Closed Bug 595194 Opened 14 years ago Closed 14 years ago

CGL context creation crashes on Mac Tryserver

Categories

(Core :: Graphics, defect)

Product:
Core
Component:
Graphics
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla2.0b7
Tracking Flags:
Tracking Status
blocking2.0 --- beta7+

People

(Reporter: bjacob, Assigned: bjacob)

References

Details

Attachments

(2 files)

Fix CGL crash with null gGlobalContext
1.19 KB, patch
bas.schouten
: review+
Details | Diff | Splinter Review
patch ready to import
1.40 KB, patch
Details | Diff | Splinter Review 
This comes from bug 582053, where I've done a tryserver run with the WebGL mochitest enabled on native OpenGL.

I'm getting a crash on Mac:
  http://tinderbox.mozilla.org/showlog.cgi?log=MozillaTry/1284130180.1284130571.16454.gz

Here are the last lines of output before the crash:

34282 INFO TEST-START |
/tests/content/canvas/test/webgl/test_webgl_conformance_test_suite.html
colorbits: 24 alpha: 8 depth: 16 stencil: 0
2010-09-10 07:55:31.396 firefox-bin[442:903] invalid pixel format
2010-09-10 07:55:31.396 firefox-bin[442:903] invalid context
TEST-UNEXPECTED-FAIL |
/tests/content/canvas/test/webgl/test_webgl_conformance_test_suite.html |
Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:04:14.276568
INFO | automation.py | Reading PID log:
/var/folders/H5/H5TD8hgwEqKq9hgKlayjWU+++TM/-Tmp-/tmpguBCIwpidlog
PROCESS-CRASH |
/tests/content/canvas/test/webgl/test_webgl_conformance_test_suite.html |
application crashed (minidump found)


Here's the relevant crash info:

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x1f

Thread 0 (crashed)
 0  XUL!mozilla::gl::GLContextProviderCGL::GetGlobalContext
[GLContext.h:c7ab78580846 : 407 + 0x0]
    rbx = 0x00000000   r12 = 0x00000000   r13 = 0x5fbfa460   r14 = 0x1ecba670
    r15 = 0x5fbfa530   rip = 0x00db165e   rsp = 0x5fbfa3a0   rbp = 0x00000000
 1  XUL!mozilla::gl::CreateOffscreenFBOContext
[GLContextProviderCGL.mm:c7ab78580846 : 326 + 0x4]
    rbx = 0x00000001   r12 = 0x00000000   r13 = 0x5fbfa460   r14 = 0x1ecba670
    r15 = 0x5fbfa530   rip = 0x00db1449   rsp = 0x5fbfa400   rbp = 0x5fbfa4e0
 2  XUL!mozilla::gl::GLContextProviderCGL::CreateOffscreen
[GLContextProviderCGL.mm:c7ab78580846 : 483 + 0x11]
    rbx = 0x00000000   r12 = 0x00000000   r13 = 0x5fbfa460   r14 = 0x1ecba670
    r15 = 0x5fbfa530   rip = 0x00db2149   rsp = 0x5fbfa440   rbp = 0x5fbfa4e0
 3  XUL!mozilla::WebGLContext::SetDimensions [WebGLContext.cpp:c7ab78580846 :
342 + 0xc]
    rbx = 0x1ece6570   r12 = 0x0000012c   r13 = 0x00000096   r14 = 0x1ecba670
    r15 = 0x5fbfa530   rip = 0x00443d87   rsp = 0x5fbfa4e0   rbp = 0x80004005
 4  XUL!nsHTMLCanvasElement::GetContext [nsHTMLCanvasElement.cpp:c7ab78580846 :
449 + 0xc]
    rbx = 0x1ece6578   r12 = 0x004456c0   r13 = 0x5fbfa640   r14 = 0x1ecba670
    r15 = 0x5fbfa670   rip = 0x004a2c72   rsp = 0x5fbfa590   rbp = 0x1ecba5f0


So there are a few questions:
 - where do these messages, "invalid pixel format" and "invalid context" come
from?
 - why are we still continuing doing GL stuff after such messages have been
printed?
 - why are we jumping to bogus address 0x1F ?
Blocks: 582053
Severity: normal → critical
Ah, "good news", it also crashes on the Mac debug build:
http://tinderbox.mozilla.org/showlog.cgi?log=MozillaTry/1284131034.1284131928.22378.gz&fulltext=1#err1

Interesting part:

34287 INFO TEST-START | /tests/content/canvas/test/webgl/test_webgl_conformance_test_suite.html
--DOMWINDOW == 20 (0x11f6060c8) [serial = 737] [outer = 0x1159f1c60] [url = http://mochi.test:8888/tests/content/canvas/test/test_canvas_font_setter.html]
--DOMWINDOW == 19 (0x126faf468) [serial = 732] [outer = 0x1159f1c60] [url = http://mochi.test:8888/tests/content/canvas/test/test_2d.gradient.radial.outside2.html]
--DOMWINDOW == 18 (0x11c3f2628) [serial = 735] [outer = 0x1159f1c60] [url = http://mochi.test:8888/tests/content/canvas/test/test_2d.path.rect.selfintersect.html]
--DOMWINDOW == 17 (0x11b355a98) [serial = 734] [outer = 0x1159f1c60] [url = http://mochi.test:8888/tests/content/canvas/test/test_2d.path.arc.shape.3.html]
--DOMWINDOW == 16 (0x11c5cc7c8) [serial = 733] [outer = 0x1159f1c60] [url = http://mochi.test:8888/tests/content/canvas/test/test_2d.gradient.radial.outside3.html]
++DOMWINDOW == 17 (0x121239bb8) [serial = 739] [outer = 0x1159f1c60]
++DOCSHELL 0x11b1c53c0 == 9
++DOMWINDOW == 18 (0x11ef65c58) [serial = 740] [outer = 0x0]
WARNING: NS_ENSURE_TRUE(shell) failed: file /builds/slave/tryserver-macosx64-debug/build/docshell/base/nsDocShell.cpp, line 10596
WARNING: NS_ENSURE_TRUE(sf) failed: file /builds/slave/tryserver-macosx64-debug/build/docshell/base/nsDocShell.cpp, line 4913
WARNING: NS_ENSURE_TRUE(shell) failed: file /builds/slave/tryserver-macosx64-debug/build/docshell/base/nsDocShell.cpp, line 10596
WARNING: NS_ENSURE_TRUE(sf) failed: file /builds/slave/tryserver-macosx64-debug/build/docshell/base/nsDocShell.cpp, line 4913
WARNING: Context has no global.: file /builds/slave/tryserver-macosx64-debug/build/dom/base/nsJSEnvironment.cpp, line 2444
WARNING: Context has no global.: file /builds/slave/tryserver-macosx64-debug/build/dom/base/nsJSEnvironment.cpp, line 2444
++DOMWINDOW == 19 (0x11c689fc8) [serial = 741] [outer = 0x11ef65bf0]
colorbits: 24 alpha: 8 depth: 16 stencil: 0
2010-09-10 08:18:12.961 firefox-bin[340:903] invalid pixel format
2010-09-10 08:18:12.962 firefox-bin[340:903] invalid context
###!!! ASSERTION: You can't dereference a NULL nsRefPtr with operator->().: 'mRawPtr != 0', file ../../../dist/include/nsAutoPtr.h, line 1117
nsRefPtr<mozilla::gl::GLContext>::operator-> [nsAutoPtr.h:1118]
mozilla::gl::GLContextProviderCGL::GetGlobalContext [gfx/thebes/GLContextProviderCGL.mm:524]
mozilla::gl::GetGlobalContextCGL [gfx/thebes/GLContextProviderCGL.mm:327]
mozilla::gl::CreateOffscreenFBOContext [gfx/thebes/GLContextProviderCGL.mm:449]
mozilla::gl::GLContextProviderCGL::CreateOffscreen [gfx/thebes/GLContextProviderCGL.mm:483]
mozilla::WebGLContext::SetDimensions [content/canvas/src/WebGLContext.cpp:342]
nsHTMLCanvasElement::UpdateContext [content/html/content/src/nsHTMLCanvasElement.cpp:449]
nsHTMLCanvasElement::GetContext [content/html/content/src/nsHTMLCanvasElement.cpp:382]
nsIDOMHTMLCanvasElement_GetContext [dom_quickstubs.cpp:21000]
js::Interpret [js/src/jsinterp.cpp:4696]
js::InvokeCommon<JSBool (*)(JSContext*, JSObject*, uintN, js::Value*, js::Value*)> [js/src/jsinterp.cpp:577]
js::Invoke [js/src/jsinterp.cpp:696]
js::InternalInvoke [js/src/jsinterp.cpp:736]
js::InternalCall [js/src/jsinterp.h:651]
JS_CallFunctionValue [js/src/jsapi.cpp:4874]
nsJSContext::CallEventHandler [dom/base/nsJSEnvironment.cpp:2174]
nsJSEventListener::HandleEvent [dom/src/events/nsJSEventListener.cpp:228]
nsEventListenerManager::HandleEventSubType [content/events/src/nsEventListenerManager.cpp:1112]
nsEventListenerManager::HandleEventInternal [content/events/src/nsEventListenerManager.cpp:1209]
nsEventListenerManager::HandleEvent [content/events/src/nsEventListenerManager.h:146]
nsEventTargetChainItem::HandleEvent [content/events/src/nsEventDispatcher.cpp:213]
nsEventTargetChainItem::HandleEventTargetChain [content/events/src/nsEventDispatcher.cpp:343]
nsEventDispatcher::Dispatch [content/events/src/nsEventDispatcher.cpp:628]
DocumentViewerImpl::LoadComplete [layout/base/nsDocumentViewer.cpp:1033]
nsDocShell::EndPageLoad [docshell/base/nsDocShell.cpp:5996]
nsDocShell::OnStateChange [docshell/base/nsDocShell.cpp:5855]
nsDocLoader::FireOnStateChange [uriloader/base/nsDocLoader.cpp:1318]
nsDocLoader::doStopDocumentLoad [uriloader/base/nsDocLoader.cpp:953]
nsDocLoader::DocLoaderIsEmpty [uriloader/base/nsDocLoader.cpp:820]
nsDocLoader::ChildDoneWithOnload [uriloader/base/nsDocLoader.h:206]
nsDocLoader::DocLoaderIsEmpty [uriloader/base/nsDocLoader.cpp:823]
nsDocLoader::OnStopRequest [uriloader/base/nsDocLoader.cpp:705]
nsLoadGroup::RemoveRequest [netwerk/base/src/nsLoadGroup.cpp:680]
nsDocument::DoUnblockOnload [content/base/src/nsDocument.cpp:7273]
nsDocument::UnblockOnload [content/base/src/nsDocument.cpp:7211]
nsDocument::DispatchContentLoadedEvents [content/base/src/nsDocument.cpp:4190]
nsRunnableMethodImpl<void (nsDocument::*)(),true>::Run [nsThreadUtils.h:348]
nsThread::ProcessNextEvent [xpcom/threads/nsThread.cpp:547]
NS_ProcessPendingEvents_P [nsThreadUtils.cpp:200]
nsBaseAppShell::NativeEventCallback [widget/src/xpwidgets/nsBaseAppShell.cpp:132]
nsAppShell::ProcessGeckoEvents [widget/src/cocoa/nsAppShell.mm:395]
CoreFoundation + 0x4d271
CoreFoundation + 0x4b469
CoreFoundation + 0x4ac2f
HIToolbox + 0x2ea4e
HIToolbox + 0x2e7b1
HIToolbox + 0x2e70c
AppKit + 0x441f2
-AppKit + 0x43b41
-AppKit + 0x9747
nsAppShell::Run [widget/src/cocoa/nsAppShell.mm:747]
nsAppStartup::Run [toolkit/components/startup/src/nsAppStartup.cpp:191]
XRE_main [toolkit/xre/nsAppRunner.cpp:3665]
main [browser/app/nsBrowserApp.cpp:158]
NEXT ERROR TEST-UNEXPECTED-FAIL | /tests/content/canvas/test/webgl/test_webgl_conformance_test_suite.html | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:11:56.122560
INFO | automation.py | Reading PID log: /var/folders/H5/H5TD8hgwEqKq9hgKlayjWU+++TM/-Tmp-/tmp6gxH2cpidlog
PROCESS-CRASH | /tests/content/canvas/test/webgl/test_webgl_conformance_test_suite.html | application crashed (minidump found)
Operating system: Mac OS X
                  10.6.2 10C540
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x1f

Thread 0 (crashed)
 0  XUL!mozilla::gl::GLContext::SetIsGlobalSharedContext [GLContext.h:c7ab78580846 : 407 + 0x9]
    rbx = 0x26f83488   r12 = 0x006f3577   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x016f2898   rsp = 0x5fbf9e80   rbp = 0x5fbf9e80
 1  XUL!mozilla::gl::GLContextProviderCGL::GetGlobalContext [GLContextProviderCGL.mm:c7ab78580846 : 524 + 0x18]
    rbx = 0x26f83488   r12 = 0x006f3577   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x016f19b7   rsp = 0x5fbf9e90   rbp = 0x5fbf9ef0
 2  XUL!mozilla::gl::GetGlobalContextCGL [GLContextProviderCGL.mm:c7ab78580846 : 326 + 0x4]
    rbx = 0x26f83488   r12 = 0x006f3577   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x016f19d6   rsp = 0x5fbf9f00   rbp = 0x5fbf9f00
 3  XUL!mozilla::gl::CreateOffscreenFBOContext [GLContextProviderCGL.mm:c7ab78580846 : 449 + 0xa]
    rbx = 0x26f83488   r12 = 0x006f3577   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x016f169d   rsp = 0x5fbf9f10   rbp = 0x5fbf9fc0
 4  XUL!mozilla::gl::GLContextProviderCGL::CreateOffscreen [GLContextProviderCGL.mm:c7ab78580846 : 483 + 0x11]
    rbx = 0x26f83488   r12 = 0x006f3577   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x016f274a   rsp = 0x5fbf9fd0   rbp = 0x5fbfa070
 5  XUL!mozilla::WebGLContext::SetDimensions [WebGLContext.cpp:c7ab78580846 : 342 + 0x24]
    rbx = 0x26f83488   r12 = 0x006f3577   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x006f16b0   rsp = 0x5fbfa080   rbp = 0x5fbfa150
 6  XUL!nsHTMLCanvasElement::UpdateContext [nsHTMLCanvasElement.cpp:c7ab78580846 : 449 + 0x24]
    rbx = 0x26f83488   r12 = 0x006f3577   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x0077e29b   rsp = 0x5fbfa160   rbp = 0x5fbfa190
 7  XUL!nsHTMLCanvasElement::GetContext [nsHTMLCanvasElement.cpp:c7ab78580846 : 382 + 0x8]
    rbx = 0x5fbfa2b0   r12 = 0x0077e4dc   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x0077e684   rsp = 0x5fbfa1a0   rbp = 0x5fbfa1e0
 8  XUL!nsIDOMHTMLCanvasElement_GetContext [dom_quickstubs.cpp : 21000 + 0x50]
    rbx = 0x5fbfa2b0   r12 = 0x0077e4dc   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x00f109c8   rsp = 0x5fbfa1f0   rbp = 0x5fbfa440
 9  XUL!js::Interpret [jsinterp.cpp:c7ab78580846 : 4696 + 0x20]
    rbx = 0x0000000e   r12 = 0x0c1b52c8   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x0182c81c   rsp = 0x5fbfa450   rbp = 0x5fbfb780
So the interesting part was:

###!!! ASSERTION: You can't dereference a NULL nsRefPtr with operator->().:
'mRawPtr != 0', file ../../../dist/include/nsAutoPtr.h, line 1117
nsRefPtr<mozilla::gl::GLContext>::operator-> [nsAutoPtr.h:1118]
mozilla::gl::GLContextProviderCGL::GetGlobalContext
[gfx/thebes/GLContextProviderCGL.mm:524]

The code at GLContextProviderCGL.mm:524 is:

        gGlobalContext->SetIsGlobalSharedContext(PR_TRUE);

So the problem is that gGlobalContext is unexpectedly null.
Yeah, you're derefing a NULL pointer here:
http://mxr.mozilla.org/mozilla-central/source/gfx/thebes/GLContext.h#407
(0x1F is just the offset to that member variable)

Probably because you don't NULL check here:
http://mxr.mozilla.org/mozilla-central/source/gfx/thebes/GLContextProviderCGL.mm#515
Yes, indeed, here's a 1-liner.
Assignee: nobody → bjacob
Status: NEW → ASSIGNED
Attachment #474065 - Flags: review+
blocking2.0: --- → ?
blocking2.0: ? → beta6+
That's ready to be committed...
http://hg.mozilla.org/mozilla-central/rev/0dec15896c45
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla2.0b6
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: