crash in mozilla::webgl::TexUnpackSurface::TexUnpackSurface

RESOLVED FIXED in Firefox 47

Status

()

defect
--
critical
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: ashughes, Assigned: mtseng)

Tracking

({crash, regression})

45 Branch
mozilla49
x86
Windows NT
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox46+ wontfix, firefox47 fixed, firefox48 fixed, firefox49+ fixed, firefox-esr45 affected)

Details

(Whiteboard: [gfx-noted], crash signature)

Attachments

(1 attachment)

This bug was filed from the Socorro interface and is 
report bp-99ecc410-1404-482f-a921-945832160427.
=============================================================
0 	xul.dll 	mozilla::webgl::TexUnpackSurface::TexUnpackSurface(RefPtr<mozilla::gfx::SourceSurface> const&, bool) 	dom/canvas/TexUnpackBlob.cpp
1 	xul.dll 	mozilla::webgl::TexUnpackImage::TexOrSubImage(bool, bool, char const*, mozilla::WebGLTexture*, StrongGLenum<TexImageTargetDetails>, int, mozilla::webgl::DriverUnpackInfo const*, int, int, int, unsigned int* const) 	dom/canvas/TexUnpackBlob.cpp
2 	xul.dll 	mozilla::WebGLTexture::TexImage(char const*, StrongGLenum<TexImageTargetDetails>, int, unsigned int, int, unsigned int, unsigned int, mozilla::webgl::TexUnpackBlob*) 	dom/canvas/WebGLTextureUpload.cpp
3 	xul.dll 	mozilla::WebGLTexture::TexOrSubImage(bool, char const*, StrongGLenum<TexImageTargetDetails>, int, unsigned int, int, int, int, int, unsigned int, unsigned int, mozilla::webgl::TexUnpackBlob*) 	dom/canvas/WebGLTextureUpload.cpp
4 	xul.dll 	mozilla::WebGLContext::TexImage2D(unsigned int, int, unsigned int, unsigned int, unsigned int, mozilla::dom::Element*, mozilla::ErrorResult* const) 	dom/canvas/WebGLContextTextures.cpp
5 	xul.dll 	mozilla::dom::WebGLRenderingContextBinding::texImage2D 	obj-firefox/dom/bindings/WebGLRenderingContextBinding.cpp
=============================================================
More reports: https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozilla%3A%3Awebgl%3A%3ATexUnpackSurface%3A%3ATexUnpackSurface
[Tracking Requested - why for this release]:
This is a low volume crash that appears to have started in Firefox 45. There have been 378 reports of this crash over the last week in Firefox 45.0.2 which ranks it around #212. The crash seems to be predominantly reported on Windows 7 32-bit, although not exclusively and has no strong correlation to any particular graphics vendor/device/driver combination.

Unfortunately I'm still having authentication issues so I am unable to get URLs at this time.
urls: overwhelmingly Facebook. Too late to fix in 46 unless it is a major issue/dot release driver. 
Let's track this for 49 and try to find an owner to investigate. 
Jeff, Morris, is this something one of you could look at?
Flags: needinfo?(mtseng)
Flags: needinfo?(jgilbert)
Milan can you help find an owner for this crash bug?
Flags: needinfo?(milan)
Peter, do you have somebody that could take a look at this soon?  I imagine a regression from bug 1221822.
Flags: needinfo?(milan)
Flags: needinfo?(jgilbert)
Flags: needinfo?(howareyou322)
Looks like the SourceSurface[1] might be null. Morris, please help to check.

[1]https://hg.mozilla.org/releases/mozilla-release/annotate/078baf501b55/dom/canvas/TexUnpackBlob.cpp#l314
Assignee: nobody → mtseng
Flags: needinfo?(howareyou322)
Flags: needinfo?(mtseng)
Attachment #8750586 - Flags: review?(jgilbert) → review+
Last try mix other commit. Submit another try with my commit only.
https://treeherder.mozilla.org/#/jobs?repo=try&revision=3d839b5766eb

Comment 10

3 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/218969cdfaf0
Status: NEW → RESOLVED
Last Resolved: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla49
Hi Milan, should we consider uplifting this crash fix to Beta47, Aurora48? Thanks!
Flags: needinfo?(milan)
Comment on attachment 8750586 [details] [diff] [review]
GetAsSourceSurface might return nullptr, let's handle it.

Approval Request Comment
[Feature/regressing bug #]: Bug 1268155
[User impact if declined]: Maybe crash user's firefox!
[Describe test coverage new/current, TreeHerder]: Test on local, nightly and try.
[Risks and why]: Low risk, just add a null check.
[String/UUID change made/needed]: N/A
Flags: needinfo?(milan)
Attachment #8750586 - Flags: approval-mozilla-beta?
Attachment #8750586 - Flags: approval-mozilla-aurora?
Comment on attachment 8750586 [details] [diff] [review]
GetAsSourceSurface might return nullptr, let's handle it.

Crash fix, Aurora48+, Beta47+
Attachment #8750586 - Flags: approval-mozilla-beta?
Attachment #8750586 - Flags: approval-mozilla-beta+
Attachment #8750586 - Flags: approval-mozilla-aurora?
Attachment #8750586 - Flags: approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.