1012740 - crash in mozalloc_abort(char const*) | NS_DebugBreak | mozilla::layers::GrallocTextureHostOGL::GrallocTextureHostOGL

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-91ae952a-2c45-4291-bdf0-4f76b2140519.
=============================================================
Crashing Thread
Frame 	Module 	Signature 	Source
0 	libxul.so 	mozalloc_abort(char const*) 	/home/geeksphone/FOS/peak/gecko/memory/mozalloc/mozalloc_abort.cpp:30
1 	libxul.so 	NS_DebugBreak 	/home/geeksphone/FOS/peak/gecko/xpcom/base/nsDebugImpl.cpp:422
2 	libxul.so 	mozilla::layers::GrallocTextureHostOGL::GrallocTextureHostOGL 	/home/geeksphone/FOS/peak/gecko/gfx/layers/opengl/GrallocTextureHost.cpp:285
3 	libxul.so 	mozilla::layers::CreateTextureHostOGL(mozilla::layers::SurfaceDescriptor const&, mozilla::layers::ISurfaceAllocator*, mozilla::layers::TextureFlags) 	/home/geeksphone/FOS/peak/gecko/gfx/layers/opengl/TextureHostOGL.cpp:95
4 	libxul.so 	mozilla::layers::TextureHost::Create(mozilla::layers::SurfaceDescriptor const&, mozilla::layers::ISurfaceAllocator*, mozilla::layers::TextureFlags) 	/home/geeksphone/FOS/peak/gecko/gfx/layers/composite/TextureHost.cpp:185
5 	libxul.so 	mozilla::layers::TextureParent::Init(mozilla::layers::SurfaceDescriptor const&, mozilla::layers::TextureFlags const&) 	/home/geeksphone/FOS/peak/gecko/gfx/layers/composite/TextureHost.cpp:705
6 	libxul.so 	mozilla::layers::TextureHost::CreateIPDLActor(mozilla::layers::CompositableParentManager*, mozilla::layers::SurfaceDescriptor const&, mozilla::layers::TextureFlags) 	/home/geeksphone/FOS/peak/gecko/gfx/layers/composite/TextureHost.cpp:114
7 	libxul.so 	mozilla::layers::LayerTransactionParent::AllocPTextureParent(mozilla::layers::SurfaceDescriptor const&, mozilla::layers::TextureFlags const&) 	/home/geeksphone/FOS/peak/gecko/gfx/layers/ipc/LayerTransactionParent.cpp:774
8 	libxul.so 	mozilla::layers::PLayerTransactionParent::OnMessageReceived(IPC::Message const&) 	/home/geeksphone/FOS/peak/objdir-gecko/ipc/ipdl/PLayerTransactionParent.cpp:409
9 	libxul.so 	mozilla::layers::PCompositorParent::OnMessageReceived(IPC::Message const&) 	/home/geeksphone/FOS/peak/objdir-gecko/ipc/ipdl/PCompositorParent.cpp:416
10 	libxul.so 	mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) 	/home/geeksphone/FOS/peak/gecko/ipc/glue/MessageChannel.cpp:1151
11 	libxul.so 	mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message const&) 	/home/geeksphone/FOS/peak/gecko/ipc/glue/MessageChannel.cpp:1065
12 	libxul.so 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	/home/geeksphone/FOS/peak/gecko/ipc/glue/MessageChannel.cpp:1048
13 	libxul.so 	RunnableMethod<FdWatcher, void (FdWatcher::*)(), Tuple0>::Run() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/tuple.h:383
14 	libxul.so 	mozilla::ipc::MessageChannel::DequeueTask::Run() 	/home/geeksphone/FOS/peak/objdir-gecko/ipc/glue/../../dist/include/mozilla/ipc/MessageChannel.h:383
15 	libxul.so 	MessageLoop::RunTask(Task*) 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc:357
16 	libxul.so 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc:365
17 	libxul.so 	MessageLoop::DoWork() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc:443
18 	libxul.so 	base::MessagePumpDefault::Run(base::MessagePump::Delegate*) 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_pump_default.cc:34
19 	libxul.so 	MessageLoop::RunInternal() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc:229
20 	libxul.so 	MessageLoop::Run() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/message_loop.cc:222
21 	libxul.so 	base::Thread::ThreadMain() 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/thread.cc:168
22 	libxul.so 	ThreadFunc 	/home/geeksphone/FOS/peak/gecko/ipc/chromium/src/base/platform_thread_posix.cc:39
23 	libc.so 	__thread_entry 	/home/geeksphone/FOS/keon_nightly/bionic/libc/bionic/pthread.c:217
24 	libc.so 	pthread_create 	/home/geeksphone/FOS/keon_nightly/bionic/libc/bionic/pthread.c:357 

More Reports: 
https://crash-stats.mozilla.com/report/list?product=B2G&signature=mozalloc_abort%28char+const*%29+|+NS_DebugBreak+|+mozilla%3A%3Alayers%3A%3AGrallocTextureHostOGL%3A%3AGrallocTextureHostOGL#tab-reports

Device : GEEKSPHONE GP-Peak

Note:

Comment 1

[Sotaro Ikeda [:sotaro]]

The problem might be mitigated by Bug 1011327.

Comment 2

[Sotaro Ikeda [:sotaro]]

Since Bug 959089, if GrallocTextureHostOGL::GrallocTextureHostOGL() receives invalid NewSurfaceDescriptorGralloc, it causes b2g process crash. b2g process should not crash even when the surface descriptor is invalid in release build.

Comment 3

[Sotaro Ikeda [:sotaro]]

Attachment: patch - Change as not to abort in GrallocTextureHostOGL::GrallocTextureHostOGL()

Comment 4

[Sotaro Ikeda [:sotaro]]

https://hg.mozilla.org/integration/b2g-inbound/rev/47bda724f91c

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/47bda724f91c