1130420 - crash in mozilla::gl::GLScreenBuffer::Readback(mozilla::gl::SharedSurface*, mozilla::gfx::DataSourceSurface*)

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[James Willcox (:snorp) ([e-mail]) (he/him)]

This bug was filed from the Socorro interface and is 
report bp-faef4c77-803f-4bdc-9603-cfbe52150206.
=============================================================

I get this canvas crash when loading http://crash-stats.mozilla.org on Nightly with e10s enabled.

Comment 1

[James Willcox (:snorp) ([e-mail]) (he/him)]

Oh, I'm using SkiaGL. Turning that off makes the crash go away.

CopyableCanvasLayer::UpdateTarget() assumes the mGLContext has a Screen(), but the SkiaGL ones does not. I don't see any handling of the mFrontbufferGLTex either, so not sure how this is supposed to work.

Comment 2

[James Willcox (:snorp) ([e-mail]) (he/him)]

As expected, this also crashes on Android in today's Nightly, since we have SkiaGL on there.

Comment 3

[James Willcox (:snorp) ([e-mail]) (he/him)]

The crash report I get on Android is garbage for some reason:

https://crash-stats.mozilla.com/report/index/d880b8d9-2f93-4648-b408-a0bc52150206

Comment 4

[James Willcox (:snorp) ([e-mail]) (he/him)]

I do see the crash-stats main page (with the canvas chart), but it crashes shortly after. Presumably while trying to create a snapshot via basic layers. So that cause might be different from the Mac one.

Comment 5

[James Willcox (:snorp) ([e-mail]) (he/him)]

Alright, my personal device just has some issue reporting crashes. Weird. It's the same stack as the Mac.

Comment 6

[James Willcox (:snorp) ([e-mail]) (he/him)]

Oh, except it is in fact via BasicLayers because it's creating a snapshot.

(gdb) bt
#0  mozilla::gl::GLScreenBuffer::Readback (this=0x0, src=0x86ce3700, dest=0x86ce3910) at /Volumes/GeckoDev/gecko/gfx/gl/GLScreenBuffer.cpp:528
#1  0x7cb06634 in mozilla::layers::CopyableCanvasLayer::UpdateTarget (this=0x8a206f60, aDestTarget=0x0) at /Volumes/GeckoDev/gecko/gfx/layers/CopyableCanvasLayer.cpp:157
#2  0x7cb0aa8c in mozilla::layers::BasicCanvasLayer::Paint (this=0x8a206f60, aDT=0x86cde820, aDeviceOffset=..., aMaskLayer=0x0) at /Volumes/GeckoDev/gecko/gfx/layers/basic/BasicCanvasLayer.cpp:35
#3  0x7cb1d48e in mozilla::layers::BasicLayerManager::PaintSelfOrChildren (this=<optimized out>, aPaintContext=..., aGroupTarget=0x86cf14c0) at /Volumes/GeckoDev/gecko/gfx/layers/basic/BasicLayerManager.cpp:729
#4  0x7cb1cc5e in mozilla::layers::BasicLayerManager::PaintLayer (this=this@entry=0x8441d280, aTarget=aTarget@entry=0x86cf14c0, aLayer=0x8a206f60, aCallback=<optimized out>, aCallbackData=0x75afd1b0) at /Volumes/GeckoDev/gecko/gfx/layers/basic/BasicLayerManager.cpp:850
#5  0x7cb1d4d2 in mozilla::layers::BasicLayerManager::PaintSelfOrChildren (this=0x8441d280, aPaintContext=..., aGroupTarget=0x86cf14c0) at /Volumes/GeckoDev/gecko/gfx/layers/basic/BasicLayerManager.cpp:738
#6  0x7cb1cc5e in mozilla::layers::BasicLayerManager::PaintLayer (this=this@entry=0x8441d280, aTarget=0x86cf14c0, aLayer=0x8a2bc940, aCallback=aCallback@entry=
    0x7d2d4c11 <mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, aCallbackData=aCallbackData@entry=0x75afd1b0) at /Volumes/GeckoDev/gecko/gfx/layers/basic/BasicLayerManager.cpp:850
#7  0x7cb1d3ae in mozilla::layers::BasicLayerManager::EndTransactionInternal (this=0x8441d280, aCallback=0x7d2d4c11 <mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, aCallbackData=0x75afd1b0, 
    aFlags=<optimized out>) at /Volumes/GeckoDev/gecko/gfx/layers/basic/BasicLayerManager.cpp:528
#8  0x7d2fd27e in nsDisplayList::PaintRoot (this=this@entry=0x75afd164, aBuilder=aBuilder@entry=0x75afd1b0, aCtx=aCtx@entry=0x75afd5e4, aFlags=0) at /Volumes/GeckoDev/gecko/layout/base/nsDisplayList.cpp:1694
#9  0x7d306c7c in nsLayoutUtils::PaintFrame (aRenderingContext=0x75afd5e4, aFrame=0x8a6a62b8, aDirtyRegion=..., aBackstop=4294967295, aFlags=59) at /Volumes/GeckoDev/gecko/layout/base/nsLayoutUtils.cpp:3193
#10 0x7d310356 in PresShell::RenderDocument (this=0x759f4fc0, aRect=..., aFlags=<optimized out>, aBackgroundColor=4294967295, aThebesContext=0x86cf14c0) at /Volumes/GeckoDev/gecko/layout/base/nsPresShell.cpp:4964
#11 0x7d20ea42 in mozilla::AndroidBridge::CaptureThumbnail (this=<optimized out>, window=<optimized out>, bufW=350, bufH=200, tabId=0, buffer=..., shouldStore=@0x75afd7d3: true) at /Volumes/GeckoDev/gecko/widget/android/AndroidBridge.cpp:1885

Comment 7

[James Willcox (:snorp) ([e-mail]) (he/him)]

I bisected, and this is caused by bug 1124394. Jeff, can you fix this quickly? Otherwise I think we'll need to back it out.

Comment 8

[James Willcox (:snorp) ([e-mail]) (he/him)]

Hmm, I dont' see an obvious cause in that patch...

Comment 9

[(Away)]

There are a bunch of crash reports from Windows machines as well.
Looks like bug 1124394 was already backed out.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Assuming this was fixed by said backout. Feel free to reopen otherwise.

Comment 11

[u279076]

(In reply to Ryan VanderMeulen [:RyanVM UTC-4] from comment #10)
> Assuming this was fixed by said backout. Feel free to reopen otherwise.

I concur. There's 26 crashes reported over the last week but none on a currently support version of Firefox. The most recent version is with Firefox 38.0a1.

Comment 12

[u279076]

(In reply to Anthony Hughes, QA Mentor (:ashughes) from comment #11)
> (In reply to Ryan VanderMeulen [:RyanVM UTC-4] from comment #10)
> > Assuming this was fixed by said backout. Feel free to reopen otherwise.
> 
> I concur. There's 26 crashes reported over the last week but none on a
> currently support version of Firefox. The most recent version is with
> Firefox 38.0a1.

Furthermore, there are no crashes on Mac OS X (the other crashes are probably a different bug).