864427 - crash in [@ mozalloc_abort(char const*) | abort | mozilla::layers::TextureHost::SwapTextures(mozilla::layers::SurfaceDescriptor const&, mozilla::layers::SurfaceDescriptor*, nsIntRegion*) ]

Status: RESOLVED WORKSFORME

(Core :: Graphics: Layers, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Attachment: screenshot

This bug was filed from the Socorro interface and is 
report bp-3ecfe351-086e-450e-9b2f-ce2c92130422 .
============================================================= 
Frame 	Module 	Signature 	Source
0 	libxul.so 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:30
1 	libxul.so 	abort 	memory/mozalloc/mozalloc_abort.cpp:39
2 	libxul.so 	mozilla::layers::TextureHost::SwapTextures 	gfx/layers/composite/TextureHost.cpp:78
3 	libxul.so 	mozilla::layers::ImageHostBuffered::Update 	gfx/layers/composite/ImageHost.cpp:148
4 	libxul.so 	mozilla::layers::CompositableParentManager::ReceiveCompositableUpdate 	gfx/layers/ipc/CompositableTransactionParent.cpp:83
5 	libxul.so 	Pickle::ReadBool const 	ipc/chromium/src/base/pickle.cc:86
6 	libxul.so 	mozilla::layers::PImageBridgeParent::Read 	ipc/chromium/src/chrome/common/ipc_message_utils.h:141
7 	libxul.so 	mozilla::layers::PImageBridgeParent::Read 	PImageBridgeParent.cpp:1051
8 	libxul.so 	mozilla::dom::PContentChild::Lookup 	_hashtable.h:513
9 	libxul.so 	Pickle::AlignInt 	ipc/chromium/src/base/pickle.h:252
10 	libxul.so 	mozilla::layers::PImageBridgeParent::Read 	PImageBridgeParent.cpp:1766
11 	libxul.so 	mozilla::layers::SurfaceDescriptor::~SurfaceDescriptor 	LayersSurfaces.cpp:668
12 	libxul.so 	mozilla::layers::OpCreatedTexture::~OpCreatedTexture 	LayerTransaction.cpp:3623
13 	libxul.so 	mozilla::layers::PImageBridgeParent::Read 	PImageBridgeParent.cpp:1718
14 	libxul.so 	IPC::Message::WriteFileDescriptor 	ipc/chromium/src/chrome/common/ipc_message.cc:105
15 	libxul.so 	IPC::ParamTraits<mozilla::layers::MagicGrallocBufferHandle>::Write 	gfx/layers/ipc/ShadowLayerUtilsGralloc.cpp:53
16 	libmozglue.so 	arena_malloc 	memory/mozjemalloc/jemalloc.c:4167
17 	libmozglue.so 	arena_malloc 	memory/mozjemalloc/jemalloc.c:4167
18 	libmozglue.so 	imalloc 	memory/mozjemalloc/jemalloc.c:4247
19 	libxul.so 	mozilla::layers::ImageBridgeParent::RecvUpdate 	gfx/layers/ipc/ImageBridgeParent.cpp:51
20 	libxul.so 	mozilla::layers::PImageBridgeParent::OnMessageReceived 	PImageBridgeParent.cpp:505
21 	libmozglue.so 	realloc 	memory/mozjemalloc/jemalloc.c:4692
22 	libmozglue.so 	imalloc 	memory/mozjemalloc/jemalloc.c:4247
23 	libmozglue.so 	realloc 	memory/mozjemalloc/jemalloc.c:6559
24 	libmozglue.so 	malloc_mutex_unlock 	memory/mozjemalloc/jemalloc.c:1665
25 	libxul.so 	mozilla::ipc::SyncChannel::OnDispatchMessage 	ipc/glue/SyncChannel.cpp:145
26 	libxul.so 	mozilla::ipc::RPCChannel::OnMaybeDequeueOne 	ipc/glue/RPCChannel.cpp:400
27 	libxul.so 	RunnableMethod<IPC::ChannelProxy::Context, void 	ipc/chromium/src/base/tuple.h:383
28 	libxul.so 	mozilla::ipc::RPCChannel::DequeueTask::Run 	RPCChannel.h:425
29 	libxul.so 	MessageLoop::RunTask 	ipc/chromium/src/base/message_loop.cc:337
30 	libxul.so 	MessageLoop::DeferOrRunPendingTask 	ipc/chromium/src/base/message_loop.cc:345
31 	libxul.so 	MessageLoop::DoWork 	ipc/chromium/src/base/message_loop.cc:445
32 	libxul.so 	base::MessagePumpDefault::Run 	ipc/chromium/src/base/message_pump_default.cc:23
33 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:219
34 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:212
35 	libxul.so 	base::Thread::ThreadMain 	ipc/chromium/src/base/thread.cc:159

Crash on Master: 
## Environment :
Master build :2013-04-17-03-06-35
"mozilla-central" revision="50d25e083421"
"integration/gaia-central" revision="6693344385fc"
"gecko.git" revision="12a533fa7b8fa09df333a0ca7041e9f467cb3f4a"
"gaia.git" revision="0874b5e84129391de9edb23560be8ad52b3d2bed"
Unagi
  
Still trying to narrow down the STRs.
Basically I was playing with the hardware volume rocker and the lock screen.  There's an image that appears when the device is completely muted

Comment 1

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

wrong build id posted.  correct build id : Master build :2013-04-22-03-05-57

Comment 2

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Weird.  I'm showing this issue when I try to load up the video app after having some videos on the SDcard.

STR:
1. place some videos on the SDcard
2. launch video

Comment 4

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Deigo has narrowed it down to MPEG4 videos from bug 864800:

"Load any MPEG4 clip on the SD card and open the video app. The system will crash. It does not happen with .ogv or .webm videos.

Sample video: http://download.blender.org/peach/bigbuckbunny_movies/BigBuckBunny_320x180.mp4

Likely due to recent layers refactoring."

Comment 5

[Sotaro Ikeda [:sotaro]]

Is it still reproducible? Since the bug is filed, a lot of bugs around TextureHost and ImageBridge were fixed.

Comment 6

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Gaia      9a222ac02db176e47299bb37112ae40aeadbeca7
Gecko     http://hg.mozilla.org/mozilla-central/rev/14ac61461f2a
BuildID   20140106040201
Version   29.0a1
ro.build.version.incremental=eng.archermind.20131114.105818
ro.build.date=Thu Nov 14 10:58:33 CST 2013