1012737 - crash in mozilla::layers::GrallocTextureClientOGL::GetAsDrawTarget()

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-8a20ba38-5f4a-41e1-afd2-2e41e2140512.
=============================================================

Crashing Thread
Frame 	Module 	Signature 	Source
0 	libxul.so 	mozilla::layers::GrallocTextureClientOGL::GetAsDrawTarget() 	/home/geeksphone/FOS/keon/gecko/gfx/layers/opengl/GrallocTextureClient.cpp:191
1 	libxul.so 	mozilla::layers::RotatedContentBuffer::EnsureBuffer() 	/home/geeksphone/FOS/keon/gecko/gfx/layers/RotatedBuffer.cpp:333
2 	libxul.so 	mozilla::layers::RotatedContentBuffer::BorrowDrawTargetForQuadrantUpdate(nsIntRect const&, mozilla::layers::RotatedBuffer::ContextSource, mozilla::layers::RotatedContentBuffer::DrawIterator*) 	/home/geeksphone/FOS/keon/gecko/gfx/layers/RotatedBuffer.cpp:256
3 	libxul.so 	mozilla::layers::ContentClientDoubleBuffered::UpdateDestinationFrom(mozilla::layers::RotatedBuffer const&, nsIntRegion const&) 	/home/geeksphone/FOS/keon/gecko/gfx/layers/client/ContentClient.cpp:503
4 	libxul.so 	mozilla::layers::ContentClientDoubleBuffered::FinalizeFrame(nsIntRegion const&) 	/home/geeksphone/FOS/keon/gecko/gfx/layers/client/ContentClient.cpp:488
5 	libxul.so 	mozilla::layers::RotatedContentBuffer::BeginPaint(mozilla::layers::ThebesLayer*, unsigned int) 	/home/geeksphone/FOS/keon/gecko/gfx/layers/RotatedBuffer.cpp:522
6 	libxul.so 	mozilla::layers::ContentClientBasic::BeginPaintBuffer(mozilla::layers::ThebesLayer*, unsigned int) 	/home/geeksphone/FOS/keon/objdir-gecko/gfx/layers/../../dist/include/mozilla/layers/ContentClient.h:213
7 	libxul.so 	mozilla::layers::ClientThebesLayer::PaintThebes() 	/home/geeksphone/FOS/keon/gecko/gfx/layers/client/ClientThebesLayer.cpp:52
8 	libxul.so 	mozilla::layers::ClientThebesLayer::RenderLayer() 	/home/geeksphone/FOS/keon/gecko/gfx/layers/client/ClientThebesLayer.cpp:122
9 	libxul.so 	mozilla::layers::ClientContainerLayer::RenderLayer() 	/home/geeksphone/FOS/keon/gecko/gfx/layers/client/ClientContainerLayer.h:61
10 	libxul.so 	mozilla::layers::ClientContainerLayer::RenderLayer() 	/home/geeksphone/FOS/keon/gecko/gfx/layers/client/ClientContainerLayer.h:61
11 	libxul.so 	mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	/home/geeksphone/FOS/keon/gecko/gfx/layers/client/ClientLayerManager.cpp:199
12 	libxul.so 	mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	/home/geeksphone/FOS/keon/gecko/gfx/layers/client/ClientLayerManager.cpp:225
13 	libxul.so 	nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) const 	/home/geeksphone/FOS/keon/gecko/layout/base/nsDisplayList.cpp:1368
14 	libxul.so 	nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) const 	/home/geeksphone/FOS/keon/gecko/layout/base/nsDisplayList.cpp:1209
15 	libxul.so 	nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, unsigned int) 	/home/geeksphone/FOS/keon/gecko/layout/base/nsLayoutUtils.cpp:2817
16 	libxul.so 	PresShell::Paint(nsView*, nsRegion const&, unsigned int) 	/home/geeksphone/FOS/keon/gecko/layout/base/nsPresShell.cpp:5917
17 	libxul.so 	nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) 	/home/geeksphone/FOS/keon/gecko/view/src/nsViewManager.cpp:443
18 	libxul.so 	nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) 	/home/geeksphone/FOS/keon/gecko/view/src/nsViewManager.cpp:384
19 	libxul.so 	nsViewManager::ProcessPendingUpdates() 	/home/geeksphone/FOS/keon/gecko/view/src/nsViewManager.cpp:1074
20 	libxul.so 	nsRefreshDriver::Tick(long long, mozilla::TimeStamp) 	/home/geeksphone/FOS/keon/gecko/layout/base/nsRefreshDriver.cpp:1214
21 	libxul.so 	mozilla::RefreshDriverTimer::TimerTick(nsITimer*, void*) 	/home/geeksphone/FOS/keon/gecko/layout/base/nsRefreshDriver.cpp:168
22 	libxul.so 	nsTimerImpl::Fire() 	/home/geeksphone/FOS/keon/gecko/xpcom/threads/nsTimerImpl.cpp:555
23 	libxul.so 	nsTimerEvent::Run() 	/home/geeksphone/FOS/keon/gecko/xpcom/threads/nsTimerImpl.cpp:639
24 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	/home/geeksphone/FOS/keon/gecko/xpcom/threads/nsThread.cpp:715
25 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	/home/geeksphone/FOS/keon/gecko/xpcom/glue/nsThreadUtils.cpp:263
26 	libxul.so 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	/home/geeksphone/FOS/keon/gecko/ipc/glue/MessagePump.cpp:95
27 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	/home/geeksphone/FOS/keon/gecko/ipc/glue/MessagePump.cpp:283
28 	libxul.so 	MessageLoop::RunInternal() 	/home/geeksphone/FOS/keon/gecko/ipc/chromium/src/base/message_loop.cc:229
29 	libxul.so 	MessageLoop::Run() 	/home/geeksphone/FOS/keon/gecko/ipc/chromium/src/base/message_loop.cc:222
30 	libxul.so 	nsBaseAppShell::Run() 	/home/geeksphone/FOS/keon/gecko/widget/xpwidgets/nsBaseAppShell.cpp:164
31 	libxul.so 	XRE_RunAppShell 	/home/geeksphone/FOS/keon/gecko/toolkit/xre/nsEmbedFunctions.cpp:679
32 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	/home/geeksphone/FOS/keon/gecko/ipc/glue/MessagePump.cpp:253
33 	libxul.so 	MessageLoop::RunInternal() 	/home/geeksphone/FOS/keon/gecko/ipc/chromium/src/base/message_loop.cc:229
34 	libxul.so 	MessageLoop::Run() 	/home/geeksphone/FOS/keon/gecko/ipc/chromium/src/base/message_loop.cc:222
35 	libxul.so 	XRE_InitChildProcess 	/home/geeksphone/FOS/keon/gecko/toolkit/xre/nsEmbedFunctions.cpp:516
36 	plugin-container 	main 	/home/geeksphone/FOS/keon/gecko/ipc/app/MozillaRuntimeMain.cpp:149
37 	libc.so 	__libc_init 	/home/geeksphone/FOS/keon_nightly/bionic/libc/bionic/libc_init_dynamic.c:114 

URL : marketplace app, homescreen, 
 	http://mx.m.yahoo.com/?.tsrc=yahoo&mobile_view_default=true

Devices : 
GEEKSPHONE, GP-KEON, ALCATEL ONE TOUCH FIRE

Note:
More crashes listed : 
https://crash-stats.mozilla.com/report/list?product=B2G&signature=mozilla%3A%3Alayers%3A%3AGrallocTextureClientOGL%3A%3AGetAsDrawTarget%28%29#tab-reports

Comment 1

[Milan Sreckovic [:milan] (needinfo for best results)]

This is always on Keon build?

Comment 2

[Sotaro Ikeda [:sotaro]]

This seems like regression from Bug 959089. The problem might be mitigated by Bug 1011327.

Comment 3

[Sotaro Ikeda [:sotaro]]

Attachment: patch - Add erro check to GrallocTextureClientOGL::GetAsDrawTarget()

Comment 4

[Sotaro Ikeda [:sotaro]]

The crash seems to happen because of lacking error check.

Comment 5

[Nicolas Silva [:nical]]

Comment on attachment 8425606 [details] [diff] [review]
patch - Add erro check to GrallocTextureClientOGL::GetAsDrawTarget()

Review of attachment 8425606 [details] [diff] [review]:
-----------------------------------------------------------------

r+, although this crash may show that there is an issue in the logic manipulating the TexureClient. The checks you added are already in GrallocTextureClient::Lock, so it looks like someone is trying to call GetAsDrawTarget on a TextureClient that wasn't successfully locked, which is bad. So while this patch will fix the crash (which is a good thing), I am not certain it will fix the root cause.

Comment 6

[Sotaro Ikeda [:sotaro]]

 https://hg.mozilla.org/integration/b2g-inbound/rev/273389d472de

Comment 7

[Milan Sreckovic [:milan] (needinfo for best results)]

(In reply to Nicolas Silva [:nical] from comment #5)
> ... this crash may show that there is an issue in the logic
> manipulating the TexureClient. The checks you added are already in
> GrallocTextureClient::Lock, so it looks like someone is trying to call
> GetAsDrawTarget on a TextureClient that wasn't successfully locked, which is
> bad...

Do we/should we have a bug opened for this?

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/273389d472de