Seen multiple times now on b2g current trunk on flame with monkey tests. Might be happening during shutdown. Program received signal SIGSEGV, Segmentation fault. 0xb5d093d8 in mozalloc_abort (msg=<optimized out>) at ../../../memory/mozalloc/mozalloc_abort.cpp:37 37 MOZ_CRASH(); (gdb) bt #0 0xb5d093d8 in mozalloc_abort (msg=<optimized out>) at ../../../memory/mozalloc/mozalloc_abort.cpp:37 #1 0xb47f3160 in Abort ( aMsg=0xbe9bb504 "[Child 9874] ###!!! ABORT: not on worker thread!: 'mWorkerLoopID == MessageLoop::current()->id()', file ../../dist/include/mozilla/ipc/MessageChannel.h, line 401") at ../../../xpcom/base/nsDebugImpl.cpp:469 #2 NS_DebugBreak (aSeverity=<optimized out>, aStr=0xb63849e4 "not on worker thread!", aExpr=0xb63849fa "mWorkerLoopID == MessageLoop::current()->id()", aFile=0xb63849a2 "../../dist/include/mozilla/ipc/MessageChannel.h", aLine=401) at ../../../xpcom/base/nsDebugImpl.cpp:456 #3 0xb49f0f6a in AssertWorkerThread (this=<optimized out>) at ../../dist/include/mozilla/ipc/MessageChannel.h:400 #4 mozilla::ipc::MessageChannel::AssertWorkerThread (this=<optimized out>) at ../../dist/include/mozilla/ipc/MessageChannel.h:398 #5 0xb49f539a in mozilla::ipc::MessageChannel::CxxStackFrame::CxxStackFrame ( this=0xbe9bb95c, that=..., direction=mozilla::ipc::OUT_MESSAGE, msg= 0xaea69060) at ../../../ipc/glue/MessageChannel.cpp:209 #6 0xb49f69b8 in mozilla::ipc::MessageChannel::Send (this=0xb2e76eb0, aMsg=aMsg@entry=0xaea69060) at ../../../ipc/glue/MessageChannel.cpp:517 #7 0xb4b366fe in mozilla::layers::PTextureChild::SendRemoveTexture ( this=0xb1772040) at PTextureChild.cpp:112 #8 0xb4d02cf2 in mozilla::layers::TextureClient::ForceRemove ( ---Type <return> to continue, or q <return> to quit--- this=this@entry=0xb16cb670) at ../../../gfx/layers/client/TextureClient.cpp:516 #9 0xb4d287c0 in mozilla::layers::ShadowLayerForwarder::RemoveTexture (this= 0xb1f01390, aTexture=0xb16cb670) at ../../../gfx/layers/ipc/ShadowLayers.cpp:523 #10 0xb4d0f4d0 in mozilla::layers::TextureClient::Finalize (this=0xb16cb670) at ../../../gfx/layers/client/TextureClient.cpp:558 #11 0xb4c235a8 in mozilla::AtomicRefCountedWithFinalize<mozilla::layers::TextureClient>::Release (this=0xb16cb674) at ../../../../dist/include/mozilla/layers/AtomicRefCountedWithFinalize.h:60 #12 0xb4cfe91e in mozilla::RefPtr<mozilla::layers::TextureClient>::~RefPtr ( this=0xb18c8edc, __in_chrg=<optimized out>) at ../../dist/include/mozilla/RefPtr.h:329 #13 0xb4d0feb0 in ~TextureClientHolder (this=0xb18c8ed8, __in_chrg=<optimized out>) at ../../../gfx/layers/client/TextureClientRecycleAllocator.cpp:90 #14 mozilla::layers::TextureClientRecycleAllocatorImp::TextureClientHolder::Release (this=0xb18c8ed8) at ../../../gfx/layers/client/TextureClientRecycleAllocator.cpp:92 #15 0xb4d0fece in mozilla::RefPtr<mozilla::layers::TextureClientRecycleAllocatorImp::TextureClientHolder>::unref (aVal=<optimized out>) at ../../dist/include/mozilla/RefPtr.h:305 ---Type <return> to continue, or q <return> to quit--- #16 0xb4d0fef4 in mozilla::RefPtr<mozilla::layers::TextureClientRecycleAllocatorImp::TextureClientHolder>::~RefPtr (this=0xbe9bba6c, __in_chrg=<optimized out>) at ../../dist/include/mozilla/RefPtr.h:244 #17 0xb4d1031e in mozilla::layers::TextureClientRecycleAllocatorImp::RecycleCallbackImp (this=0xb16ca110, aClient=0xb16cb670) at ../../../gfx/layers/client/TextureClientRecycleAllocator.cpp:226 #18 0xb4c23606 in mozilla::AtomicRefCountedWithFinalize<mozilla::layers::TextureClient>::Release (this=0xb16cb674) at ../../../../dist/include/mozilla/layers/AtomicRefCountedWithFinalize.h:74 #19 0xb48430f4 in PLDHashTable::Finish (this=this@entry=0xb1de07c4) at /Volumes/2mac/moz/ib2g/xpcom/glue/pldhash.cpp:358 #20 0xb484317c in PL_DHashTableFinish (aTable=aTable@entry=0xb1de07c4) at /Volumes/2mac/moz/ib2g/xpcom/glue/pldhash.cpp:374 #21 0xb47f2008 in nsTHashtable<nsBaseHashtableET<nsCStringHashKey, unsigned int> >::~nsTHashtable (this=this@entry=0xb1de07c4, __in_chrg=<optimized out>) at ../../dist/include/nsTHashtable.h:401 #22 0xb4cd605a in ~nsBaseHashtable (this=0xb1de07c4, __in_chrg=<optimized out>) at ../../dist/include/nsBaseHashtable.h:53 #23 ~nsDataHashtable (this=0xb1de07c4, __in_chrg=<optimized out>) at ../../dist/include/nsDataHashtable.h:22 #24 mozilla::layers::CairoImage::~CairoImage (this=0xb1de0780, __in_chrg=<optimized out>) at ../../../gfx/layers/ImageContainer.cpp:487 ---Type <return> to continue, or q <return> to quit--- #25 0xb4cd6078 in mozilla::layers::CairoImage::~CairoImage (this=0xb1de0780, __in_chrg=<optimized out>) at ../../../gfx/layers/ImageContainer.cpp:487 #26 0xb4c0400c in mozilla::layers::Image::Release (this=0xb1de0780) at ../../../../dist/include/ImageContainer.h:145 #27 0xb4c06eb0 in nsRefPtr<mozilla::layers::Image>::~nsRefPtr ( this=0xb17d9e40, __in_chrg=<optimized out>) at ../../../../../xpcom/base/nsRefPtr.h:60 #28 0xb4cd6504 in mozilla::layers::ImageContainer::~ImageContainer ( this=0xb17d9e20, __in_chrg=<optimized out>) at ../../../gfx/layers/ImageContainer.cpp:159 #29 0xb4c0665a in mozilla::layers::ImageContainer::Release (this=0xb17d9e20) at ../../../../dist/include/ImageContainer.h:298 #30 0xb4d69c14 in ~nsRefPtr (this=0xb1dd5704, __in_chrg=<optimized out>) at ../../dist/include/nsRefPtr.h:60 #31 mozilla::image::RasterImage::~RasterImage (this=0xb1dd5690, __in_chrg=<optimized out>) at ../../../image/src/RasterImage.cpp:356 #32 0xb4d69c98 in mozilla::image::RasterImage::~RasterImage ( this=this@entry=0xb1dd5690, __in_chrg=<optimized out>) at ../../../image/src/RasterImage.cpp:356 #33 0xb4d69cfc in mozilla::image::RasterImage::Release (this=0xb1dd5690) at ../../../image/src/RasterImage.cpp:279 #34 0xb47f3516 in nsRefPtr<{anonymous}::DumpMemoryInfoToTempDirRunnable>::~nsRefPtr(void) (this=0xb16cb228, __in_chrg=<optimized out>) ---Type <return> to continue, or q <return> to quit--- at ../../dist/include/nsRefPtr.h:60 #35 0xb4d73618 in imgRequest::~imgRequest (this=0xb16cb1f0, __in_chrg=<optimized out>) at ../../../image/src/imgRequest.cpp:90 #36 0xb4d73668 in imgRequest::~imgRequest (this=this@entry=0xb16cb1f0, __in_chrg=<optimized out>) at ../../../image/src/imgRequest.cpp:90 #37 0xb4d736c8 in imgRequest::Release (this=0xb16cb1f0) at ../../../image/src/imgRequest.cpp:57 #38 0xb4d6deec in nsRefPtr<imgRequest>::~nsRefPtr (this=0xb179f43c, __in_chrg=<optimized out>) at ../../dist/include/nsRefPtr.h:60 #39 0xb4d6df0e in imgCacheEntry::~imgCacheEntry (this=0xb179f430, __in_chrg=<optimized out>) at ../../../image/src/imgLoader.cpp:791 #40 0xb4d6df74 in Release (this=0xb179f430) at ../../../image/src/imgLoader.h:63 #41 imgCacheEntry::Release (this=0xb179f430) at ../../../image/src/imgLoader.h:55 #42 0xb4d6e494 in nsRefPtr<imgCacheEntry>::~nsRefPtr (this=0xaea5220c, __in_chrg=<optimized out>) at ../../dist/include/nsRefPtr.h:60 #43 0xb4d71466 in Destruct (aE=0xaea5220c) at ../../dist/include/nsTArray.h:488 #44 DestructRange (aCount=29, aStart=0, this=0xbe9bbc6c) at ../../dist/include/nsTArray.h:1701 #45 nsTArray_Impl<nsRefPtr<imgCacheEntry>, nsTArrayInfallibleAllocator>::RemoveElementsAt (this=this@entry=0xbe9bbc6c, aStart=aStart@entry=0, aCount=29) at ../../dist/include/nsTArray.h:1397 ---Type <return> to continue, or q <return> to quit--- #46 0xb4d714c2 in Clear (this=this@entry=0xbe9bbc6c) at ../../dist/include/nsTArray.h:1406 #47 nsTArray_Impl<nsRefPtr<imgCacheEntry>, nsTArrayInfallibleAllocator>::~nsTArray_Impl (this=this@entry=0xbe9bbc6c, __in_chrg=<optimized out>) at ../../dist/include/nsTArray.h:785 #48 0xb4d715fa in ~nsTArray (this=0xbe9bbc6c, __in_chrg=<optimized out>) at ../../dist/include/nsTArray.h:1775 #49 imgLoader::EvictEntries (this=this@entry=0xb3a397e0, aCacheToClear=...) at ../../../image/src/imgLoader.cpp:1811 #50 0xb4d71624 in imgLoader::ClearImageCache (this=this@entry=0xb3a397e0) at ../../../image/src/imgLoader.cpp:1264 #51 0xb4d71780 in imgLoader::~imgLoader (this=0xb3a397e0, __in_chrg=<optimized out>) at ../../../image/src/imgLoader.cpp:1057 #52 0xb4d71884 in imgLoader::~imgLoader (this=this@entry=0xb3a397e0, __in_chrg=<optimized out>) at ../../../image/src/imgLoader.cpp:1066 #53 0xb4d71912 in Release (this=0xb3a397e0) at ../../../image/src/imgLoader.cpp:1001 #54 imgLoader::Release (this=0xb3a397e0) at ../../../image/src/imgLoader.cpp:1001 #55 0xb4d71976 in imgLoader::Shutdown () at ../../../image/src/imgLoader.cpp:1252 #56 0xb4d8f65e in mozilla::image::ShutdownModule () at ../../../image/build/nsImageModule.cpp:108 ---Type <return> to continue, or q <return> to quit--- #57 0xb58a7416 in LayoutModuleDtor () at ../../../layout/build/nsLayoutModule.cpp:1298 #58 0xb4825ac0 in nsComponentManagerImpl::KnownModule::~KnownModule ( this=0xb3a808e0, __in_chrg=<optimized out>) at ../../../xpcom/components/nsComponentManager.h:234 #59 0xb48290f4 in nsAutoPtr<nsComponentManagerImpl::KnownModule>::~nsAutoPtr ( this=0xb3a63770, __in_chrg=<optimized out>) at ../../dist/include/nsAutoPtr.h:74 #60 0xb4829156 in Destruct (aE=0xb3a63770) at ../../dist/include/nsTArray.h:488 #61 DestructRange (aCount=59, aStart=0, this=0xb3a830fc) at ../../dist/include/nsTArray.h:1701 #62 nsTArray_Impl<nsAutoPtr<nsComponentManagerImpl::KnownModule>, nsTArrayInfallibleAllocator>::RemoveElementsAt (this=this@entry=0xb3a830fc, aStart=aStart@entry=0, aCount=59) at ../../dist/include/nsTArray.h:1397 #63 0xb48291ae in nsTArray_Impl<nsAutoPtr<nsComponentManagerImpl::KnownModule>, nsTArrayInfallibleAllocator>::Clear (this=this@entry=0xb3a830fc) at ../../dist/include/nsTArray.h:1406 #64 0xb4829298 in nsComponentManagerImpl::Shutdown (this=0xb3a83040) at ../../../xpcom/components/nsComponentManager.cpp:898 #65 0xb4849518 in mozilla::ShutdownXPCOM (aServMgr=<optimized out>) at ../../../xpcom/build/XPCOMInit.cpp:974 #66 0xb5a56764 in XRE_TermEmbedding () at ../../../toolkit/xre/nsEmbedFunctions.cpp:206 ---Type <return> to continue, or q <return> to quit--- #67 0xb49f20ce in mozilla::ipc::ScopedXREEmbed::Stop (this=0xb3a55ed0) at ../../../ipc/glue/ScopedXREEmbed.cpp:115 #68 0xb5a56e56 in XRE_InitChildProcess (aArgc=<optimized out>, aArgv=<optimized out>, aGMPLoader=<optimized out>) at ../../../toolkit/xre/nsEmbedFunctions.cpp:579 #69 0xb6fe22c8 in content_process_main (argc=6, argv=0xbe9bc8e4) at ../../../ipc/app/../contentproc/plugin-container.cpp:211 #70 0xb6f164a4 in __libc_init (raw_args=0xbe9bc8e0, onexit=<optimized out>, slingshot=0xb6fe2329 <main(int, char**)>, structors=<optimized out>) at bionic/libc/bionic/libc_init_dynamic.cpp:112 #71 0xb6fe21a8 in _start ()

I will hazard a guess that this PTextureChild actor was originally bound to a non-main thread, but here during XPCOM shutdown through some chain of destructors we're calling an IPDL method on the same actor from the main thread?

Seth, any changes in image cache that could have caused this?

(In reply to ben turner [:bent] (use the needinfo? flag!) from comment #1) > I will hazard a guess that this PTextureChild actor was originally bound to > a non-main thread, but here during XPCOM shutdown through some chain of > destructors we're calling an IPDL method on the same actor from the main > thread? I couldn't find a way for this to happen. This TextureClient has been created on the main thread because it's mForwarder member is the ShadowLayerForwarder which is the main thread one and there is no way for a TextureClient to change its forwarder to one that doesn't belong to the same thread (the only reassignment of mForwarder is in TextureClient::InitIPDLActor where we first assert that the forwarders belongs to the same thread (granted it's only a debug assertion, but if this would have happened, I am certian things would have blown up right after InitIPDLActor). Now, the only other thing I could think of is that this is happening late enough in the shutdown that the assertion mWorkerLoopID == MessageLoop::current()->id() wrongly fails due to the threads system being already shut down. And in fact, > #65 0xb4849518 in mozilla::ShutdownXPCOM (aServMgr=<optimized out>) > at ../../../xpcom/build/XPCOMInit.cpp:974 is happening after the shutdown of threads so I would bet on this being the cause, and it would not be the first time we get a bug caused by an assertion related to threads being wrongly hit after the shutdown of threads. So in short, I think this texture is being destroyed way too late.

That sounds very reasonable!

(In reply to Milan Sreckovic [:milan] from comment #2) > Seth, any changes in image cache that could have caused this? Nothing that has changed recently seems like it could have caused this. I initially thought this might have somehow been triggered by bug 1116733, but it hasn't hit central yet. I concur with Nical that general shutdown madness is the cause. It's quite tricky to destroy these objects earlier, though. I'd prefer if we could make the texture code robust enough to handle this situation.

What are the next steps here?