New issue
Advanced search Search tips

Issue 900625 link

Starred by 1 user
Status: Assigned
Owner:
moh...@chromium.org
Cc:
moh...@chromium.org
sadrul@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug



Sign in to add a comment

MashLogin: HostGpuMemoryBufferManager::DestroyAllGpuMemoryBufferForClient crash on shutdown

Project Member Reported by xiy...@chromium.org, Oct 31 
Happened on desktopui_MashLogin_SERVER_JOB Failure on tricky-tot-chrome-pfq-informational/R72-11210.0.0-b3086418

The test itself passes but chrome crashed during tests. This particular one tracks the crash in DestroyAllGpuMemoryBufferForClient during shutdown.

Seems like |gpu_service| is null.

logs:
https://stainless.corp.google.com/browse/chromeos-autotest-results/253724756-chromeos-test/chromeos4-row2-rack3-host12/debug/

artifacts:
https://pantheon.corp.google.com/storage/browser/chromeos-image-archive/tricky-tot-chrome-pfq-informational/R72-11210.0.0-b3086418

stack:
====
Thread 0 (crashed)
 0  chrome!viz::HostGpuMemoryBufferManager::DestroyAllGpuMemoryBufferForClient(int) [host_gpu_memory_buffer_manager.cc : 96 + 0x0]
    rax = 0xffffd70f986c14b5   rdx = 0x00007f5868001240
    rcx = 0xaffffabdb9836013   rbx = 0x000028f39db63500
    rsi = 0x0000000000000041   rdi = 0x000028f39d5117e0
    rbp = 0x00007ffd611cc720   rsp = 0x00007ffd611cc660
     r8 = 0x0000000000000006    r9 = 0x0000000000000000
    r10 = 0x00000000000000c4   r11 = 0x00007ffd611cc100
    r12 = 0x0000000000000006   r13 = 0x000028f39e694a80
    r14 = 0x000028f39d4577e0   r15 = 0x0000000000000006
    rip = 0x00007f5862b7fb85
    Found by: given as instruction pointer in context
 1  chrome!viz::GpuClient::~GpuClient() [gpu_client.cc : 56 + 0x8]
    rbx = 0x000028f39d4c6c00   rbp = 0x00007ffd611cc740
    rsp = 0x00007ffd611cc730   r12 = 0x0000000000000000
    r13 = 0x000028f39d463200   r14 = 0x000028f39d4c6cb0
    r15 = 0x000028f39e681c00   rip = 0x00007f5862b72f52
    Found by: call frame info
 2  chrome!<name omitted> [gpu_client.cc : 39 + 0x5]
    rbx = 0x000028f39d4c6c00   rbp = 0x00007ffd611cc760
    rsp = 0x00007ffd611cc750   r12 = 0x0000000000000000
    r13 = 0x000028f39d463200   r14 = 0x000028f39d438f80
    r15 = 0x000028f39e681c00   rip = 0x00007f5862b72f7e
    Found by: call frame info
 3  chrome!ws::gpu_host::GpuHost::Shutdown() [memory : 2321 + 0x5]
    rbx = 0x000028f39e681c10   rbp = 0x00007ffd611cc790
    rsp = 0x00007ffd611cc770   r12 = 0x0000000000000000
    r13 = 0x000028f39d463200   r14 = 0x000028f39d438f80
    r15 = 0x000028f39e681c00   rip = 0x00007f585fd73a7a
    Found by: call frame info
 4  chrome!ash::AshService::~AshService() [ash_service.cc : 83 + 0x5]
    rbx = 0x000028f39d4a2c60   rbp = 0x00007ffd611cc7b0
    rsp = 0x00007ffd611cc7a0   r12 = 0x0000000000000000
    r13 = 0x000028f39d463200   r14 = 0x000028f39d4e0aa8
    r15 = 0x000028f39d4e7030   rip = 0x00007f5863a687f6
    Found by: call frame info
 5  chrome!<name omitted> [ash_service.cc : 76 + 0x5]
    rbx = 0x000028f39d4a2c60   rbp = 0x00007ffd611cc7d0
    rsp = 0x00007ffd611cc7c0   r12 = 0x0000000000000000
    r13 = 0x000028f39d463200   r14 = 0x000028f39d4e0aa8
    r15 = 0x000028f39d4e7030   rip = 0x00007f5863a68b8e
    Found by: call frame info
 6  chrome!service_manager::ServiceContext::~ServiceContext() [memory : 2321 + 0x3]
    rbx = 0x000028f39d4e0a90   rbp = 0x00007ffd611cc7f0
    rsp = 0x00007ffd611cc7e0   r12 = 0x0000000000000000
    r13 = 0x000028f39d463200   r14 = 0x000028f39d4e0aa8
    r15 = 0x000028f39d4e7030   rip = 0x00007f58623cb385
    Found by: call frame info
 7  chrome!service_manager::ServiceContext::~ServiceContext() [service_context.cc : 91 + 0x5]
    rbx = 0x000028f39d4e0a90   rbp = 0x00007ffd611cc810
    rsp = 0x00007ffd611cc800   r12 = 0x0000000000000000
    r13 = 0x000028f39d463200   r14 = 0x000028f39d4e6ea0
    r15 = 0x000028f39d4e7030   rip = 0x00007f58623cb3ee
    Found by: call frame info
 8  chrome!service_manager::EmbeddedInstanceManager::OnInstanceLost(int) [memory : 2321 + 0x5]
    rbx = 0x000028f39d4e7000   rbp = 0x00007ffd611cc840
    rsp = 0x00007ffd611cc820   r12 = 0x0000000000000000
    r13 = 0x000028f39d463200   r14 = 0x000028f39d4e6ea0
    r15 = 0x000028f39d4e7030   rip = 0x00007f58623cd4bc
    Found by: call frame info
 9  chrome!service_manager::ServiceContext::OnConnectionError() [callback.h : 140 + 0x3]
    rbx = 0x000028f39d4d5440   rbp = 0x00007ffd611cc860
    rsp = 0x00007ffd611cc850   r12 = 0x0000000000000000
    r13 = 0x000028f39d463200   r14 = 0x00007ffd611cc928
    r15 = 0x000028f39d4e1d80   rip = 0x00007f58623cb25b
    Found by: call frame info
10  chrome!mojo::InterfaceEndpointClient::NotifyError(base::Optional<mojo::DisconnectReason> const&) [callback.h : 99 + 0x7]
    rbx = 0x000028f39d4e4140   rbp = 0x00007ffd611cc8d0
    rsp = 0x00007ffd611cc870   r12 = 0x0000000000000000
    r13 = 0x000028f39d463200   r14 = 0x00007ffd611cc928
    r15 = 0x000028f39d4e1d80   rip = 0x00007f58615ab901
    Found by: call frame info
130229.10338.txt
64.5 KB View Download

Comment 1 by moh...@chromium.org, Nov 14

Cc: moh...@chromium.org

Comment 2 by msw@chromium.org, Dec 3

Cc: sadrul@chromium.org
Labels: -Pri-3 Stability-Crash Pri-2
Owner: moh...@chromium.org
Status: Assigned (was: Untriaged)
This happened again. Please take a look, mohsen@. Thanks!

https://cros-goldeneye.corp.google.com/chromeos/healthmonitoring/buildDetails?buildbucketId=8928259539022852144
https://stainless.corp.google.com/browse/chromeos-autotest-results/263043374-chromeos-test/

Crash reason:  SIGILL
Crash address: 0x0
Process uptime: not available

Thread 0 (crashed)
 0  chrome!viz::HostGpuMemoryBufferManager::DestroyAllGpuMemoryBufferForClient(int) [host_gpu_memory_buffer_manager.cc : 96 + 0x0]
    rax = 0xffffdec6c499ac84   rdx = 0x00007f6ff33ceea0
    rcx = 0x27fffafab68ae5ef   rbx = 0x0000213ac0855300
    rsi = 0x0000000000000021   rdi = 0x0000213ac0191680
    rbp = 0x00007fff71b41300   rsp = 0x00007fff71b41230
     r8 = 0x0000000000000006    r9 = 0x0000000000000000
    r10 = 0x00000000000000c4   r11 = 0x00007fff71b40e70
    r12 = 0x0000000000000006   r13 = 0x0000213ac10b1d40
    r14 = 0x0000213ac005bb60   r15 = 0x0000000000000006
    rip = 0x00007f6fede209a5
    Found by: given as instruction pointer in context
 1  chrome!viz::GpuClient::~GpuClient() [gpu_client.cc : 57 + 0x8]
    rbx = 0x0000213ac05e7400   rbp = 0x00007fff71b41320
    rsp = 0x00007fff71b41310   r12 = 0x00007f6ff36e6bb8
    r13 = 0x00007fff71b41c00   r14 = 0x0000213ac05e74b0
    r15 = 0x0000213ac1075180   rip = 0x00007f6fede13769
    Found by: call frame info
 2  chrome!<name omitted> [gpu_client.cc : 40 + 0x5]
    rbx = 0x0000213ac05e7400   rbp = 0x00007fff71b41340
    rsp = 0x00007fff71b41330   r12 = 0x00007f6ff36e6bb8
    r13 = 0x00007fff71b41c00   r14 = 0x0000213ac003bf80
    r15 = 0x0000213ac1075180   rip = 0x00007f6fede1387e
    Found by: call frame info
 3  chrome!ws::gpu_host::GpuHost::Shutdown() [memory : 2321 + 0x5]
    rbx = 0x0000213ac1075190   rbp = 0x00007fff71b41370
    rsp = 0x00007fff71b41350   r12 = 0x00007f6ff36e6bb8
    r13 = 0x00007fff71b41c00   r14 = 0x0000213ac003bf80
    r15 = 0x0000213ac1075180   rip = 0x00007f6feaf01a2a
    Found by: call frame info
 4  chrome!ash::AshService::~AshService() [ash_service.cc : 78 + 0x5]
    rbx = 0x0000213ac00d6600   rbp = 0x00007fff71b41390
    rsp = 0x00007fff71b41380   r12 = 0x00007f6ff36e6bb8
    r13 = 0x00007fff71b41c00   r14 = 0x0000213ac00b1000
    r15 = 0x00007fff71b414d0   rip = 0x00007f6feed45706
    Found by: call frame info
 5  chrome!<name omitted> [ash_service.cc : 71 + 0x5]
    rbx = 0x0000213ac00d6600   rbp = 0x00007fff71b413b0
    rsp = 0x00007fff71b413a0   r12 = 0x00007f6ff36e6bb8
    r13 = 0x00007fff71b41c00   r14 = 0x0000213ac00b1000
    r15 = 0x00007fff71b414d0   rip = 0x00007f6feed45ace
    Found by: call frame info
 6  chrome!content::UtilityServiceFactory::~UtilityServiceFactory() [memory : 2321 + 0x3]
    rbx = 0x0000213ac00b1000   rbp = 0x00007fff71b413d0
    rsp = 0x00007fff71b413c0   r12 = 0x00007f6ff36e6bb8
    r13 = 0x00007fff71b41c00   r14 = 0x0000213ac00b1000
    r15 = 0x00007fff71b414d0   rip = 0x00007f6febfc7b62
    Found by: call frame info
 7  chrome!content::UtilityServiceFactory::~UtilityServiceFactory() [utility_service_factory.cc : 110 + 0x5]
    rbx = 0x0000213ac00b1000   rbp = 0x00007fff71b413f0
    rsp = 0x00007fff71b413e0   r12 = 0x00007f6ff36e6bb8
    r13 = 0x00007fff71b41c00   r14 = 0x00007fff71b414e0
    r15 = 0x00007fff71b414d0   rip = 0x00007f6febfc7bde
    Found by: call frame info
 8  chrome!content::UtilityThreadImpl::~UtilityThreadImpl() [memory : 2321 + 0x5]
    rbx = 0x0000213ac00ad600   rbp = 0x00007fff71b41410
    rsp = 0x00007fff71b41400   r12 = 0x00007f6ff36e6bb8
    r13 = 0x00007fff71b41c00   r14 = 0x00007fff71b414e0
    r15 = 0x00007fff71b414d0   rip = 0x00007f6febfc9672
    Found by: call frame info
 9  chrome!non-virtual thunk to content::UtilityThreadImpl::~UtilityThreadImpl() [utility_thread_impl.cc : 73 + 0x8]
    rbx = 0x0000213ac00ad600   rbp = 0x00007fff71b41430
    rsp = 0x00007fff71b41420   r12 = 0x00007f6ff36e6bb8
    r13 = 0x00007fff71b41c00   r14 = 0x00007fff71b414e0
    r15 = 0x00007fff71b414d0   rip = 0x00007f6febfc9775
    Found by: call frame info
10  chrome!content::ChildProcess::~ChildProcess() [memory : 2321 + 0x3]
    rbx = 0x00007f6ff2af0846   rbp = 0x00007fff71b41470
    rsp = 0x00007fff71b41440   r12 = 0x00007f6ff36e6bb8
    r13 = 0x00007fff71b41c00   r14 = 0x00007fff71b414e0
    r15 = 0x00007fff71b414d0   rip = 0x00007f6fef8ad52a
    Found by: call frame info
11  chrome!content::UtilityMain(content::MainFunctionParams const&) [utility_main.cc : 137 + 0x5]
    rbx = 0x0000213ac00ad608   rbp = 0x00007fff71b41620
    rsp = 0x00007fff71b41480   r12 = 0x0000213ac005af30
    r13 = 0x00007fff71b41c00   r14 = 0x00007fff71b41490
    r15 = 0x00007fff71b41488   rip = 0x00007f6febfc7a39
    Found by: call frame info
12  chrome!content::ContentMainRunnerImpl::Run(bool) [content_main_runner_impl.cc : 569 + 0x4]
    rbx = 0x0000000000000020   rbp = 0x00007fff71b41870
    rsp = 0x00007fff71b41630   r12 = 0x0000213ac005af30
    r13 = 0x00007fff71b41c00   r14 = 0x00000000ffffffff
    r15 = 0x0000000000000000   rip = 0x00007f6fec212573
    Found by: call frame info
13  chrome!service_manager::Main(service_manager::MainParams const&) [main.cc : 472 + 0x6]
    rbx = 0x0000213ac003f360   rbp = 0x00007fff71b41b50
    rsp = 0x00007fff71b41880   r12 = 0x00000000ffffffff
    r13 = 0x00007fff71b41c00   r14 = 0x00007f6ff3363d90
    r15 = 0x0000000000000000   rip = 0x00007f6fec21a52a
    Found by: call frame info
14  chrome!ChromeMain [content_main.cc : 19 + 0x5]
    rbx = 0x0000213ac003f360   rbp = 0x00007fff71b41c70
    rsp = 0x00007fff71b41b60   r12 = 0x00007f6ff3363d90
    r13 = 0x00007fff71b41c00   r14 = 0x00007fff71b41d68
    r15 = 0x0000000000000047   rip = 0x00007f6fe954df3f
    Found by: call frame info
15  libc-2.27.so!__libc_start_main [libc-start.c : 308 + 0x1a]
    rbx = 0x0000000000000000   rbp = 0x00007fff71b41d40
    rsp = 0x00007fff71b41c80   r12 = 0x00007f6ff2393b00
    r13 = 0x00007fff71b41d60   r14 = 0x0000000000000000
    r15 = 0x0000000000000000   rip = 0x00007f6fe78bfa94
    Found by: call frame info
16  chrome!_start + 0x2a
    rbx = 0x0000000000000000   rbp = 0x0000000000000000
    rsp = 0x00007fff71b41d50   r12 = 0x00007f6fe9531960
    r13 = 0x00007fff71b41d60   r14 = 0x0000000000000000
    r15 = 0x0000000000000000   rip = 0x00007f6fe953198a
    Found by: call frame info
17  0x7fff71b41d58
    rbx = 0x0000000000000000   rbp = 0x0000000000000000
    rsp = 0x00007fff71b41d58   r12 = 0x00007f6fe9531960
    r13 = 0x00007fff71b41d60   r14 = 0x0000000000000000
    r15 = 0x0000000000000000   rip = 0x00007fff71b41d58
    Found by: call frame info
►

Sign in to add a comment