Crashes in both Map and destructor, i.e. Map is called multiple times in different thread - I didn't know it was even allowed.
Also Map and destructor are called in different thread concurrently 🔥
ThreadPoolForegroundWorker[143038] vs ThreadPoolForegroundWorker[143136]
Stack traces are attached.
```
[00287.095670][klog] INFO: crashsvc: exception received for process "web_engine_exe:renderer", processing
[00287.095705][klog] INFO: <== CRASH: process web_engine_exe:renderer[142825] thread ThreadPoolForegroundWorker[143038]
[00287.095712][klog] INFO: <== sw breakpoint, PC at 0x8000943807f4
[00287.095716][klog] INFO: x0 0x510cf000 x1 0xc200b434 x2 0xc200b434 x3 0xabababababababab
[00287.095721][klog] INFO: x4 0 x5 0x748 x6 0xaaaaaaaaaaaaaaaa x7 0xffffffffffffffff
[00287.095726][klog] INFO: x8 0x80009432af84 x9 0xc1ea2bd8 x10 0 x11 0
[00287.095731][klog] INFO: x12 0xc00713000 x13 0x740 x14 0xf x15 0
[00287.095735][klog] INFO: x16 0xc1e093c0 x17 0x8000943807ec x18 0x70c3e0e8 x19 0x7e
[00287.095739][klog] INFO: x20 0xc00122800 x21 0x510cfd10 x22 0xa028d500 x23 0xc00713000
[00287.095744][klog] INFO: x24 0xa028d500 x25 0 x26 0x740 x27 0xa028d500
[00287.095748][klog] INFO: x28 0xc0062a6c0 x29 0x2 lr 0xbc9c3108 sp 0x510cf040
[00287.095754][klog] INFO: pc 0x8000943807f4 psr 0x60000000 far 0 esr 0xf2000001
[00287.095757][klog] INFO: bottom of user stack:
[00287.095782][klog] INFO: 0x510cf040: aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa |................|
[00287.095790][klog] INFO: 0x510cf050: aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa |................|
[00287.095798][klog] INFO: 0x510cf060: aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa |................|
[00287.095807][klog] INFO: 0x510cf070: aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa |................|
[00287.095815][klog] INFO: 0x510cf080: aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa |................|
[00287.095823][klog] INFO: 0x510cf090: aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa |................|
[00287.095831][klog] INFO: 0x510cf0a0: aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa |................|
[00287.095841][klog] INFO: 0x510cf0b0: aaaaaaaa aaaaaaaa 3234315b 3a353238 |........[142825:|
[00287.095850][klog] INFO: 0x510cf0c0: 30333431 303a3833 2f313338 32303032 |143038:0831/2002|
[00287.095860][klog] INFO: 0x510cf0d0: 302e3933 30303030 41463a30 3a4c4154 |39.000000:FATAL:|
[00287.095869][klog] INFO: 0x510cf0e0: 65736162 7165732f 636e6575 68635f65 |base/sequence_ch|
[00287.095879][klog] INFO: 0x510cf0f0: 656b6365 63632e72 5d31323a 48434420 |ecker.cc:21] DCH|
[00287.095889][klog] INFO: 0x510cf100: 204b4345 6c696166 203a6465 63656863 |ECK failed: chec|
[00287.095898][klog] INFO: 0x510cf110: 2e72656b 6c6c6143 6e4f6465 696c6156 |ker.CalledOnVali|
[00287.095908][klog] INFO: 0x510cf120: 71655364 636e6575 62262865 646e756f |dSequence(&bound|
[00287.095918][klog] INFO: 0x510cf130: 2974615f 7b0a202e 6f6d7b7b 656c7564 |_at). .{{{module|
[00287.095921][klog] INFO: memory dump near pc:
[00287.095945][klog] INFO: 0x00008000943807c4: 1f 01 00 71 76 42 94 9a e0 03 16 aa f4 4f 44 a9 |...qvB.......OD.
[00287.095958][klog] INFO: 0x00008000943807d4: f6 57 43 a9 f8 5f 42 a9 fa 67 41 a9 fd 7b c5 a8 |.WC.._B..gA..{..
[00287.095972][klog] INFO: 0x00008000943807e4: 5e 8e 5f f8 c0 03 5f d6 1f 20 03 d5 a8 3c d5 10 |^._..._.. ...<..
[00287.095986][klog] INFO: 0x00008000943807f4: 20 00 20 d4 5e 86 00 f8 fd 7b be a9 f3 0b 00 f9 | . .^....{......
[00287.095990][klog] INFO: arch: aarch64
[00287.111740][klog] INFO: #0 abort
[00287.111750][klog] INFO: #1 logging::LogMessage::HandleFatal(unsigned long, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&) const
[00287.111755][klog] INFO: #2 logging::LogMessage::Flush()
[00287.111760][klog] INFO: #3 logging::LogMessage::~LogMessage()
[00287.111765][klog] INFO: #4 logging::(anonymous namespace)::DCheckLogMessage::~DCheckLogMessage()
[00287.111775][klog] INFO: #5 logging::NotReachedError::~NotReachedError()
[00287.111780][klog] INFO: #6 base::ScopedValidateSequenceChecker::ScopedValidateSequenceChecker(base::SequenceCheckerImpl const&)
[00287.111784][klog] INFO: #7 (anonymous namespace)::ClientNativePixmapFuchsia::Map()
[00287.111789][klog] INFO: #8 gpu::MappableBufferNativePixmap::Map()
[00287.111794][klog] INFO: #9 gpu::ClientSharedImage::ScopedMapping::Create(gpu::SharedImageMetadata, gpu::MappableBuffer*, bool)
[00287.111799][klog] INFO: #10 gpu::ClientSharedImage::Map()
[00287.111803][klog] INFO: #11 cc::OneCopyRasterBufferProvider::PlaybackToStagingBuffer(cc::StagingBuffer*, cc::RasterSource const*, gfx::Rect const&, gfx::Rect const&, gfx::AxisTransform2d const&, viz::SharedImageFormat, gfx::ColorSpace const&, cc::RasterSource::PlaybackSettings const&, unsigned long, unsigned long)
[00287.111808][klog] INFO: #12 cc::OneCopyRasterBufferProvider::PlaybackAndCopyOnWorkerThread(cc::ResourcePool::Backing*, bool, gpu::SyncToken const&, cc::RasterSource const*, gfx::Rect const&, gfx::Rect const&, gfx::AxisTransform2d const&, cc::RasterSource::PlaybackSettings const&, unsigned long, unsigned long, bool&)
[00287.111813][klog] INFO: #13 cc::OneCopyRasterBufferProvider::RasterBufferImpl::Playback(cc::RasterSource const*, gfx::Rect const&, gfx::Rect const&, unsigned long, gfx::AxisTransform2d const&, cc::RasterSource::PlaybackSettings const&, GURL const&)
[00287.111817][klog] INFO: #14 cc::(anonymous namespace)::RasterTaskImpl::RunOnWorkerThread()
[00287.111822][klog] INFO: #15 cc::CategorizedWorkerPoolJob::Run(base::span<cc::TaskCategory const, 18446744073709551615ul, cc::TaskCategory const*>, base::JobDelegate*)
[00287.111827][klog] INFO: #16 base::RepeatingCallback<void (cc::VideoPlaybackRoughnessReporter::Measurement const&)>::Run(cc::VideoPlaybackRoughnessReporter::Measurement const&) const &
[00287.111831][klog] INFO: #17 base::internal::Invoker<base::internal::FunctorTraits<base::internal::JobTaskSource::JobTaskSource(base::Location const&, base::TaskTraits const&, base::RepeatingCallback<void (base::JobDelegate*)>, base::RepeatingCallback<unsigned long (unsigned long)>, base::internal::PooledTaskRunnerDelegate*)::$_0 const&, base::internal::JobTaskSource*>, base::internal::BindState<false, false, false, base::internal::JobTaskSource::JobTaskSource(base::Location const&, base::TaskTraits const&, base::RepeatingCallback<void (base::JobDelegate*)>, base::RepeatingCallback<unsigned long (unsigned long)>, base::internal::PooledTaskRunnerDelegate*)::$_0, base::internal::UnretainedWrapper<base::internal::JobTaskSource, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*)
[00287.111836][klog] INFO: #18 base::OnceCallback<void ()>::Run() &&
[00287.111840][klog] INFO: #19 base::TaskAnnotator::RunTaskImpl(base::PendingTask&)
[00287.111844][klog] INFO: #20 base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)
[00287.111855][klog] INFO: #21 base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)
[00287.111860][klog] INFO: #22 base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&)
[00287.111868][klog] INFO: #23 base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource)
[00287.111872][klog] INFO: #24 base::internal::WorkerThread::RunWorker()
[00287.111879][klog] INFO: #25 base::internal::WorkerThread::RunPooledWorker()
[00287.111884][klog] INFO: #26 base::internal::WorkerThread::ThreadMain()
[00287.111890][klog] INFO: #27 base::(anonymous namespace)::ThreadFunc(void*)
[00287.111895][klog] INFO: #28 pthread_create
[00287.111901][klog] INFO: #29 __tls_get_addr
[00287.112851][klog] INFO: crashsvc: exception received for process "web_engine_exe:renderer", processing
[00287.112872][klog] INFO: <== CRASH: process web_engine_exe:renderer[142825] thread ThreadPoolForegroundWorker[143136]
[00287.112879][klog] INFO: <== sw breakpoint, PC at 0x8000943807f4
[00287.112884][klog] INFO: x0 0xab4660b8 x1 0xc00768740 x2 0xababababababab00 x3 0xabababababababab
[00287.112891][klog] INFO: x4 0 x5 0x748 x6 0xaaaaaaaaaaaaaaaa x7 0xffffffffffffffff
[00287.112896][klog] INFO: x8 0x80009432af84 x9 0xc1ea2bd8 x10 0 x11 0
[00287.112903][klog] INFO: x12 0xc00768000 x13 0x740 x14 0 x15 0
[00287.112908][klog] INFO: x16 0xc1e093c0 x17 0x8000943807ec x18 0x250440e8 x19 0x7e
[00287.112915][klog] INFO: x20 0xc00122e00 x21 0xab466d10 x22 0x26bfe500 x23 0xc00768000
[00287.112919][klog] INFO: x24 0x26bfe500 x25 0 x26 0x740 x27 0x26bfe500
[00287.112926][klog] INFO: x28 0xc006294c0 x29 0x1 lr 0xbc9c3108 sp 0xab466040
[00287.112932][klog] INFO: pc 0x8000943807f4 psr 0x60000000 far 0 esr 0xf2000001
[00287.112937][klog] INFO: bottom of user stack:
[00287.112951][klog] INFO: 0xab466040: aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa |................|
[00287.112962][klog] INFO: 0xab466050: aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa |................|
[00287.112973][klog] INFO: 0xab466060: aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa |................|
[00287.112983][klog] INFO: 0xab466070: aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa |................|
[00287.112994][klog] INFO: 0xab466080: aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa |................|
[00287.113005][klog] INFO: 0xab466090: aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa |................|
[00287.113016][klog] INFO: 0xab4660a0: aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa |................|
[00287.113027][klog] INFO: 0xab4660b0: aaaaaaaa aaaaaaaa 3234315b 3a353238 |........[142825:|
[00287.113039][klog] INFO: 0xab4660c0: 31333431 303a3633 2f313338 32303032 |143136:0831/2002|
[00287.113049][klog] INFO: 0xab4660d0: 302e3933 30303030 41463a30 3a4c4154 |39.000000:FATAL:|
[00287.113059][klog] INFO: 0xab4660e0: 65736162 7165732f 636e6575 68635f65 |base/sequence_ch|
[00287.113071][klog] INFO: 0xab4660f0: 656b6365 63632e72 5d31323a 48434420 |ecker.cc:21] DCH|
[00287.113083][klog] INFO: 0xab466100: 204b4345 6c696166 203a6465 63656863 |ECK failed: chec|
[00287.113095][klog] INFO: 0xab466110: 2e72656b 6c6c6143 6e4f6465 696c6156 |ker.CalledOnVali|
[00287.113107][klog] INFO: 0xab466120: 71655364 636e6575 62262865 646e756f |dSequence(&bound|
[00287.113119][klog] INFO: 0xab466130: 2974615f 7b0a202e 6f6d7b7b 656c7564 |_at). .{{{module|
[00287.113124][klog] INFO: memory dump near pc:
[00287.113143][klog] INFO: 0x00008000943807c4: 1f 01 00 71 76 42 94 9a e0 03 16 aa f4 4f 44 a9 |...qvB.......OD.
[00287.113160][klog] INFO: 0x00008000943807d4: f6 57 43 a9 f8 5f 42 a9 fa 67 41 a9 fd 7b c5 a8 |.WC.._B..gA..{..
[00287.113176][klog] INFO: 0x00008000943807e4: 5e 8e 5f f8 c0 03 5f d6 1f 20 03 d5 a8 3c d5 10 |^._..._.. ...<..
[00287.113192][klog] INFO: 0x00008000943807f4: 20 00 20 d4 5e 86 00 f8 fd 7b be a9 f3 0b 00 f9 | . .^....{......
[00287.113198][klog] INFO: arch: aarch64
[00287.129681][exceptions][forensics,exception] INFO: [exception_broker.cc(62)] Received exception -- pid: 142825 tid: 143038
[00287.128382][klog] INFO: #0 abort
[00287.128393][klog] INFO: #1 logging::LogMessage::HandleFatal(unsigned long, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&) const
[00287.128399][klog] INFO: #2 logging::LogMessage::Flush()
[00287.128409][klog] INFO: #3 logging::LogMessage::~LogMessage()
[00287.128418][klog] INFO: #4 logging::(anonymous namespace)::DCheckLogMessage::~DCheckLogMessage()
[00287.128426][klog] INFO: #5 logging::NotReachedError::~NotReachedError()
[00287.128434][klog] INFO: #6 base::ScopedValidateSequenceChecker::ScopedValidateSequenceChecker(base::SequenceCheckerImpl const&)
[00287.128442][klog] INFO: #7 (anonymous namespace)::ClientNativePixmapFuchsia::Map()
[00287.128450][klog] INFO: #8 gpu::MappableBufferNativePixmap::Map()
[00287.128455][klog] INFO: #9 gpu::ClientSharedImage::ScopedMapping::Create(gpu::SharedImageMetadata, gpu::MappableBuffer*, bool)
[00287.128462][klog] INFO: #10 gpu::ClientSharedImage::Map()
[00287.128471][klog] INFO: #11 cc::OneCopyRasterBufferProvider::PlaybackToStagingBuffer(cc::StagingBuffer*, cc::RasterSource const*, gfx::Rect const&, gfx::Rect const&, gfx::AxisTransform2d const&, viz::SharedImageFormat, gfx::ColorSpace const&, cc::RasterSource::PlaybackSettings const&, unsigned long, unsigned long)
[00287.128479][klog] INFO: #12 cc::OneCopyRasterBufferProvider::PlaybackAndCopyOnWorkerThread(cc::ResourcePool::Backing*, bool, gpu::SyncToken const&, cc::RasterSource const*, gfx::Rect const&, gfx::Rect const&, gfx::AxisTransform2d const&, cc::RasterSource::PlaybackSettings const&, unsigned long, unsigned long, bool&)
[00287.128486][klog] INFO: #13 cc::OneCopyRasterBufferProvider::RasterBufferImpl::Playback(cc::RasterSource const*, gfx::Rect const&, gfx::Rect const&, unsigned long, gfx::AxisTransform2d const&, cc::RasterSource::PlaybackSettings const&, GURL const&)
[00287.128495][klog] INFO: #14 cc::(anonymous namespace)::RasterTaskImpl::RunOnWorkerThread()
[00287.128504][klog] INFO: #15 cc::CategorizedWorkerPoolJob::Run(base::span<cc::TaskCategory const, 18446744073709551615ul, cc::TaskCategory const*>, base::JobDelegate*)
[00287.128512][klog] INFO: #16 base::RepeatingCallback<void (cc::VideoPlaybackRoughnessReporter::Measurement const&)>::Run(cc::VideoPlaybackRoughnessReporter::Measurement const&) const &
[00287.128521][klog] INFO: #17 base::internal::Invoker<base::internal::FunctorTraits<base::internal::JobTaskSource::JobTaskSource(base::Location const&, base::TaskTraits const&, base::RepeatingCallback<void (base::JobDelegate*)>, base::RepeatingCallback<unsigned long (unsigned long)>, base::internal::PooledTaskRunnerDelegate*)::$_0 const&, base::internal::JobTaskSource*>, base::internal::BindState<false, false, false, base::internal::JobTaskSource::JobTaskSource(base::Location const&, base::TaskTraits const&, base::RepeatingCallback<void (base::JobDelegate*)>, base::RepeatingCallback<unsigned long (unsigned long)>, base::internal::PooledTaskRunnerDelegate*)::$_0, base::internal::UnretainedWrapper<base::internal::JobTaskSource, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*)
[00287.128525][klog] INFO: #18 base::OnceCallback<void ()>::Run() &&
[00287.128532][klog] INFO: #19 base::TaskAnnotator::RunTaskImpl(base::PendingTask&)
[00287.128537][klog] INFO: #20 base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)
[00287.128543][klog] INFO: #21 base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)
[00287.128552][klog] INFO: #22 base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&)
[00287.128560][klog] INFO: #23 base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource)
[00287.128564][klog] INFO: #24 base::internal::WorkerThread::RunWorker()
[00287.128570][klog] INFO: #25 base::internal::WorkerThread::RunPooledWorker()
[00287.128575][klog] INFO: #26 base::internal::WorkerThread::ThreadMain()
[00287.128581][klog] INFO: #27 base::(anonymous namespace)::ThreadFunc(void*)
[00287.128586][klog] INFO: #28 pthread_create
[00287.128592][klog] INFO: #29 __tls_get_addr
```
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Crashes in both Map and destructor, i.e. Map is called multiple times in different thread - I didn't know it was even allowed.
Also Map and destructor are called in different thread concurrently 🔥
`Map()` and the destructor being called concurrently is nonsensical. Can you file a bug and provide the details?
Re the different-sequence `Map()` calls - the stacks you include are both under `CategorizedWorkerPoolJob` which suggests that they _should_ be running on a `SequenceTaskRunner` created via `CategorizedWorkerPool::CreateSequencedTaskRunner()` - in which case the sequence checker should not complain.
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Crashes in both Map and destructor, i.e. Map is called multiple times in different thread - I didn't know it was even allowed.
Also Map and destructor are called in different thread concurrently 🔥`Map()` and the destructor being called concurrently is nonsensical. Can you file a bug and provide the details?
I cannot imagine other scenarios since both DCHECK failures happened, they must be running in parallel so that one crash didn't stop the logging of the other crash 😮
I will create a bug and CC you.
Re the different-sequence `Map()` calls - the stacks you include are both under `CategorizedWorkerPoolJob` which suggests that they _should_ be running on a `SequenceTaskRunner` created via `CategorizedWorkerPool::CreateSequencedTaskRunner()` - in which case the sequence checker should not complain.
I haven't found the use of this function except for tests, https://crsrc.org/c/cc/raster/categorized_worker_pool.h;l=73;drc=181e7a80687c55d02e2e74d7d5db3d75ad53c0de;bpv=1;bpt=1.
I do see two potential causes, 1) the CategorizedWorkerPool is a pool, but not a single thread runner https://crsrc.org/c/cc/raster/categorized_worker_pool.cc;drc=181e7a80687c55d02e2e74d7d5db3d75ad53c0de;l=145; 2) the CreateSequencedTaskRunner isn't even used.
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
bool running_ = false;
You'll need to make this atomic if you want to actually check for concurrent `running_=true`, otherwise the `true` value won't necessarily be visible to the other thread(s).
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
bool running_ = false;
You'll need to make this atomic if you want to actually check for concurrent `running_=true`, otherwise the `true` value won't necessarily be visible to the other thread(s).
Well, even when the other threads read the latest state, they may not run in parallel, so this condition checks a probability and won't be very meaningful unless it's so easy to fail.
But anyway, it doesn't look so. I think we can assume,
1. map/unmap can be protected by the same sequence checker.
2. destructor is running on a dedicated thread other than constructor, map and unmap.
I would consider adding only the sequence checker to map and unmap, and leave others as is.
There isn't a proper way of checking if race condition would happen, I will just assume the caller of this class would do the right thing.
I will update the CL and send it over to review.
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |