h:53 :GpuChannel: :~GpuChannel (this=this@ entry=0x7fff800 0a3c0, __in_chrg= <optimised out>) at ../../. ./../third_ party/chromium/ src/content/ common/ gpu/gpu_ channel. cc:430 :GpuChannel: :~GpuChannel (this=0x7fff800 0a3c0, __in_chrg= <optimised out>) ./../third_ party/chromium/ src/content/ common/ gpu/gpu_ channel. cc:434 <__gnu_ cxx::hash_ map<int, content: :GpuChannel* , base_hash: :hash<int> , std::equal_to<int>, std::allocator< std::pair< int const, content: :GpuChannel* > > > > (container=0x29d3, container@ entry=0x7fff800 09308) at ../../. ./../third_ party/chromium/ src/base/ stl_util. h:152 09308) at ../../. ./../third_ party/chromium/ src/base/ containers/ scoped_ ptr_hash_ map.h:122 :GpuChannelMana ger::~GpuChanne lManager (this=0x7fff800 092e0, __in_chrg= <optimised out>) ./../third_ party/chromium/ src/content/ common/ gpu/gpu_ channel_ manager. cc:122 :GpuChannelMana ger::~GpuChanne lManager (this=0x7fff800 092e0, __in_chrg= <optimised out>) ./../third_ party/chromium/ src/content/ common/ gpu/gpu_ channel_ manager. cc:127 025b8, ptr=<optimised out>) at ../../. ./../third_ party/chromium/ src/base/ memory/ scoped_ ptr.h:127 025b8, __in_chrg= <optimised out>) at ../../. ./../third_ party/chromium/ src/base/ memory/ scoped_ ptr.h:221 025b8, __in_chrg= <optimised out>) at ../../. ./../third_ party/chromium/ src/base/ memory/ scoped_ ptr.h:311 :GpuChildThread ::~GpuChildThre ad (this=0x7fff800 02430, __in_chrg= <optimised out>) at ../../. ./../third_ party/chromium/ src/content/ gpu/gpu_ child_thread. cc:92 :GpuChildThread ::~GpuChildThre ad (this=0x7fff800 02430, __in_chrg= <optimised out>) ./../third_ party/chromium/ src/content/ gpu/gpu_ child_thread. cc:94 02028, ptr=<optimised out>) at ../../. ./../third_ party/chromium/ src/base/ memory/ scoped_ ptr.h:127 2028) at ../../. ./../third_ party/chromium/ src/base/ memory/ scoped_ ptr.h:247 2028) at ../../. ./../third_ party/chromium/ src/base/ memory/ scoped_ ptr.h:376 :ChildProcess: :~ChildProcess (this=0x7fff800 01fd0, __in_chrg= <optimised out>) at ../../. ./../third_ party/chromium/ src/content/ child/child_ process. cc:68 01fd0, __in_chrg= <optimised out>) at ../../. ./../third_ party/chromium/ src/content/ gpu/gpu_ process. cc:12 :GpuProcess: :~GpuProcess (this=0x7fff800 01fd0, __in_chrg= <optimised out>) at ../../. ./../third_ party/chromium/ src/content/ gpu/gpu_ process. cc:13 :ThreadMain (this=0x7fff840 22600) at ../../. ./../third_ party/chromium/ src/base/ threading/ thread. cc:232 ::ThreadFunc (params=<optimised out>) at ../../. ./../third_ party/chromium/ src/base/ threading/ platform_ thread_ posix.cc: 80 b700) at pthread_ create. c:309 unix/sysv/ linux/x86_ 64/clone. S:111
#1 0x00007ffff134a418 in __GI_abort () at abort.c:89
#2 0x00007ffff255ee69 in base::debug:
#3 0x00007ffff2586ed5 in logging:
#4 0x00007ffff27272cb in gpu::gles2:
at ../../.
#5 0x00007ffff26c3521 in operator() (this=0x7fff800
#6 reset (p=0x0, this=0x7fff8001
#7 reset (p=0x0, this=0x7fff8001
#8 gpu::gles2:
at ../../.
#9 0x00007ffff26f4a84 in gpu::gles2:
at ../../.
#10 0x00007ffff319ae56 in content:
at ../../.
#11 0x00007ffff319b0e2 in content:
at ../../.
#12 0x00007ffff319b2f9 in content:
at ../../.
#13 0x00007ffff319326c in release_all (table=
#14 ~IDMap (this=0x7fff800
#15 content:
#16 0x00007ffff31934d9 in content:
at ../../.
#17 0x00007ffff31950bf in STLDeleteValues
#18 0x00007ffff3195118 in clear (this=0x7fff800
#19 content:
at ../../.
#20 0x00007ffff3195329 in content:
at ../../.
#21 0x00007ffff4ccada7 in operator() (this=0x7fff800
#22 ~scoped_ptr_impl (this=0x7fff800
#23 ~scoped_ptr (this=0x7fff800
#24 content:
#25 0x00007ffff4ccae49 in content:
at ../../.
#26 0x00007ffff4c533f3 in operator() (this=0x7fff800
#27 reset (p=0x0, this=0x7fff8000
#28 reset (p=0x0, this=0x7fff8000
#29 content:
#30 0x00007ffff4cca8f3 in ~GpuProcess (this=0x7fff800
#31 content:
#32 0x00007ffff25b9035 in base::Thread:
#33 0x00007ffff25b561e in base::(anonymous namespace)
#34 0x00007ffff10fc0a5 in start_thread (arg=0x7fffa080
#35 0x00007ffff140c77d in clone () at ../sysdeps/