Bug 216777 – REGRESSION(r267010) [GLIB] compositing/video/video-update-rendering.html is a flaky crash

• Component: New Bugs
• Status: NEW

[Diego Pino]

The test has been crashing intermittently since r267010. It seems the error happens in Mesa.


Crash-log: https://build.webkit.org/results/GTK%20Linux%2064-bit%20Release%20(Tests)/r267339%20(15944)/compositing/video/video-update-rendering-crash-log.txt


Thread 1 (Thread 0x7f26697fa700 (LWP 25133)):
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007f26c4d34855 in __GI_abort () at abort.c:79
#2  0x00007f26c4d34729 in __assert_fail_base (fmt=0x7f26c4ea20e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x7f2653695c10 "c != _SIMPLE_MTX_INVALID_VALUE", file=0x7f2653695caf "../src/util/simple_mtx.h", line=89, function=<optimized out>) at assert.c:92
#3  0x00007f26c4d43db6 in __GI___assert_fail (assertion=assertion@entry=0x7f2653695c10 "c != _SIMPLE_MTX_INVALID_VALUE", file=file@entry=0x7f2653695caf "../src/util/simple_mtx.h", line=line@entry=89, function=function@entry=0x7f26536a2e90 <__PRETTY_FUNCTION__.11> "simple_mtx_lock") at assert.c:101
#4  0x00007f2652874a35 in simple_mtx_lock (mtx=0x7f25a94178e0) at ../src/util/simple_mtx.h:83
#5  0x00007f26528752fe in simple_mtx_lock (mtx=0x7f25a94178e0) at ../src/util/simple_mtx.h:94
#6  st_save_zombie_sampler_view (st=0x7f25a9416070, view=<optimized out>) at ../src/mesa/state_tracker/st_context.c:315
#7  0x00007f26528670bd in st_texture_release_all_sampler_views (st=st@entry=0x7f2658349bd0, stObj=stObj@entry=0x7f25a82c39a0) at ../src/mesa/state_tracker/st_sampler_view.c:233
#8  0x00007f26528677bf in st_texture_release_all_sampler_views (stObj=0x7f25a82c39a0, st=0x7f2658349bd0) at ../src/mesa/state_tracker/st_sampler_view.c:221
#9  st_delete_texture_sampler_views (st=st@entry=0x7f2658349bd0, stObj=stObj@entry=0x7f25a82c39a0) at ../src/mesa/state_tracker/st_sampler_view.c:253
#10 0x00007f26528566be in st_DeleteTextureObject (ctx=0x7f26584b5530, texObj=0x7f25a82c39a0) at ../src/mesa/state_tracker/st_cb_texture.c:193
#11 0x00007f2652a1d670 in _mesa_reference_texobj_ (ptr=ptr@entry=0x7f26584c8bf8, tex=tex@entry=0x7f2658505ce0) at ../src/mesa/main/texobj.c:607
#12 0x00007f2652a1d9f8 in _mesa_reference_texobj (tex=0x7f2658505ce0, ptr=0x7f26584c8bf8) at ../src/mesa/main/texobj.h:100
#13 bind_texture_object (ctx=0x7f26584b5530, unit=2, texObj=0x7f2658505ce0) at ../src/mesa/main/texobj.c:1691
#14 0x00007f26cee8db86 in WebCore::BitmapTextureGL::updateContents(void const*, WebCore::IntRect const&, WebCore::IntPoint const&, int) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#15 0x00007f26cd52a00c in WebCore::CoordinatedBackingStoreTile::swapBuffers(WebCore::TextureMapper&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#16 0x00007f26cd52b0c5 in WebCore::CoordinatedBackingStore::commitTileOperations(WebCore::TextureMapper&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#17 0x00007f26cd00d316 in WebKit::CoordinatedGraphicsScene::updateSceneState() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#18 0x00007f26cd00bae2 in WebKit::CoordinatedGraphicsScene::paintToCurrentGLContext(WebCore::TransformationMatrix const&, WebCore::FloatRect const&, unsigned int) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#19 0x00007f26cd00f79b in WebKit::ThreadedCompositor::renderLayerTree() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#20 0x00007f26ca74f7dc in WTF::RunLoop::TimerBase::TimerBase(WTF::RunLoop&)::$_3::__invoke(void*) () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#21 0x00007f26ca74ec3a in WTF::RunLoop::$_0::__invoke(_GSource*, int (*)(void*), void*) () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#22 0x00007f26c61a404f in g_main_dispatch (context=0x7f2658000b60) at ../glib/gmain.c:3325
#23 g_main_context_dispatch (context=0x7f2658000b60) at ../glib/gmain.c:4016
#24 0x00007f26c61a43f8 in g_main_context_iterate (context=0x7f2658000b60, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4092
#25 0x00007f26c61a4713 in g_main_loop_run (loop=0x7f2658001480) at ../glib/gmain.c:4290
#26 0x00007f26ca74f1db in WTF::RunLoop::run() () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#27 0x00007f26ca6f9620 in WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#28 0x00007f26ca751976 in WTF::wtfThreadEntryPoint(void*) () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#29 0x00007f26c72984d2 in start_thread (arg=<optimized out>) at pthread_create.c:477
#30 0x00007f26c4e104d3 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

STDERR: 
WebKitWebProcess: ../src/util/simple_mtx.h:89: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE' failed.

[Philippe Normand]

Strange, I thought the Mesa fixes I cherry-picked in the SDK were fixing that...

[Lauro Moura]

Gardened in r267406.

Since the flatpak update, this test has been flaky only in the X11 bots.

[Diego Pino]

There are many more tests crashing with the same stacktrace in GTK Tests bot. Examining the latest builds, I got:

gtk-release.15984 fast/spatial-navigation/snav-table-traversal.html
gtk-release.15984 imported/w3c/web-platform-tests/css/css-ui/animation/caret-color-interpolation.html
gtk-release.15985 imported/w3c/web-platform-tests/css/css-ui/appearance-initial-value-001.html
gtk-release.15985 media/video-display-toggle.html
gtk-release.15986 imported/w3c/web-platform-tests/css/css-transitions/CSSTransition-ready.tentative.html
gtk-release.15987 imported/w3c/web-platform-tests/css/css-values/angle-units-003.html
gtk-release.15988 imported/w3c/web-platform-tests/css/css-ui/parsing/cursor-valid.html
gtk-release.15989 compositing/reflections/nested-reflection-anchor-point.html
gtk-release.15989 imported/w3c/web-platform-tests/css/css-ui/parsing/cursor-computed.html
gtk-release.15990 imported/w3c/web-platform-tests/css/css-ui/parsing/box-sizing-computed.html

[Lauro Moura]

Created attachment 409606 [details]
crash log for imported/w3c/web-platform-tests/css/css-transitions/parsing/transition-delay-computed.html

imported/w3c/web-platform-tests/css/css-transitions/parsing/transition-delay-computed.html

Thread 1 (Thread 0x7f4e9f7fe700 (LWP 77960)):
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007f4fffd98855 in __GI_abort () at abort.c:79
#2  0x00007f4fffd98729 in __assert_fail_base (fmt=0x7f4ffff060e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x7f4f518b7c10 "c != _SIMPLE_MTX_INVALID_VALUE", file=0x7f4f518b7caf "../src/util/simple_mtx.h", line=89, function=<optimized out>) at assert.c:92
#3  0x00007f4fffda7db6 in __GI___assert_fail (assertion=assertion@entry=0x7f4f518b7c10 "c != _SIMPLE_MTX_INVALID_VALUE", file=file@entry=0x7f4f518b7caf "../src/util/simple_mtx.h", line=line@entry=89, function=function@entry=0x7f4f518c4e90 <__PRETTY_FUNCTION__.11> "simple_mtx_lock") at assert.c:101
#4  0x00007f4f50a96a35 in simple_mtx_lock (mtx=0x7f4e8407b550) at ../src/util/simple_mtx.h:83
#5  0x00007f4f50a972fe in simple_mtx_lock (mtx=0x7f4e8407b550) at ../src/util/simple_mtx.h:94
#6  st_save_zombie_sampler_view (st=0x7f4e84079ce0, view=<optimized out>) at ../src/mesa/state_tracker/st_context.c:315
#7  0x00007f4f50a890bd in st_texture_release_all_sampler_views (st=st@entry=0x7f4e8c0843d0, stObj=stObj@entry=0x7f4e84081520) at ../src/mesa/state_tracker/st_sampler_view.c:233
#8  0x00007f4f50a897bf in st_texture_release_all_sampler_views (stObj=0x7f4e84081520, st=0x7f4e8c0843d0) at ../src/mesa/state_tracker/st_sampler_view.c:221
#9  st_delete_texture_sampler_views (st=st@entry=0x7f4e8c0843d0, stObj=stObj@entry=0x7f4e84081520) at ../src/mesa/state_tracker/st_sampler_view.c:253
#10 0x00007f4f50a786be in st_DeleteTextureObject (ctx=0x7f4e8c1f01b0, texObj=0x7f4e84081520) at ../src/mesa/state_tracker/st_cb_texture.c:193
#11 0x00007f4f50c3f670 in _mesa_reference_texobj_ (ptr=ptr@entry=0x7f4e8c203788, tex=tex@entry=0x0) at ../src/mesa/main/texobj.c:607
#12 0x00007f4f50c4a93d in _mesa_reference_texobj (tex=0x0, ptr=<optimized out>) at ../src/mesa/main/texobj.h:100
#13 _mesa_free_texture_data (ctx=ctx@entry=0x7f4e8c1f01b0) at ../src/mesa/main/texstate.c:1101
#14 0x00007f4f50b2ee57 in _mesa_free_context_data (ctx=ctx@entry=0x7f4e8c1f01b0, destroy_debug_output=destroy_debug_output@entry=false) at ../src/mesa/main/context.c:1358
#15 0x00007f4f50a98563 in st_destroy_context (st=0x7f4e8c0843d0) at ../src/mesa/state_tracker/st_context.c:1112
#16 0x00007f4f50a74d82 in dri_destroy_context (cPriv=<optimized out>) at ../src/gallium/state_trackers/dri/dri_context.c:247
#17 0x00007f4f50fa6277 in driDestroyContext (pcp=0x7f4e8c003400) at ../src/mesa/drivers/dri/common/dri_util.c:528
#18 0x00007f4fac444343 in drisw_destroy_context (context=0x7f4e8c003270) at ../src/glx/drisw_glx.c:376
#19 0x00007f4fac446789 in glXDestroyContext (ctx=0x7f4e8c003270, dpy=0x11a1da0) at ../src/glx/glxcmds.c:511
#20 glXDestroyContext (dpy=0x11a1da0, ctx=0x7f4e8c003270) at ../src/glx/glxcmds.c:492
#21 0x00007f500985846b in WebCore::GLContextGLX::~GLContextGLX() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#22 0x00007f50098584e9 in WebCore::GLContextGLX::~GLContextGLX() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#23 0x00007f500808c378 in WTF::Detail::CallableWrapper<WebKit::ThreadedCompositor::invalidate()::$_8, void>::call() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#24 0x00007f500808c085 in WTF::Detail::CallableWrapper<WebKit::CompositingRunLoop::performTaskSync(WTF::Function<void ()>&&)::$_5, void>::call() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#25 0x00007f5005768756 in WTF::RunLoop::performWork() () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#26 0x00007f50057c0636 in WTF::RunLoop::RunLoop()::$_1::__invoke(void*) () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#27 0x00007f50057bfb2a in WTF::RunLoop::$_0::__invoke(_GSource*, int (*)(void*), void*) () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#28 0x00007f500120804f in g_main_dispatch (context=0x7f4e8c000b60) at ../glib/gmain.c:3325
#29 g_main_context_dispatch (context=0x7f4e8c000b60) at ../glib/gmain.c:4016
#30 0x00007f50012083f8 in g_main_context_iterate (context=0x7f4e8c000b60, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4092
#31 0x00007f5001208713 in g_main_loop_run (loop=0x7f4e8c001d40) at ../glib/gmain.c:4290
#32 0x00007f50057c00cb in WTF::RunLoop::run() () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#33 0x00007f500576a510 in WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#34 0x00007f50057c2866 in WTF::wtfThreadEntryPoint(void*) () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#35 0x00007f50022fc4d2 in start_thread (arg=<optimized out>) at pthread_create.c:477
#36 0x00007f4fffe744d3 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

[Lauro Moura]

Created attachment 409654 [details]
Reproducible crash log for replaced-element-003.tentative.html

The smallest test case I managed to reproduce reliably:

./Tools/Scripts/run-webkit-tests --verbose --debug-rwt-logging --no-retry-failures --no-new-test-results --no-build --no-show-results --clobber-old-results --display-server=xvfb --results-directory layout-test-results --release --gtk imported/w3c/web-platform-tests/css/css-sizing/aspect-ratio/replaced-element-003.tentative.html --iterations=2

Trace snippet:

Thread 1 (Thread 0x7efe00ff9700 (LWP 192)):
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007efec696e855 in __GI_abort () at abort.c:79
#2  0x00007efec696e729 in __assert_fail_base (fmt=0x7efec6adc0e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x7efe5f695c10 "c != _SIMPLE_MTX_INVALID_VALUE", file=0x7efe5f695caf "../src/util/s
imple_mtx.h", line=89, function=<optimized out>) at assert.c:92
#3  0x00007efec697ddb6 in __GI___assert_fail (assertion=assertion@entry=0x7efe5f695c10 "c != _SIMPLE_MTX_INVALID_VALUE", file=file@entry=0x7efe5f695caf "../src/util/simple_mtx.h", line=line@entry=89, fun
ction=function@entry=0x7efe5f6a2e90 <__PRETTY_FUNCTION__.11> "simple_mtx_lock") at assert.c:101
#4  0x00007efe5e874a35 in simple_mtx_lock (mtx=0x7efdc807ab00) at ../src/util/simple_mtx.h:83
#5  0x00007efe5e8752fe in simple_mtx_lock (mtx=0x7efdc807ab00) at ../src/util/simple_mtx.h:94
#6  st_save_zombie_sampler_view (st=0x7efdc8079290, view=<optimized out>) at ../src/mesa/state_tracker/st_context.c:315
#7  0x00007efe5e8670bd in st_texture_release_all_sampler_views (st=st@entry=0x7efdd0083bf0, stObj=stObj@entry=0x7efdc8222760) at ../src/mesa/state_tracker/st_sampler_view.c:233
#8  0x00007efe5e8677bf in st_texture_release_all_sampler_views (stObj=0x7efdc8222760, st=0x7efdd0083bf0) at ../src/mesa/state_tracker/st_sampler_view.c:221
#9  st_delete_texture_sampler_views (st=st@entry=0x7efdd0083bf0, stObj=stObj@entry=0x7efdc8222760) at ../src/mesa/state_tracker/st_sampler_view.c:253
#10 0x00007efe5e8566be in st_DeleteTextureObject (ctx=0x7efdd01efc10, texObj=0x7efdc8222760) at ../src/mesa/state_tracker/st_cb_texture.c:193
#11 0x00007efe5ea1d670 in _mesa_reference_texobj_ (ptr=ptr@entry=0x7efdd02032d8, tex=tex@entry=0x7efdd022f910) at ../src/mesa/main/texobj.c:607
#12 0x00007efe5ea1d9f8 in _mesa_reference_texobj (tex=0x7efdd022f910, ptr=0x7efdd02032d8) at ../src/mesa/main/texobj.h:100
#13 bind_texture_object (ctx=0x7efdd01efc10, unit=2, texObj=0x7efdd022f910) at ../src/mesa/main/texobj.c:1691
#14 0x00007efed0f44754 in WebCore::BitmapTextureGL::updateContents(void const*, WebCore::IntRect const&, WebCore::IntPoint const&, int) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#15 0x00007efecf1f749f in WebCore::CoordinatedBackingStoreTile::swapBuffers(WebCore::TextureMapper&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#16 0x00007efecf1f818b in WebCore::CoordinatedBackingStore::commitTileOperations(WebCore::TextureMapper&) () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#17 0x00007efecec99235 in WebKit::CoordinatedGraphicsScene::updateSceneState() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#18 0x00007efecec9b0e5 in WebKit::CoordinatedGraphicsScene::paintToCurrentGLContext(WebCore::TransformationMatrix const&, WebCore::FloatRect const&, unsigned int) () at /app/webkit/WebKitBuild/Release/li
b/libwebkit2gtk-4.0.so.37
#19 0x00007efecec9b5ef in WebKit::ThreadedCompositor::renderLayerTree() () at /app/webkit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#20 0x00007efecc4fdff5 in WTF::RunLoop::TimerBase::TimerBase(WTF::RunLoop&)::{lambda(void*)#1}::_FUN(void*) () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#21 0x00007efecc4fe26f in WTF::RunLoop::{lambda(_GSource*, int (*)(void*), void*)#1}::_FUN(_GSource*, int (*)(void*), void*) () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#22 0x00007efec7dde04f in g_main_dispatch (context=0x7efdd0000b60) at ../glib/gmain.c:3325
#23 g_main_context_dispatch (context=0x7efdd0000b60) at ../glib/gmain.c:4016
#24 0x00007efec7dde3f8 in g_main_context_iterate (context=0x7efdd0000b60, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4092
#25 0x00007efec7dde713 in g_main_loop_run (loop=0x7efdd0001480) at ../glib/gmain.c:4290
#26 0x00007efecc4fe3b8 in WTF::RunLoop::run() () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#27 0x00007efecc49ce99 in WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#28 0x00007efecc5004c9 in WTF::wtfThreadEntryPoint(void*) () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#29 0x00007efec8ed24d2 in start_thread (arg=<optimized out>) at pthread_create.c:477
#30 0x00007efec6a4a4d3 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

[Radar WebKit Bug Importer]

<rdar://problem/69696336>

[Lauro Moura]

More info:

In Mesa, between the 19.2 and 19.3 branches, pthread_mutex was replaced with its own simple_mutex. https://gitlab.freedesktop.org/mesa/mesa/-/commit/5498a8d23c

And between the 19.3 and 20.0 branches, the assert was added to Mesa to avoid invalid mutex states. https://gitlab.freedesktop.org/mesa/mesa/-/commit/74665eaf

With the 0.3 SDK, mesa was bumped to 20.1.5 and the assert from this bug started to be hit both locally and in the bots.

That said, using the Mesa version from the SDK (20.1.5) and bisecting WebKit, the assert starts to be triggered in a small range with the following revisions from August 2019, related to color formats in the texturemapper & cia:

r249427 / bug132869
r249428 / bug200914
r249429 / bug200922

The previous revision (r249426) works fine.

I could not bisect further as these commits are closely related and trying one of the first two trigger a different assert (related to Cairo).

cc'ing Zan and Chris as they were the original authors of the patches.

To build, I had to backport the changes from r250747 related to ICU 65>.

To reliably trigger the mesa assert, I've used the comand from #c5.

As these tests were not yet imported, I manually copied the LayoutTests/imported/w3c folder from a recent checkout before running and used `--root=<builddir>` to point to the folder where I had run cmake/ninja.

[Carlos Alberto Lopez Perez]

(In reply to Lauro Moura from comment #7)
[....]
> 
> And between the 19.3 and 20.0 branches, the assert was added to Mesa to
> avoid invalid mutex states.
> https://gitlab.freedesktop.org/mesa/mesa/-/commit/74665eaf
> 
> With the 0.3 SDK, mesa was bumped to 20.1.5 and the assert from this bug
> started to be hit both locally and in the bots.
> 
> That said, using the Mesa version from the SDK (20.1.5) and bisecting
> WebKit, the assert starts to be triggered in a small range with the
> following revisions from August 2019, related to color formats in the
> texturemapper & cia:
> 
> r249427 / bug132869
> r249428 / bug200914
> r249429 / bug200922
> 
> The previous revision (r249426) works fine.
> 
> I could not bisect further as these commits are closely related and trying
> one of the first two trigger a different assert (related to Cairo).
> 
> cc'ing Zan and Chris as they were the original authors of the patches.
> 
> To build, I had to backport the changes from r250747 related to ICU 65>.
> 
> To reliably trigger the mesa assert, I've used the comand from #c5.
> 
> As these tests were not yet imported, I manually copied the
> LayoutTests/imported/w3c folder from a recent checkout before running and
> used `--root=<builddir>` to point to the folder where I had run cmake/ninja.


Great job with this findings!


I have checked that if you build with -DUSE_GSTREAMER_GL=OFF then the crash is not longer reproducible, so the codepath that triggers this crash is only enabled with USE_GSTREAMER_GL=ON

In the traceback above I can see that it enters into this state in the function WebCore::BitmapTextureGL::updateContents() when it calls glBindTexture(), which triggers this assertion inside Mesa.

I guess that then the assertion happens because Mesa tries to acquire the texture mutex for updating it, but the mutex is marked with an invalid state because the texture was previously destroyed.

Looking into the Mesa repository I spotted two commit that we don't have in our branch and looks like two good candidates to be merged with the hope of fixing this issue.

- https://gitlab.freedesktop.org/mesa/mesa/-/commit/045267d1e62
- https://gitlab.freedesktop.org/mesa/mesa/-/commit/de3d7dbed52

I have not tested if rebuilding Mesa with this two commits backported fix the issue or not. I tried to build locally to test it but I found issues with bst-wrapper, it fails to build some packages previous to building mesa

[Carlos Alberto Lopez Perez]

(In reply to Carlos Alberto Lopez Perez from comment #8)
> Looking into the Mesa repository I spotted two commit that we don't have in
> our branch and looks like two good candidates to be merged with the hope of
> fixing this issue.
> 
> - https://gitlab.freedesktop.org/mesa/mesa/-/commit/045267d1e62
> - https://gitlab.freedesktop.org/mesa/mesa/-/commit/de3d7dbed52
> 

I pasted the wrong commit, the second should be https://gitlab.freedesktop.org/mesa/mesa/-/commit/46b3cb011fd (instead of de3d7dbed52), and this one is already merged on the branch we are using.

So the only one we miss is 045267d1e62. Here is a patch for webkit/bst for trying: http://ix.io/2CfG

If backporting this commits doesn't fix the issue then another option we have is to disable this assertion on Mesa. We can do that by setting "-Db_ndebug=true" in mesa.bst

Ideally we would have two builds of mesa, one with "-Db_ndebug=false" for Debug builds and other with "-Db_ndebug=true" for release builds so that only on debug builds the asserts for Mesa are enabled. But maybe having that is still not possible, not sure.

[Philippe Normand]

(In reply to Carlos Alberto Lopez Perez from comment #9)
> (In reply to Carlos Alberto Lopez Perez from comment #8)
> > Looking into the Mesa repository I spotted two commit that we don't have in
> > our branch and looks like two good candidates to be merged with the hope of
> > fixing this issue.
> > 
> > - https://gitlab.freedesktop.org/mesa/mesa/-/commit/045267d1e62
> > - https://gitlab.freedesktop.org/mesa/mesa/-/commit/de3d7dbed52
> > 
> 
> I pasted the wrong commit, the second should be
> https://gitlab.freedesktop.org/mesa/mesa/-/commit/46b3cb011fd (instead of
> de3d7dbed52), and this one is already merged on the branch we are using.
> 
> So the only one we miss is 045267d1e62. Here is a patch for webkit/bst for
> trying: http://ix.io/2CfG
> 

I can add this in the SDK.

> If backporting this commits doesn't fix the issue then another option we
> have is to disable this assertion on Mesa. We can do that by setting
> "-Db_ndebug=true" in mesa.bst
> 
> Ideally we would have two builds of mesa, one with "-Db_ndebug=false" for
> Debug builds and other with "-Db_ndebug=true" for release builds so that
> only on debug builds the asserts for Mesa are enabled. But maybe having that
> is still not possible, not sure.

Not easily possible currently. To have this behavior I think we could use a new Flatpak extension that would be enabled only for WK Debug builds, but it's not trivial to accomplish.

[Carlos Alberto Lopez Perez]

(In reply to Philippe Normand from comment #10)
> (In reply to Carlos Alberto Lopez Perez from comment #9)
> > (In reply to Carlos Alberto Lopez Perez from comment #8)
> > > Looking into the Mesa repository I spotted two commit that we don't have in
> > > our branch and looks like two good candidates to be merged with the hope of
> > > fixing this issue.
> > > 
> > > - https://gitlab.freedesktop.org/mesa/mesa/-/commit/045267d1e62
> > > - https://gitlab.freedesktop.org/mesa/mesa/-/commit/de3d7dbed52
> > > 
> > 
> > I pasted the wrong commit, the second should be
> > https://gitlab.freedesktop.org/mesa/mesa/-/commit/46b3cb011fd (instead of
> > de3d7dbed52), and this one is already merged on the branch we are using.
> > 
> > So the only one we miss is 045267d1e62. Here is a patch for webkit/bst for
> > trying: http://ix.io/2CfG
> > 
> 
> I can add this in the SDK.
> 

This was done in bug 218281 and now the issue seems fixed.

The only thing that remains is to actually check this issue doesn't happen again after some time and then update the TestExpectations accordingly