Issue metadata
Sign in to add a comment
|
Chromium tries to delete non-existent sync queries
Reported by
ptwo...@vewd.com,
Nov 8 2017
|
||||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.75 Safari/537.36 Steps to reproduce the problem: The problem descibed was reproduced internally in Vewd Core, but the nature of it is generic and relatively easy to understand. Right now the constructor for blink::SharedContextRateLimiter records if GL_CHROMUIM_sync_query extension is supported. Based on that ::Tick either calls GenQueryExt or just adds 0 token to ::queries_. Unfortunately ::Reset function always tries to call DeleteQueriesExt on all tokens from ::queries_, regardless if they are actual tokens created by GenQueryExt or 0s added in case sync tokens are not available. This triggers a DCHECK in GLES2Implementation::DeleteQueriesEXT since the function expects the queries it gets are never 0. This triggers a following DCHECK in renderer: [3974:3974:0922/110318.405146:9429025239:FATAL:gles2_implementation_impl_autogen.h(2953)] Check failed: queries[i] != 0. #0 0x0000b34fd5ba base::debug::StackTrace::StackTrace() #1 0x0000b3510dae logging::LogMessage::~LogMessage() #2 0x0000b3c7dad0 gpu::gles2::GLES2Implementation::DeleteQueriesEXT() #3 0x0000b4681d6a blink::SharedContextRateLimiter::Reset() #4 0x0000b4629c8e blink::Canvas2DLayerBridge::PrepareTextureMailbox() #5 0x0000b39a4420 cc::TextureLayer::Update() #6 0x0000b3a04b44 cc::LayerTreeHost::DoUpdateLayers() #7 0x0000b3a0470c cc::LayerTreeHost::UpdateLayers() #8 0x0000b3a310e0 cc::ProxyMain::BeginMainFrame() #9 0x0000b3a2ff08 _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIMN2cc9ProxyMainEFvSt10unique_ptrINS4_28BeginMainFrameAndCommitStateESt14default_deleteIS7_EEENS_7WeakPtrIS5_EEJSA_EEEvOT_OT0_DpOT1_ #10 0x0000b3a2fe76 _ZN4base8internal7InvokerINS0_9BindStateIMN2cc9ProxyMainEFvSt10unique_ptrINS3_28BeginMainFrameAndCommitStateESt14default_deleteIS6_EEEJNS_7WeakPtrIS4_EENS0_13PassedWrapperIS9_EEEEEFvvEE7RunOnceEPNS0_13BindStateBaseE #11 0x0000b34fdb50 base::debug::TaskAnnotator::RunTask() #12 0x0000b308d5cc blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue() #13 0x0000b308be74 blink::scheduler::TaskQueueManager::DoWork() #14 0x0000b308eb5a _ZN4base8internal7InvokerINS0_9BindStateIMN5blink9scheduler16TaskQueueManagerEFvbEJNS_7WeakPtrIS5_EEbEEEFvvEE7RunImplIRKS7_RKSt5tupleIJS9_bEEJLj0ELj1EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE #15 0x0000b34fdb50 base::debug::TaskAnnotator::RunTask() #16 0x0000b3518314 base::MessageLoop::RunTask() #17 0x0000b3518504 base::MessageLoop::DeferOrRunPendingTask() #18 0x0000b3518792 base::MessageLoop::DoWork() #19 0x0000b351988c base::MessagePumpDefault::Run() #20 0x0000b351807a base::MessageLoop::Run() #21 0x0000b353012a base::RunLoop::Run() #22 0x0000b5667f5a content::RendererMain() #23 0x0000b32129de content::RunZygote() #24 0x0000b321358a content::ContentMainRunnerImpl::Run() #25 0x0000b34f5f0e service_manager::Main() #26 0x0000b3212898 content::ContentMain() #27 0x0000b1eb6510 OperaContentMain() #28 0x0000000086d8 main #29 0x0000b1a592f4 __libc_start_main What is the expected behavior? No DCHECK should be triggered What went wrong? Renderer crashed due to failing DCHECK. Crashed report ID: How much crashed? Just one tab Is it a problem with a plugin? N/A Did this work before? N/A Chrome version: 64.0.3263.0 Channel: dev OS Version: 4.12 Flash Version:
,
Nov 10 2017
This patch should fix the problem: https://chromium-review.googlesource.com/c/chromium/src/+/758759
,
Dec 6 2017
,
Dec 6 2017
Thanks for reporting this. It would have been helpful had I seen this bug when it was originally filed. Unfortunately, triage is hard... especially on a project the size of Chromium. @brajkumar: For future reference when the stack contains classes with "Canvas2D", the Blink>Canvas component is a pretty sure bet. When uncertain, you can just put the "Blink" component and leave the bug in the Untriaged state, then the engineer assigned to Blink bug triage will be responsible for assigning the bug to the right blink sub-component. |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by brajkumar@chromium.org
, Nov 10 2017Labels: Needs-Triage-M64 TE-NeedsTriageHelp