Chromium crash in TextureStorage2D destructor

[GoogleCodeExporter]

We're getting a wave of crash reports with the following signature:

Thread 0 *CRASHED* ( EXCEPTION_ACCESS_VIOLATION_READ @ 0x00000000 )
0x67f06669   [libglesv2.dll  - 
texture.cpp:1659]   gl::TextureStorage2D::~TextureStorage2D()
0x67f065c6   [libglesv2.dll  + 0x000165c6]  gl::TextureStorage2D::`scalar 
deleting destructor'(unsigned int)
0x67f07138   [libglesv2.dll  - texture.cpp:2105]    gl::Texture2D::createTexture()
0x67f064ea   [libglesv2.dll  - texture.cpp:1538]    gl::Texture::getTexture()
0x67f0cddd   [libglesv2.dll  - 
context.cpp:2169]   gl::Context::applyTextures(gl::SamplerType)
0x67f0cc99   [libglesv2.dll  - context.cpp:2136]    gl::Context::applyTextures()
0x67f0e124   [libglesv2.dll  - 
context.cpp:2850]   gl::Context::drawElements(unsigned int,int,unsigned int,void 
const *)
0x67ef630d   [libglesv2.dll  - libglesv2.cpp:1918]  glDrawElements
0x5bf59a3f   [chrome.dll     - 
gles2_cmd_decoder.cc:5017]  gpu::gles2::GLES2DecoderImpl::HandleDrawElements(unsi
gned int,gpu::gles2::DrawElements const &)
0x5bf55c8b   [chrome.dll     - 
gles2_cmd_decoder.cc:2913]  gpu::gles2::GLES2DecoderImpl::DoCommand(unsigned 
int,unsigned int,void const *)
0x5bf630d9   [chrome.dll     - 
cmd_parser.cc:57]   gpu::CommandParser::ProcessCommand()
0x5bf52187   [chrome.dll     - gpu_scheduler.cc:100]    gpu::GpuScheduler::PutChanged()
0x5bf51801   [chrome.dll     - 
command_buffer_service.cc:134]  gpu::CommandBufferService::Flush(int)
0x5bee1a2d   [chrome.dll     - 
gpu_command_buffer_stub.cc:352] GpuCommandBufferStub::OnAsyncFlush(int,unsigned 
int)

Most likely related to the recent textureStorage addition?

Original issue reported on code.google.com by vange...@google.com on 7 Dec 2011 at 8:23

[GoogleCodeExporter]

We also see this stack trace:

Thread 0 *CRASHED* ( EXCEPTION_ACCESS_VIOLATION_READ @ 0x00000000 )

0x5c5c6669   [libglesv2.dll  - 
texture.cpp:1659]   gl::TextureStorage2D::~TextureStorage2D()
0x5c5c65c6   [libglesv2.dll  + 0x000165c6]  gl::TextureStorage2D::`scalar 
deleting destructor'(unsigned int)
0x5c5c670a   [libglesv2.dll  + 0x0001670a]  gl::Texture2D::`scalar deleting 
destructor'(unsigned int)
0x5c5bb2ca   [libglesv2.dll  - 
refcountobject.cpp:39]  gl::RefCountObject::release()
0x5c5b15ea   [libglesv2.dll  - 
resourcemanager.cpp:181]    gl::ResourceManager::deleteTexture(unsigned int)
0x5c5cac5e   [libglesv2.dll  - 
context.cpp:941]    gl::Context::deleteTexture(unsigned int)
0x5c5b5df6   [libglesv2.dll  - libglesv2.cpp:1671]  glDeleteTextures
0x5eaf4817   [chrome.dll     - 
gles2_cmd_decoder.cc:2367]  gpu::gles2::GLES2DecoderImpl::DeleteTexturesHelper(in
t,unsigned int const *)
0x5eaf5be0   [chrome.dll     - 
gles2_cmd_decoder.cc:2913]  gpu::gles2::GLES2DecoderImpl::DoCommand(unsigned 
int,unsigned int,void const *)
0x5eb030d9   [chrome.dll     - 
cmd_parser.cc:57]   gpu::CommandParser::ProcessCommand()
0x5eaf2187   [chrome.dll     - gpu_scheduler.cc:100]    gpu::GpuScheduler::PutChanged()
0x5eaf1801   [chrome.dll     - 
command_buffer_service.cc:134]  gpu::CommandBufferService::Flush(int)

Original comment by vange...@google.com on 7 Dec 2011 at 8:25

[GoogleCodeExporter]

Original comment by nicolas....@gmail.com on 7 Dec 2011 at 9:00

• Changed state: Started

[GoogleCodeExporter]

Should be fixed in r905.

Original comment by nicolas....@gmail.com on 7 Dec 2011 at 9:18

• Changed state: Fixed

[GoogleCodeExporter]

Thank you Nicolas for the super-speedy turnaround!

Original comment by vange...@google.com on 8 Dec 2011 at 6:35