Closed Bug 1300549 Opened 8 years ago Closed 8 years ago

Assertion failure: blob->mHeight >= 1, at WebGLTextureUpload.cpp:155

Categories

(Core :: Graphics: CanvasWebGL, defect)

Product:
Core
Component:
Graphics: CanvasWebGL
Version:
51 Branch
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla53
Tracking Flags:
Tracking Status
firefox51 + fixed
firefox52 --- fixed
firefox53 --- fixed

People

(Reporter: cbook, Assigned: cleu)

References

(
URL
)

Details

(Keywords: assertion, regression, Whiteboard: [gfx-noted])

Attachments

(4 files, 2 obsolete files)

complete stack
678.15 KB, text/plain
Details
about:support
4.48 KB, text/plain
Details
stack
6.82 KB, text/plain
Details
Bail out if we have already generated exceptions
750 bytes, patch
jgilbert
: review+
gchang
: approval-mozilla-aurora+
gchang
: approval-mozilla-beta+
Details | Diff | Splinter Review
Attached file complete stack — 
found via bughunter and reproduced on latest m-c trunk debug tinderbox build

STR:
-> Load https://artsandculture.withgoogle.com/en-us/national-parks-service/hawaii-volcanoes/jagger-museum/hawaii-volcanoes-helicopter-360
--> Assertion

Assertion failure: blob->mHeight >= 1, at c:/builds/moz2_slave/m-cen-w32-d-000000000000000000/build/src/dom/canvas/WebGLTextureUpload.cpp:155

trunk only assertion/regression it seems
[Tracking Requested - why for this release]:
trunk regression, bughunter found
tracking-firefox51: --- → ?
I try with this debug build[1] at win10, but I don't see the crash or assertion.

There is another problem that gecko shows lot of messages "We can't support non-premultiplied alpha for video!" in console. The bug 1289637 is fired for this message.

:Tomcat, what's the build id you used? Is it tested at win10?

[1]
https://ftp.mozilla.org/pub/firefox/tinderbox-builds/mozilla-central-win32-debug/1473172434/firefox-51.0a1.en-US.win32.installer.exe
Flags: needinfo?(cbook)
Keywords: regression
Whiteboard: [gfx-noted]
Version: unspecified → 51 Branch
(In reply to Jerry Shih[:jerry] (UTC+8) from comment #2)
> I try with this debug build[1] at win10, but I don't see the crash or
> assertion.
> 
> There is another problem that gecko shows lot of messages "We can't support
> non-premultiplied alpha for video!" in console. The bug 1289637 is fired for
> this message.
> 
> :Tomcat, what's the build id you used? Is it tested at win10?
> 
> [1]
> https://ftp.mozilla.org/pub/firefox/tinderbox-builds/mozilla-central-win32-
> debug/1473172434/firefox-51.0a1.en-US.win32.installer.exe

i tested the assertion on windows 7 but can try also on 10 now
Flags: needinfo?(cbook)
I cannot reproduce it on Windows 10, but I can reproduce it on MacOSX 10.11.6
I found the crash part is different under Mac OSX, not sure whether it is by same bug or not.

Crash Annotation GraphicsCriticalError: |[C0][GFX1]: RGBX corner pixel at (0,0) in 1280x872 surface is not opaque: 0,0,0,0 (t=25.3405) [GFX1]: RGBX corner pixel at (0,0) in 1280x872 surface is not opaque: 0,0,0,0
Assertion failure: [GFX1]: RGBX corner pixel at (0,0) in 1280x872 surface is not opaque: 0,0,0,0, at /Users/jybowser/git/gecko/gfx/2d/Logging.h:510
#01: mozilla::gfx::GetBitmapForSurface(mozilla::gfx::SourceSurface*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xdd928e]
#02: mozilla::gfx::SetPaintPattern(SkPaint&, mozilla::gfx::Pattern const&, float, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float>)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xddc737]
#03: mozilla::gfx::DrawTargetSkia::FillRect(mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::Pattern const&, mozilla::gfx::DrawOptions const&)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xdda2f6]
#04: mozilla::gfx::DrawTargetDual::FillRect(mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::Pattern const&, mozilla::gfx::DrawOptions const&)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xe0be95]
#05: mozilla::layers::FillRectWithMask(mozilla::gfx::DrawTarget*, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::SourceSurface*, mozilla::gfx::SamplingFilter,[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf6b53a]
#06: mozilla::layers::BasicCanvasLayer::Paint(mozilla::gfx::DrawTarget*, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::layers::Layer*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf5c8ce]
#07: mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext&, gfxContext*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf6a0d8]
#08: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownU[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf69426]
#09: mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext&, gfxContext*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf6a026]
#10: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownU[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf693c9]
#11: mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext&, gfxContext*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf6a026]
#12: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownU[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf693c9]
#13: mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::lay[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf67d2a]
#14: mozilla::FrameLayerBuilder::PaintItems(nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem>&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, gfxContext*, nsRenderingContext*, nsDisplayListBuilder*, nsPresContext*, mozilla::gfx::IntPoin[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x31c931e]
#15: mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mo[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x31ca90d]
#16: mozilla::layers::ClientSingleTiledLayerBuffer::PaintThebes(mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, v[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf842aa]
#17: mozilla::layers::ClientTiledPaintedLayer::RenderHighPrecision(mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits>&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::I[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf751d6]
#18: mozilla::layers::ClientTiledPaintedLayer::RenderLayer()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf75d4b]
#19: mozilla::layers::ClientContainerLayer::RenderLayer()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf79ccf]
#20: mozilla::layers::ClientContainerLayer::RenderLayer()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf79ccf]
#21: mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::la[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf7102a]
#22: mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::Dr[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf711fa]
#23: nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3254660]
#24: nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3298b85]
#25: PresShell::Paint(nsView*, nsRegion const&, unsigned int)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x32cdad6]
#26: nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2e26d69]
#27: nsViewManager::ProcessPendingUpdatesForView(nsView*, bool)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2e26a09]
#28: nsViewManager::ProcessPendingUpdates()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2e27bf2]
#29: nsRefreshDriver::Tick(long long, mozilla::TimeStamp)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x31942f3]
#30: mozilla::RefreshDriverTimer::TickRefreshDrivers(long long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x31982b6]
#31: mozilla::RefreshDriverTimer::Tick(long long, mozilla::TimeStamp)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x31980db]
#32: mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3198f8c]
#33: mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3198cc4]
#34: mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3566293]
#35: mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x8bfe9c]
#36: mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6bb881]
#37: mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x66672f]
#38: mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x664fb2]
#39: mozilla::ipc::MessageChannel::OnMaybeDequeueOne()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x65cd4b]
#40: mozilla::detail::RunnableMethodImpl<bool (mozilla::ipc::MessageChannel::*)(), false, true>::Run()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6794e7]
#41: mozilla::ipc::MessageChannel::DequeueTask::Run()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6771ce]
#42: nsThread::ProcessNextEvent(bool, bool*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xfa371]
#43: NS_ProcessPendingEvents(nsIThread*, unsigned int)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x1396cf]
#44: nsBaseAppShell::NativeEventCallback()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2e57fd1]
#45: nsAppShell::ProcessGeckoEvents(void*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2ec1081]
#46: __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0xaa881]
#47: __CFRunLoopDoSources0[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x89fbc]
#48: __CFRunLoopRun[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x894df]
#49: CFRunLoopRunSpecific[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x88ed8]
#50: RunCurrentEventLoopInMode[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x30935]
#51: ReceiveNextEventCommon[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x3076f]
#52: _BlockUntilNextEventMatchingListInModeWithFilter[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x305af]
#53: _DPSNextEvent[/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x48df6]
#54: -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:][/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x48226]
#55: -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:][/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2ec0396]
#56: -[NSApplication run][/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x3cd80]
#57: nsAppShell::Run()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2ec1775]
#58: XRE_RunAppShell[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3bbad57]
#59: mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x66ad67]
#60: MessageLoop::Run()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x62943c]
#61: XRE_InitChildProcess[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3bba708]
#62: content_process_main(int, char**)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container +0x150c]
Hit MOZ_CRASH(GFX: An assert from the graphics logger) at /Users/jybowser/git/gecko/gfx/2d/Logging.h:511
#01: mozilla::gfx::GetBitmapForSurface(mozilla::gfx::SourceSurface*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xdd928e]
#02: mozilla::gfx::SetPaintPattern(SkPaint&, mozilla::gfx::Pattern const&, float, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float>)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xddc737]
#03: mozilla::gfx::DrawTargetSkia::FillRect(mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::Pattern const&, mozilla::gfx::DrawOptions const&)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xdda2f6]
#04: mozilla::gfx::DrawTargetDual::FillRect(mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::Pattern const&, mozilla::gfx::DrawOptions const&)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xe0be95]
#05: mozilla::layers::FillRectWithMask(mozilla::gfx::DrawTarget*, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::SourceSurface*, mozilla::gfx::SamplingFilter,[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf6b53a]
#06: mozilla::layers::BasicCanvasLayer::Paint(mozilla::gfx::DrawTarget*, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::layers::Layer*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf5c8ce]
#07: mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext&, gfxContext*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf6a0d8]
#08: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownU[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf69426]
#09: mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext&, gfxContext*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf6a026]
#10: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownU[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf693c9]
#11: mozilla::layers::BasicLayerManager::PaintSelfOrChildren(mozilla::layers::PaintLayerContext&, gfxContext*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf6a026]
#12: mozilla::layers::BasicLayerManager::PaintLayer(gfxContext*, mozilla::layers::Layer*, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownU[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf693c9]
#13: mozilla::layers::BasicLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::lay[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf67d2a]
#14: mozilla::FrameLayerBuilder::PaintItems(nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem>&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, gfxContext*, nsRenderingContext*, nsDisplayListBuilder*, nsPresContext*, mozilla::gfx::IntPoin[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x31c931e]
#15: mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mo[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x31ca90d]
#16: mozilla::layers::ClientSingleTiledLayerBuffer::PaintThebes(mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, v[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf842aa]
#17: mozilla::layers::ClientTiledPaintedLayer::RenderHighPrecision(mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits>&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::I[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf751d6]
#18: mozilla::layers::ClientTiledPaintedLayer::RenderLayer()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf75d4b]
#19: mozilla::layers::ClientContainerLayer::RenderLayer()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf79ccf]
#20: mozilla::layers::ClientContainerLayer::RenderLayer()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf79ccf]
#21: mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::la[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf7102a]
#22: mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::Dr[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf711fa]
#23: nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3254660]
#24: nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3298b85]
#25: PresShell::Paint(nsView*, nsRegion const&, unsigned int)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x32cdad6]
#26: nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2e26d69]
#27: nsViewManager::ProcessPendingUpdatesForView(nsView*, bool)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2e26a09]
#28: nsViewManager::ProcessPendingUpdates()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2e27bf2]
#29: nsRefreshDriver::Tick(long long, mozilla::TimeStamp)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x31942f3]
#30: mozilla::RefreshDriverTimer::TickRefreshDrivers(long long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x31982b6]
#31: mozilla::RefreshDriverTimer::Tick(long long, mozilla::TimeStamp)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x31980db]
#32: mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3198f8c]
#33: mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3198cc4]
#34: mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3566293]
#35: mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x8bfe9c]
#36: mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6bb881]
#37: mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x66672f]
#38: mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x664fb2]
#39: mozilla::ipc::MessageChannel::OnMaybeDequeueOne()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x65cd4b]
#40: mozilla::detail::RunnableMethodImpl<bool (mozilla::ipc::MessageChannel::*)(), false, true>::Run()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6794e7]
#41: mozilla::ipc::MessageChannel::DequeueTask::Run()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6771ce]
#42: nsThread::ProcessNextEvent(bool, bool*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xfa371]
#43: NS_ProcessPendingEvents(nsIThread*, unsigned int)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x1396cf]
#44: nsBaseAppShell::NativeEventCallback()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2e57fd1]
#45: nsAppShell::ProcessGeckoEvents(void*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2ec1081]
#46: __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0xaa881]
#47: __CFRunLoopDoSources0[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x89fbc]
#48: __CFRunLoopRun[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x894df]
#49: CFRunLoopRunSpecific[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x88ed8]
#50: RunCurrentEventLoopInMode[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x30935]
#51: ReceiveNextEventCommon[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x3076f]
#52: _BlockUntilNextEventMatchingListInModeWithFilter[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x305af]
#53: _DPSNextEvent[/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x48df6]
#54: -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:][/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x48226]
#55: -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:][/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2ec0396]
#56: -[NSApplication run][/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x3cd80]
#57: nsAppShell::Run()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2ec1775]
#58: XRE_RunAppShell[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3bbad57]
#59: mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x66ad67]
#60: MessageLoop::Run()[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x62943c]
#61: XRE_InitChildProcess[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3bba708]
#62: content_process_main(int, char**)[/Users/jybowser/git/gecko/obj-x86_64-apple-darwin15.6.0/dist/NightlyDebug.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container +0x150c]
Assignee: nobody → cleu
Tracking 51+ for this reproducible bughunter crash.
tracking-firefox51: ? → +
I set up a Windows 7 machine and I can reproduce the exact same crash.

It seems that WebGLContext obtains an HTMLVideoElement which contains malformed frame image with both width and height 0. (It should be 1024*512)

I think it has something to do with media decoder.
I think we're supposed to support 0-size texture uploads anyway, though.
This patch will check image frames and ignore it if the image frame has invalid dimension.

It does prevent the assertion, but the video cannot be played.

It seems that every frames in the video are decoded with dimension 0*0.

        Attachment #8792742 -
        Attachment is obsolete: true

    
    

    
  
Comment on attachment 8792796 [details] [diff] [review]
Bypass frame image with invalid dimensions v2

Review of attachment 8792796 [details] [diff] [review]:
-----------------------------------------------------------------

I originally think it should be okay to process texture with 0*0, too.
So I tried to remove the assertions and see what will happen.
But it seems that our implementation will encounter problems before calling native OpenGL calls if we have a 0*0 texture.
I think the safest way to fix it is to check the image dimension, throwing exception if we have invalid dimension before we upload it.

According to the spec, I think it should be an INVALID_VALUE exception.

void texImage2D(GLenum target, GLint level, GLint internalformat, GLenum format, GLenum type, TexImageSource? source) /* May throw DOMException */
https://www.khronos.org/registry/webgl/specs/latest/1.0/

        Attachment #8792796 -
        Flags: feedback?(jgilbert)

    
  

        Attachment #8792796 -
        Attachment description: WIP - Bypass frame image with invalid dimensions v2 → Bypass frame image with invalid dimensions v2

        Attachment #8792796 -
        Flags: feedback?(jgilbert) → review?(jgilbert)

    
    

    
  
Comment on attachment 8792796 [details] [diff] [review]
Bypass frame image with invalid dimensions v2

Review of attachment 8792796 [details] [diff] [review]:
-----------------------------------------------------------------

I believe we're supposed to handle this properly, instead of throwing an error.

        Attachment #8792796 -
        Flags: review?(jgilbert) → review-

    
    

    
  
Hi Tomcat,
I cannot reproduce this crash with my Win7 32bit VM after pulling the latest m-c build.

Can you test the latest build again?

And please post your about:support here, thank  you:)
Flags: needinfo?(cbook)

    
    

    
  

      
      
      
      

        Attached file
          
        about:support
        — 
      

    


  
Flags: needinfo?(cbook)

    
    

    
  

      
      
      
      

        Attached file
          
        stack
        — 
      

    


  

    
    

    
  
(In reply to Michael Leu[:lenzak800](UTC+8) from comment #13)
> Hi Tomcat,
> I cannot reproduce this crash with my Win7 32bit VM after pulling the latest
> m-c build.
> 
> Can you test the latest build again?
> 
> And please post your about:support here, thank  you:)

yeah still crashed with latest version (btw updated vm fusion to Version 8.5.1 (4543325)

    
    

    
  
OK, I can now reproduce the crash, but the cause is different.

Previously we got a mHeight=0 assertion failure, and now we got an OOM exception here.
http://searchfox.org/mozilla-central/source/dom/canvas/TexUnpackBlob.cpp#650

I will do more test to figure out whether it is a real OOM or another driver issue.

    
    

    
  
This is definitely not a real OOM.

The image which cause it throws OOM exception is a 0x0 image.

It seems the cause of this crash is same as the previous crash.

Media part is unable to decode the 360 video so it keeps barfing 0x0 images.

The 0x0 images are read as textures by WebGL, and we fail to acquire its SourceSurface because of its dimension, then we have OOM exception and crash.

    
    

    
  
After bug1290831 landed, the crash place is changed.
https://dxr.mozilla.org/mozilla-central/source/dom/canvas/WebGLTextureUpload.cpp?q=WebGLTextureUpload.cpp&redirect_type=direct#1159

Bug1290831 adds more check to prevent malformed texture from mistakenly converted to ImageInfo, which leads to a null ImageInfo here and hit the MOZ_ASSERT.

I think we should have more checks before this happen.

    
    

    
  
The real ASSERT is caused by glError
https://dxr.mozilla.org/mozilla-central/source/dom/canvas/WebGLTextureUpload.cpp?q=WebGLTextureUpload.cpp&redirect_type=direct#1259

Looks like I accidentally active compiler optimization.

    
    

    
  
So here is the problem, we execute blob->TexOrSubImage and we return true without actually call DoTexSubImage which contains the actual GL call.
https://dxr.mozilla.org/mozilla-central/source/dom/canvas/WebGLTextureUpload.cpp?q=WebGLTextureUpload.cpp&redirect_type=direct#1242

Under this condition, glError is a random number because it has no initial value, then we found it's not 0 and we crash.

    
    

    
  


  
I think we can just bail out if we have generated exceptions before executing actual GL calls

        Attachment #8792796 -
        Attachment is obsolete: true

    
  

        Attachment #8814029 -
        Flags: review?(jgilbert)

        Attachment #8814029 -
        Flags: review?(jgilbert) → review+

    
  
Keywords: checkin-needed

    
    

    
  
Pushed by cbook@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/84ea3d3b3248
Bail out if we have already generated exceptions. r=jgilbert
Keywords: checkin-needed

    
    

    
  
https://hg.mozilla.org/mozilla-central/rev/84ea3d3b3248
Status: NEW → RESOLVED
Closed: 8 years ago

          status-firefox53:
          --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla53

    
    

    
  
Comment on attachment 8814029 [details] [diff] [review]
Bail out if we have already generated exceptions

Approval Request Comment
[Feature/Bug causing the regression]: webgl2
[User impact if declined]:
[Is this code covered by automated tests?]:
[Has the fix been verified in Nightly?]:
[Needs manual test from QE? If yes, steps to reproduce]: 
[List of other uplifts needed for the feature/fix]:
[Is the change risky?]:
[Why is the change risky/not risky?]:
[String changes made/needed]:

        Attachment #8814029 -
        Flags: approval-mozilla-beta?

        Attachment #8814029 -
        Flags: approval-mozilla-aurora?

    
    

    
  
Comment on attachment 8814029 [details] [diff] [review]
Bail out if we have already generated exceptions

WebGL2 related patch. Beta51+ & Aurora52+. Should be in 51 beta 8.

        Attachment #8814029 -
        Flags: approval-mozilla-beta?

        Attachment #8814029 -
        Flags: approval-mozilla-beta+

        Attachment #8814029 -
        Flags: approval-mozilla-aurora?

        Attachment #8814029 -
        Flags: approval-mozilla-aurora+

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: