New issue
Advanced search Search tips

Issue 782681 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 791608
Owner: ----
Closed: Dec 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Chromium tries to delete non-existent sync queries

Reported by ptwo...@vewd.com, Nov 8 2017

Issue description

UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.75 Safari/537.36

Steps to reproduce the problem:
The problem descibed was reproduced internally in Vewd Core, but the nature of it is generic and relatively easy to understand.

Right now the constructor for blink::SharedContextRateLimiter records if GL_CHROMUIM_sync_query extension is supported. Based on that ::Tick either calls GenQueryExt or just adds 0 token to ::queries_. Unfortunately ::Reset function always tries to call DeleteQueriesExt on all tokens from ::queries_, regardless if they are actual tokens created by GenQueryExt or 0s added in case sync tokens are not available. This triggers a DCHECK in GLES2Implementation::DeleteQueriesEXT since the function expects the queries it gets are never 0.

This triggers a following DCHECK in renderer: 
[3974:3974:0922/110318.405146:9429025239:FATAL:gles2_implementation_impl_autogen.h(2953)] Check failed: queries[i] != 0. 
#0 0x0000b34fd5ba base::debug::StackTrace::StackTrace()
#1 0x0000b3510dae logging::LogMessage::~LogMessage()
#2 0x0000b3c7dad0 gpu::gles2::GLES2Implementation::DeleteQueriesEXT()
#3 0x0000b4681d6a blink::SharedContextRateLimiter::Reset()
#4 0x0000b4629c8e blink::Canvas2DLayerBridge::PrepareTextureMailbox()
#5 0x0000b39a4420 cc::TextureLayer::Update()
#6 0x0000b3a04b44 cc::LayerTreeHost::DoUpdateLayers()
#7 0x0000b3a0470c cc::LayerTreeHost::UpdateLayers()
#8 0x0000b3a310e0 cc::ProxyMain::BeginMainFrame()
#9 0x0000b3a2ff08 _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIMN2cc9ProxyMainEFvSt10unique_ptrINS4_28BeginMainFrameAndCommitStateESt14default_deleteIS7_EEENS_7WeakPtrIS5_EEJSA_EEEvOT_OT0_DpOT1_
#10 0x0000b3a2fe76 _ZN4base8internal7InvokerINS0_9BindStateIMN2cc9ProxyMainEFvSt10unique_ptrINS3_28BeginMainFrameAndCommitStateESt14default_deleteIS6_EEEJNS_7WeakPtrIS4_EENS0_13PassedWrapperIS9_EEEEEFvvEE7RunOnceEPNS0_13BindStateBaseE
#11 0x0000b34fdb50 base::debug::TaskAnnotator::RunTask()
#12 0x0000b308d5cc blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue()
#13 0x0000b308be74 blink::scheduler::TaskQueueManager::DoWork()
#14 0x0000b308eb5a _ZN4base8internal7InvokerINS0_9BindStateIMN5blink9scheduler16TaskQueueManagerEFvbEJNS_7WeakPtrIS5_EEbEEEFvvEE7RunImplIRKS7_RKSt5tupleIJS9_bEEJLj0ELj1EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE
#15 0x0000b34fdb50 base::debug::TaskAnnotator::RunTask()
#16 0x0000b3518314 base::MessageLoop::RunTask()
#17 0x0000b3518504 base::MessageLoop::DeferOrRunPendingTask()
#18 0x0000b3518792 base::MessageLoop::DoWork()
#19 0x0000b351988c base::MessagePumpDefault::Run()
#20 0x0000b351807a base::MessageLoop::Run()
#21 0x0000b353012a base::RunLoop::Run()
#22 0x0000b5667f5a content::RendererMain()
#23 0x0000b32129de content::RunZygote()
#24 0x0000b321358a content::ContentMainRunnerImpl::Run()
#25 0x0000b34f5f0e service_manager::Main()
#26 0x0000b3212898 content::ContentMain()
#27 0x0000b1eb6510 OperaContentMain()
#28 0x0000000086d8 main
#29 0x0000b1a592f4 __libc_start_main

What is the expected behavior?
No DCHECK should be triggered

What went wrong?
Renderer crashed due to failing DCHECK.

Crashed report ID: 

How much crashed? Just one tab

Is it a problem with a plugin? N/A 

Did this work before? N/A 

Chrome version: 64.0.3263.0  Channel: dev
OS Version: 4.12
Flash Version:
 
Components: Blink>Internals
Labels: Needs-Triage-M64 TE-NeedsTriageHelp
Not sure about the component, adding Blink>Internals for now, could someone from dev team can look in to this issue?

Thanks!

Comment 2 by ptwo...@vewd.com, Nov 10 2017

This patch should fix the problem: https://chromium-review.googlesource.com/c/chromium/src/+/758759

Comment 3 by junov@chromium.org, Dec 6 2017

Mergedinto: 791608
Status: Duplicate (was: Unconfirmed)

Comment 4 by junov@chromium.org, Dec 6 2017

Thanks for reporting this. It would have been helpful had I seen this bug when it was originally filed.  Unfortunately, triage is hard... especially on a project the size of Chromium.

@brajkumar: For future reference when the stack contains classes with "Canvas2D", the Blink>Canvas component is a pretty sure bet.  When uncertain, you can just put the "Blink" component and leave the bug in the Untriaged state, then the engineer assigned to Blink bug triage will be responsible for assigning the bug to the right blink sub-component.

Sign in to add a comment