1110528 - crash in mozilla::layers::TextureImageTextureSourceOGL::Update(mozilla::gfx::DataSourceSurface*, nsIntRegion*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits>*)

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Kevin Brosnan [Ex-Mozilla]]

This bug was filed from the Socorro interface and is 
report bp-435ec86b-bf27-48d8-88c2-971c42141204.
=============================================================

0 	libxul.so 	mozilla::layers::TextureImageTextureSourceOGL::Update(mozilla::gfx::DataSourceSurface*, nsIntRegion*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits>*) 	gfx/layers/opengl/TextureHostOGL.cpp
1 	libxul.so 	mozilla::layers::StreamTextureHost::Lock() 	gfx/layers/composite/TextureHost.cpp
2 	libxul.so 	mozilla::layers::ImageHost::Lock() 	gfx/layers/composite/ImageHost.cpp
3 	libxul.so 	mozilla::layers::ImageHost::Composite(mozilla::layers::EffectChain&, float, mozilla::gfx::Matrix4x4 const&, mozilla::gfx::Filter const&, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits> const&, nsIntRegion const*) 	gfx/layers/composite/CompositableHost.h
4 	libxul.so 	mozilla::layers::CanvasLayerComposite::RenderLayer(nsIntRect const&) 	gfx/layers/composite/CanvasLayerComposite.cpp
5 	libxul.so 	void mozilla::layers::RenderLayers<mozilla::layers::ContainerLayerComposite>(mozilla::layers::ContainerLayerComposite*, mozilla::layers::LayerManagerComposite*, mozilla::gfx::IntRectTyped<mozilla::RenderTargetPixel> const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
6 	libxul.so 	void mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerComposite>(mozilla::layers::ContainerLayerComposite*, mozilla::layers::LayerManagerComposite*, nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
7 	libxul.so 	void mozilla::layers::RenderLayers<mozilla::layers::ContainerLayerComposite>(mozilla::layers::ContainerLayerComposite*, mozilla::layers::LayerManagerComposite*, mozilla::gfx::IntRectTyped<mozilla::RenderTargetPixel> const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
8 	libxul.so 	void mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerComposite>(mozilla::layers::ContainerLayerComposite*, mozilla::layers::LayerManagerComposite*, nsIntRect const&) 	gfx/layers/composite/ContainerLayerComposite.cpp
9 	libxul.so 	mozilla::layers::LayerManagerComposite::Render() 	gfx/layers/composite/LayerManagerComposite.cpp
10 	libxul.so 	mozilla::layers::LayerManagerComposite::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/composite/LayerManagerComposite.cpp
11 	libxul.so 	mozilla::layers::LayerManagerComposite::EndEmptyTransaction(mozilla::layers::LayerManager::EndTransactionFlags) 	gfx/layers/composite/LayerManagerComposite.cpp
12 	libxul.so 	mozilla::layers::CompositorParent::CompositeToTarget(mozilla::gfx::DrawTarget*, nsIntRect const*) 	gfx/layers/ipc/CompositorParent.cpp
13 	libxul.so 	RunnableMethod<FdWatcher, void (FdWatcher::*)(), Tuple0>::Run() 	ipc/chromium/src/base/tuple.h
14 	libxul.so 	MessageLoop::RunTask(Task*) 	ipc/chromium/src/base/message_loop.cc
15 	libxul.so 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) 	ipc/chromium/src/base/message_loop.cc
16 	libxul.so 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
17 	libxul.so 	base::MessagePumpDefault::Run(base::MessagePump::Delegate*) 	ipc/chromium/src/base/message_pump_default.cc
18 	libxul.so 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc
19 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
20 	libxul.so 	base::Thread::ThreadMain() 	ipc/chromium/src/base/thread.cc
21 	libxul.so 	ThreadFunc 	ipc/chromium/src/base/platform_thread_posix.cc
Ø 22 	libc.so 	libc.so@0xd2a2 	
Ø 23 	libc.so 	libc.so@0xd43a


Over half the crashes are on the Galaxy S4
samsung 	GT-I9500	19 (REL) 	armeabi-v7a 	2058 	51.271 %

Comment 1

[Milan Sreckovic [:milan] (needinfo for best results)]

Attachment: Don't call Update on invalid surfaces. r=nical

Comment 2

[Milan Sreckovic [:milan] (needinfo for best results)]

https://treeherder.mozilla.org/ui/#/jobs?repo=try&revision=5bbe70ea4641

Comment 3

[Milan Sreckovic [:milan] (needinfo for best results)]

https://treeherder.mozilla.org/ui/#/jobs?repo=try&revision=5bbe70ea4641

Comment 4

[Milan Sreckovic [:milan] (needinfo for best results)]

Attachment: Aurora/beta patch if we decide to uplift. Carry r=nical

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4413200ce54d

Comment 6

[Nigel Babu [:nigelb]]

https://hg.mozilla.org/mozilla-central/rev/4413200ce54d

Comment 7

[Milan Sreckovic [:milan] (needinfo for best results)]

:snorp, would you uplift this?

Comment 8

[James Willcox (:snorp) ([e-mail]) (he/him)]

Comment on attachment 8536639 [details] [diff] [review]
Aurora/beta patch if we decide to uplift. Carry r=nical

Approval Request Comment
[Feature/regressing bug #]: N/A
[User impact if declined]: crashes
[Describe test coverage new/current, TBPL]: nightly, CI
[Risks and why]: low, very small patch
[String/UUID change made/needed]: none

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/cf8372bebf38
https://hg.mozilla.org/releases/mozilla-beta/rev/8b33f8a547ed