New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 898842 link

Starred by 4 users

Issue metadata

Status: Fixed
Owner:
Closed: Nov 5
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug

Blocking:
issue 737410
issue 899748



Sign in to add a comment

CHECK failure in depth_capture_tests -- ContextProviderCommandBuffer attempted to unregister itself in a racy way

Project Member Reported by erikc...@chromium.org, Oct 25

Issue description

Logs: https://chromium-swarm.appspot.com/task?id=40c01cec032e8d10&refresh=10&show_raw=1

"""
[FATAL:memory_dump_manager.cc(251)] Check failed: (*mdp_iter)->task_runner && (*mdp_iter)->task_runner->RunsTasksInCurrentSequence(). MemoryDumpProvider "ContextProviderCommandBuffer" attempted to unregister itself in a racy way. Please file a crbug.
  	
  	Stack Trace:
  	  RELADDR   FUNCTION                                                                                                                                                                                                                                                                                                                                                                                                                             FILE:LINE
  	  0000000003e341c3  logging::LogMessage::~LogMessage()                                                                                                                                                                                                                                                                                                                                                                                                   ??:0:0
  	  0000000003eb8e97  base::trace_event::MemoryDumpManager::UnregisterDumpProviderInternal(base::trace_event::MemoryDumpProvider*, bool)                                                                                                                                                                                                                                                                                                                   ??:0:0
  	  0000000002b578e3  ws::ContextProviderCommandBuffer::~ContextProviderCommandBuffer()                                                                                                                                                                                                                                                                                                                                                                    ??:0:0
  	  0000000002b579ff  ws::ContextProviderCommandBuffer::~ContextProviderCommandBuffer()                                                                                                                                                                                                                                                                                                                                                                    ??:0:0
  	  0000000006912ceb  base::internal::Invoker<base::internal::BindState<(anonymous namespace)::PostContextProviderToCallback(scoped_refptr<base::SingleThreadTaskRunner>, scoped_refptr<viz::ContextProvider>, base::OnceCallback<void (bool, scoped_refptr<viz::ContextProvider>)>)::$_0, scoped_refptr<viz::ContextProvider>, base::OnceCallback<void (bool, scoped_refptr<viz::ContextProvider>)> >, void ()>::RunOnce(base::internal::BindStateBase*)  ??:0:0
  	  0000000003e2410f  base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)                                                                                                                                                                                                                                                                                                                                                                 ??:0:0
  	  0000000003e8bcd7  base::sequence_manager::internal::ThreadControllerImpl::DoWork(base::sequence_manager::internal::ThreadControllerImpl::WorkType)                                                                                                                                                                                                                                                                                                     ??:0:0
  	  0000000002557ecb  base::internal::Invoker<base::internal::BindState<void (viz::GpuServiceImpl::*)(int), base::WeakPtr<viz::GpuServiceImpl>, int>, void ()>::RunOnce(base::internal::BindStateBase*)                                                                                                                                                                                                                                                    ??:0:0
  	  0000000003e2410f  base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)                                                                                                                                                                                                                                                                                                                                                                 ??:0:0
  	  0000000003e3e95b  base::MessageLoop::RunTask(base::PendingTask*)                                                                                                                                                                                                                                                                                                                                                                                       ??:0:0
  	  0000000003e3ec7b  base::MessageLoop::DoWork()                                                                                                                                                                                                                                                                                                                                                                                                          ??:0:0
  	  0000000003e4271b  base::MessagePumpDefault::Run(base::MessagePump::Delegate*)                                                                                                                                                                                                                                                                                                                                                                          ??:0:0
  	  0000000003e3e44b  base::MessageLoop::Run(bool)                                                                                                                                                                                                                                                                                                                                                                                                         ??:0:0
  	  0000000003e62ceb  base::RunLoop::Run()                                                                                                                                                                                                                                                                                                                                                                                                                 ??:0:0
  	  00000000069dfd73  content::RendererMain(content::MainFunctionParams const&)                                                                                                                                                                                                                                                                                                                                                                            ??:0:0
  	  0000000003b731eb  content::ContentMainRunnerImpl::Run(bool)                                                                                                                                                                                                                                                                                                                                                                                            ??:0:0
  	  00000000053e86ef  service_manager::Main(service_manager::MainParams const&)                                                                                                                                                                                                                                                                                                                                                                            ??:0:0
  	  0000000003b7255f  Java_org_chromium_content_app_ContentMain_nativeStart                                                                                                                                                                                                                                                                                                                                                                                ??:0:0
  	  0000000001319423  <UNKNOWN>                                                                                                                                                                                                                                                                                                                                                                                                                            /data/app/org.chromium.chrome-1/oat/arm64/base.odex
  	  0000000001319357  <UNKNOWN>                                                                                                                                                                                                                                                                                                                                                                                                                            /data/app/org.chromium.chrome-1/oat/arm64/base.odex
  	  0000000001b46663  <UNKNOWN>                                                                                                                                                                                                                                                                                                                                                                                                                            /data/app/org.chromium.chrome-1/oat/arm64/base.odex
  	  0000000000d6fd3b  <UNKNOWN>                                                                                                                                                                                                                                                                                                                                                                                                                            /data/app/org.chromium.chrome-1/oat/arm64/base.odex
  	  0000000001f01e67  <UNKNOWN>                                                                                                                                                                                                                                                                                                                                                                                                                            /data/dalvik-cache/arm64/system@framework@boot.oat
"""

According to comments are the DCHECK:
"""
    // If you hit this DCHECK, your dump provider has a bug.
    // Unregistration of a MemoryDumpProvider is safe only if:
    // - The MDP has specified a sequenced task runner affinity AND the
    //   unregistration happens on the same task runner. So that the MDP cannot
    //   unregister and be in the middle of a OnMemoryDump() at the same time.
    // - The MDP has NOT specified a task runner affinity and its ownership is
    //   transferred via UnregisterAndDeleteDumpProviderSoon().
    // In all the other cases, it is not possible to guarantee that the
    // unregistration will not race with OnMemoryDump() calls.
"""

The MDP is registered in ContextProviderCommandBuffer::BindToCurrentThread, which has:
"""
  // This is called on the thread the context will be used.
  DCHECK(context_thread_checker_.CalledOnValidThread());
"""

The MDP is unregistered in ContextProviderCommandBuffer::~ContextProviderCommandBuffer, which has:
"""
  DCHECK(main_thread_checker_.CalledOnValidThread() ||
         context_thread_checker_.CalledOnValidThread());
"""

Since neither of these DCHECKS were hit, we know that the MDP is being registered on the context thread and destroyed on the main thread. 

fsamuel, sadrul -- can one you route to the appropriate owner? 
 
Owner: sadrul@chromium.org
Status: Started (was: Untriaged)
I think https://chromium-review.googlesource.com/c/chromium/src/+/1300801 will address this.
Cc: ericrk@chromium.org
 Issue 898600  has been merged into this issue.
Project Member

Comment 3 by bugdroid1@chromium.org, Oct 29

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/444889cd11ff48021e904a75bed7d81f2a29405c

commit 444889cd11ff48021e904a75bed7d81f2a29405c
Author: Sadrul Habib Chowdhury <sadrul@chromium.org>
Date: Mon Oct 29 17:44:49 2018

media: Destroy ContextProvider on the right thread.

Make sure to retain a ref to the ContextProvider so that it gets
destroyed on the thread it is bound on.

BUG= 898842 

Change-Id: Iefcab772acb4cf530ff4a3e7c64e9b66e35b3f4e
Reviewed-on: https://chromium-review.googlesource.com/c/1304068
Reviewed-by: Antoine Labour <piman@chromium.org>
Commit-Queue: Sadrul Chowdhury <sadrul@chromium.org>
Cr-Commit-Position: refs/heads/master@{#603547}
[modify] https://crrev.com/444889cd11ff48021e904a75bed7d81f2a29405c/content/renderer/media/media_factory.cc

Dupe  issue 898989  into this?
Cc: a...@chromium.org mlamouri@chromium.org dalecur...@chromium.org danakj@chromium.org kbr@chromium.org fdoray@chromium.org lethalantidote@chromium.org liber...@chromium.org
 Issue 898989  has been merged into this issue.
Blocking: 737410
Blocking: 899748
Cc: riajiang@chromium.org
is this bug fixed now or need more work? thanks!
Status: Fixed (was: Started)
This should be fixed now. Closing.

Sign in to add a comment