1033293 - Segfault in mozilla::layers::CanvasClientSurfaceStream::Update

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Thomas Zimmermann [:tzimmermann] [:tdz]]

Since yesterday, on the Nexus 4, I constantly get the error below with trunk. I haven't updated for a few days, so the bug might be older.


(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0xb47c7f1e in mozilla::layers::CanvasClientSurfaceStream::Update (this=0xac077f20, aSize=..., aLayer=0xadfc1b20)
    at ../../../../mozilla-central/gfx/layers/client/CanvasClient.cpp:167
167	    MOZ_ASSERT(false);
(gdb) bt
#0  0xb47c7f1e in mozilla::layers::CanvasClientSurfaceStream::Update (this=0xac077f20, aSize=..., aLayer=0xadfc1b20)
    at ../../../../mozilla-central/gfx/layers/client/CanvasClient.cpp:167
#1  0xb47d2bd0 in mozilla::layers::ClientCanvasLayer::RenderLayer (this=0xadfc1b20) at ../../../../mozilla-central/gfx/layers/client/ClientCanvasLayer.cpp:192
#2  0xb47d4460 in mozilla::layers::ClientContainerLayer::RenderLayer (this=0xb0607000) at ../../../../mozilla-central/gfx/layers/client/ClientContainerLayer.h:61
#3  0xb47d4460 in mozilla::layers::ClientContainerLayer::RenderLayer (this=0xb0606800) at ../../../../mozilla-central/gfx/layers/client/ClientContainerLayer.h:61
#4  0xb47d4460 in mozilla::layers::ClientContainerLayer::RenderLayer (this=0xb0606400) at ../../../../mozilla-central/gfx/layers/client/ClientContainerLayer.h:61
#5  0xb47cc6b0 in mozilla::layers::ClientLayerManager::EndTransactionInternal (this=0xae0e2e00, aCallback=
    0xb5125f41 <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, aCallbackData=<optimized out>) at ../../../../mozilla-central/gfx/layers/client/ClientLayerManager.cpp:211
#6  0xb47d425c in mozilla::layers::ClientLayerManager::EndTransaction (this=0xae0e2e00, 
    aCallback=0xb5125f41 <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, aCallbackData=0xbec24120, aFlags=mozilla::layers::LayerManager::END_DEFAULT) at ../../../../mozilla-central/gfx/layers/client/ClientLayerManager.cpp:237
#7  0xb5164f64 in nsDisplayList::PaintForFrame (this=0xbec24048, aBuilder=0xbec24120, aCtx=<optimized out>, aForFrame=<optimized out>, aFlags=13)
    at ../../../../mozilla-central/layout/base/nsDisplayList.cpp:1393
#8  0xb5165174 in nsDisplayList::PaintRoot (this=0xbec24048, aBuilder=0xbec24120, aCtx=0x0, aFlags=13) at ../../../../mozilla-central/layout/base/nsDisplayList.cpp:1232
#9  0xb5166ac4 in nsLayoutUtils::PaintFrame (aRenderingContext=0x0, aFrame=0xb05da2b8, aDirtyRegion=<optimized out>, aBackstop=4294967295, aFlags=772)
    at ../../../../mozilla-central/layout/base/nsLayoutUtils.cpp:2959
#10 0xb51108aa in PresShell::Paint (this=0xb206c2c0, aViewToPaint=0xb05c3dd0, aDirtyRegion=..., aFlags=1) at ../../../../mozilla-central/layout/base/nsPresShell.cpp:6222
#11 0xb4de7c50 in nsViewManager::ProcessPendingUpdatesPaint (this=0xb05c8970, aWidget=0xb06d62e0) at ../../../../mozilla-central/view/src/nsViewManager.cpp:443
#12 0xb4de7fa8 in nsViewManager::ProcessPendingUpdatesForView (this=<optimized out>, aView=<optimized out>, aFlushDirtyRegion=<optimized out>)
    at ../../../../mozilla-central/view/src/nsViewManager.cpp:384
#13 0xb5118748 in nsRefreshDriver::Tick (this=0xb6ac2120, aNowEpoch=<optimized out>, aNowTime=...) at ../../../../mozilla-central/layout/base/nsRefreshDriver.cpp:1278
#14 0xb5118db8 in mozilla::RefreshDriverTimer::Tick (this=0xb190f100) at ../../../../mozilla-central/layout/base/nsRefreshDriver.cpp:162
#15 0xb43518ba in nsTimerImpl::Fire (this=0xb053d6a0) at ../../../../mozilla-central/xpcom/threads/nsTimerImpl.cpp:618
#16 0xb4351a3e in nsTimerEvent::Run (this=0xb0560150) at ../../../../mozilla-central/xpcom/threads/nsTimerImpl.cpp:711
#17 0xb434f426 in ProcessNextEvent (aResult=0xbec247f7, aMayWait=false, this=0xb6a4d700) at ../../../../mozilla-central/xpcom/threads/nsThread.cpp:766
#18 nsThread::ProcessNextEvent (this=0xb6a4d700, aMayWait=<optimized out>, aResult=0xbec247f7) at ../../../../mozilla-central/xpcom/threads/nsThread.cpp:685
#19 0xb4308de6 in NS_ProcessNextEvent (aThread=0xb6a4d700, aMayWait=<optimized out>) at /home/mozilla/Projects/mozilla/src/mozilla-central/xpcom/glue/nsThreadUtils.cpp:284
#20 0xb45040b4 in mozilla::ipc::MessagePump::Run (this=0xb6a01e20, aDelegate=0xb6a701a0) at ../../../../mozilla-central/ipc/glue/MessagePump.cpp:102
#21 0xb44f26ae in MessageLoop::RunInternal (this=0xb6a701a0) at ../../../../mozilla-central/ipc/chromium/src/base/message_loop.cc:229
#22 0xb44f26c6 in RunHandler (this=0xb6a701a0) at ../../../../mozilla-central/ipc/chromium/src/base/message_loop.cc:222
#23 MessageLoop::Run (this=0xb6a701a0) at ../../../../mozilla-central/ipc/chromium/src/base/message_loop.cc:196
#24 0xb4b3ae52 in nsBaseAppShell::Run (this=0xb204f100) at ../../../../mozilla-central/widget/xpwidgets/nsBaseAppShell.cpp:164
#25 0xb53f2a4e in nsAppStartup::Run (this=0xb2052dc0) at ../../../../../mozilla-central/toolkit/components/startup/nsAppStartup.cpp:278
#26 0xb53d947a in XREMain::XRE_mainRun (this=0xbec2498c) at ../../../../mozilla-central/toolkit/xre/nsAppRunner.cpp:4013
#27 0xb53d9666 in XREMain::XRE_main (this=0xbec2498c, argc=<optimized out>, argv=<optimized out>, aAppData=<optimized out>)
    at ../../../../mozilla-central/toolkit/xre/nsAppRunner.cpp:4084
#28 0xb53d97c0 in XRE_main (argc=1, argv=0xbec26b44, aAppData=0x24938, aFlags=<optimized out>) at ../../../../mozilla-central/toolkit/xre/nsAppRunner.cpp:4298
#29 0x0000ae9c in do_main (argv=0xbec26b44, argc=1) at ../../../../mozilla-central/b2g/app/nsBrowserApp.cpp:163
#30 main (argc=<optimized out>, argv=<optimized out>) at ../../../../mozilla-central/b2g/app/nsBrowserApp.cpp:256
(gdb)

Comment 1

[Kelsey Gilbert [:jgilbert]]

This should never happen. What's your about:support look like?

Comment 3

[Thomas Zimmermann [:tzimmermann] [:tdz]]

The returned surface is of type no 3, which seems to be 'EGLSurfaceANGLE'.

How do I open 'about:support' on b2g? Opening the Browser app and using in the URL bar doesn't work.

Comment 4

[Sotaro Ikeda [:sotaro]]

It seems like regression of Bug 1000640. The following code seems to have a problem. On gonk, SurfaceFactory_Gralloc is always expected for SurfaceStream, but SurfaceFactory_EGLImage::Create() is called on in inter thread-ipc case.

http://mxr.mozilla.org/mozilla-central/source/gfx/layers/client/ClientCanvasLayer.cpp#83

Comment 5

[Thomas Zimmermann [:tzimmermann] [:tdz]]

(In reply to Sotaro Ikeda [:sotaro] from comment #4)
> It seems like regression of Bug 1000640. 

Right. The problem is not present if I revert to an earlier revision. Currently, b2g doesn't even boot.

Comment 6

[Gregor Wagner [:gwagner]]

(In reply to Thomas Zimmermann [:tzimmermann] [:tdz] from comment #5)
> (In reply to Sotaro Ikeda [:sotaro] from comment #4)
> > It seems like regression of Bug 1000640. 
> 
> Right. The problem is not present if I revert to an earlier revision.
> Currently, b2g doesn't even boot.

Yeah debug mode is completely broken. We need a fix here rather sooner than later or back out the patch that cause this.

Comment 7

[Milan Sreckovic [:milan] (needinfo for best results)]

It is going to be difficult to get QA for regression range because this is unsupported phone.  Jeff, if you have a candidate for what broke this, and send me a patch, I can build and test on Nexus 4.

Comment 8

[Sotaro Ikeda [:sotaro]]

Attachment: patch - Always use SurfaceFactory_Gralloc for SurfaceStream on gonk

The patch fixed the problem on master flame.

Comment 9

[Sotaro Ikeda [:sotaro]]

Comment on attachment 8450297 [details] [diff] [review]
patch - Always use SurfaceFactory_Gralloc for SurfaceStream on gonk

jgilbert, can you review the patch soon? Thanks.

Comment 10

[Milan Sreckovic [:milan] (needinfo for best results)]

Thomas, you can use the patch to unblock your work while it's getting reviewed?

Comment 11

[Gregor Wagner [:gwagner]]

It boots again with this patch \o/

Comment 12

[Thomas Zimmermann [:tzimmermann] [:tdz]]

(In reply to Milan Sreckovic [:milan] from comment #10)
> Thomas, you can use the patch to unblock your work while it's getting
> reviewed?

It works again. Thanks a lot!

Comment 13

[Sotaro Ikeda [:sotaro]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c47271b6d9c5

Comment 14

[Tim Taubert [:ttaubert] (inactive)]

https://hg.mozilla.org/mozilla-central/rev/c47271b6d9c5