WebGL crash: [@mozilla::gl::GLContext::AfterGLCall]

RESOLVED FIXED in Firefox 55

Status

()

Core
Canvas: WebGL
RESOLVED FIXED
a year ago
a year ago

People

(Reporter: posidron, Assigned: daoshengmu)

Tracking

(Blocks: 1 bug, {crash, testcase})

Trunk
mozilla55
crash, testcase
Points:
---

Firefox Tracking Flags

(firefox52 wontfix, firefox-esr52 wontfix, firefox53 wontfix, firefox54 wontfix, firefox55 fixed)

Details

MozReview Requests

()

Submitter Diff Changes Open Issues Last Updated
Loading...
Error loading review requests:

Attachments

(2 attachments)

(Reporter)

Description

a year ago
Created attachment 8849381 [details]
testcase.html

#0 0x112efc00d in mozilla::gl::GLContext::AfterGLCall(char const*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x29c300d)
#1 0x1160bba56 in mozilla::WebGLContext::GetSurfaceSnapshot(bool*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x5b82a56)
#2 0x1160bc511 in non-virtual thunk to mozilla::WebGLContext::GetSurfaceSnapshot(bool*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x5b83511)
#3 0x1165f438a in mozilla::dom::HTMLCanvasElement::GetSurfaceSnapshot(bool*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x60bb38a)
#4 0x118def248 in nsLayoutUtils::SurfaceFromElement(mozilla::dom::HTMLCanvasElement*, unsigned int, RefPtr<mozilla::gfx::DrawTarget>&) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x88b6248)
#5 0x118df07d1 in nsLayoutUtils::SurfaceFromElement(mozilla::dom::Element*, unsigned int, RefPtr<mozilla::gfx::DrawTarget>&) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x88b77d1)
#6 0x1161b2d5b in mozilla::WebGLContext::FromDomElem(char const*, StrongGLenum<TexImageTargetDetails>, unsigned int, unsigned int, unsigned int, mozilla::dom::Element const&, mozilla::ErrorResult*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x5c79d5b)
#7 0x1161b4125 in mozilla::WebGLContext::From(char const*, StrongGLenum<TexImageTargetDetails>, int, int, int, int, mozilla::TexImageSource const&, mozilla::dom::TypedArray<unsigned char, &(js::UnwrapUint8ClampedArray(JSObject*)), &(JS_GetUint8ClampedArrayData(JSObject*, bool*, JS::AutoCheckCannotGC const&)), &(js::GetUint8ClampedArrayLengthAndData(JSObject*, unsigned int*, bool*, unsigned char**)), &(JS_NewUint8ClampedArray(JSContext*, unsigned int))>*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x5c7b125)
#8 0x1161b505f in mozilla::ValidateTexOrSubImage(mozilla::WebGLContext*, char const*, StrongGLenum<TexImageTargetDetails>, int, int, int, int, mozilla::webgl::PackingInfo const&, mozilla::TexImageSource const&, mozilla::dom::TypedArray<unsigned char, &(js::UnwrapUint8ClampedArray(JSObject*)), &(JS_GetUint8ClampedArrayData(JSObject*, bool*, JS::AutoCheckCannotGC const&)), &(js::GetUint8ClampedArrayLengthAndData(JSObject*, unsigned int*, bool*, unsigned char**)), &(JS_NewUint8ClampedArray(JSContext*, unsigned int))>*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x5c7c05f)
#9 0x1161b4a3b in mozilla::WebGLTexture::TexImage(char const*, StrongGLenum<TexImageTargetDetails>, int, unsigned int, int, int, int, int, mozilla::webgl::PackingInfo const&, mozilla::TexImageSource const&) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x5c7ba3b)
#10 0x1160fddd5 in mozilla::WebGLContext::TexImage(char const*, unsigned char, unsigned int, int, unsigned int, int, int, int, int, unsigned int, unsigned int, mozilla::TexImageSource const&) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x5bc4dd5)
#11 0x11532aa63 in mozilla::dom::WebGL2RenderingContextBinding::texImage2D(JSContext*, JS::Handle<JSObject*>, mozilla::WebGL2Context*, JSJitMethodCallArgs const&) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x4df1a63)
#12 0x115ead61d in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x597461d)
#13 0x11c8c4c6d in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xc38bc6d)
#14 0x11c8c4388 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xc38b388)
#15 0x11c8a18d2 in Interpret(JSContext*, js::RunState&) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xc3688d2)
#16 0x11c88d740 in js::RunScript(JSContext*, js::RunState&) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xc354740)
#17 0x11c8c8881 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xc38f881)
#18 0x11c8c9617 in js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xc390617)
#19 0x11d5b1c7d in Evaluate(JSContext*, js::ScopeKind, JS::Handle<JSObject*>, JS::ReadOnlyCompileOptions const&, JS::SourceBufferHolder&, JS::MutableHandle<JS::Value>) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xd078c7d)
#20 0x11d5b309c in Evaluate(JSContext*, JS::AutoObjectVector&, JS::ReadOnlyCompileOptions const&, JS::SourceBufferHolder&, JS::MutableHandle<JS::Value>) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xd07a09c)
#21 0x113f07801 in nsJSUtils::EvaluateString(JSContext*, JS::SourceBufferHolder&, JS::Handle<JSObject*>, JS::CompileOptions&, nsJSUtils::EvaluateOptions const&, JS::MutableHandle<JS::Value>, void**) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x39ce801)
#22 0x113f093d4 in nsJSUtils::EvaluateString(JSContext*, JS::SourceBufferHolder&, JS::Handle<JSObject*>, JS::CompileOptions&, void**) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x39d03d4)
#23 0x113fafcb7 in nsScriptLoader::EvaluateScript(nsScriptLoadRequest*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x3a76cb7)
#24 0x113fabcb7 in nsScriptLoader::ProcessRequest(nsScriptLoadRequest*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x3a72cb7)
#25 0x113f8b763 in nsScriptLoader::ProcessScriptElement(nsIScriptElement*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x3a52763)
#26 0x113f872a6 in nsScriptElement::MaybeProcessScript() (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x3a4e2a6)
#27 0x112cc0f50 in nsHtml5TreeOpExecutor::RunScript(nsIContent*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x2787f50)
#28 0x112cbeba9 in nsHtml5TreeOpExecutor::RunFlushLoop() (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x2785ba9)
#29 0x112cc5fbe in nsHtml5ExecutorFlusher::Run() (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x278cfbe)
#30 0x11084c3aa in nsThread::ProcessNextEvent(bool, bool*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x3133aa)
#31 0x110844580 in NS_ProcessPendingEvents(nsIThread*, unsigned int) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x30b580)
#32 0x1182d83cf in nsBaseAppShell::NativeEventCallback() (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x7d9f3cf)
#33 0x1183e9555 in nsAppShell::ProcessGeckoEvents(void*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x7eb0555)
#34 0x7fffb448b980 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0xa7980)
#35 0x7fffb446ca7c in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x88a7c)
#36 0x7fffb446bf75 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x87f75)
#37 0x7fffb446b973 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x87973)
#38 0x7fffb39f7a5b in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30a5b)
#39 0x7fffb39f7890 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30890)
#40 0x7fffb39f76c5 in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x306c5)
#41 0x7fffb1f9d5b3 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x475b3)
#42 0x7fffb2717d6a in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x7c1d6a)
#43 0x1183e7a6c in -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x7eaea6c)
#44 0x7fffb1f91f34 in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x3bf34)
#45 0x1183ea5e6 in nsAppShell::Run() (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x7eb15e6)
#46 0x11c026c8d in nsAppStartup::Run() (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xbaedc8d)
#47 0x11c246795 in XREMain::XRE_mainRun() (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xbd0d795)
#48 0x11c24976a in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xbd1076a)
#49 0x11c24addd in XRE_main(int, char**, mozilla::BootstrapConfig const&) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xbd11ddd)
#50 0x1021200df in main (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/firefox+0x1000020df)
#51 0x10211f993 in start (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/firefox+0x100001993)
This is DEBUG-only, thus not critical.
Severity: critical → normal
(Assignee)

Updated

a year ago
Assignee: nobody → dmu
Comment hidden (mozreview-request)
Comment hidden (mozreview-request)
Comment hidden (mozreview-request)

Comment 5

a year ago
mozreview-review
Comment on attachment 8854921 [details]
Bug 1349102 - Making read back buffer use the default framebuffer when doing snapshot;

https://reviewboard.mozilla.org/r/126846/#review130704

::: dom/canvas/WebGLContext.cpp:1967
(Diff revision 3)
> +          ErrorInvalidOperation("Can't read from backbuffer when readBuffer mode is"
> +                                " NONE.");
> +          return nullptr;
> +        }
> +        else if (readBufferMode != LOCAL_GL_BACK) {
>              gl->fReadBuffer(LOCAL_GL_BACK);

My guess is that this is breaking when our 'screen' is actually a non-default framebuffer, so ReadBuffer(BACK) isn't valid, and we should be using ReadBuffer(COLOR_ATTACHMENT0).

gl->Screen()->SetReadBuffer(BACK) will take care of this for us.
Attachment #8854921 - Flags: review?(jgilbert) → review-
Comment hidden (mozreview-request)
(Assignee)

Comment 7

a year ago
mozreview-review-reply
Comment on attachment 8854921 [details]
Bug 1349102 - Making read back buffer use the default framebuffer when doing snapshot;

https://reviewboard.mozilla.org/r/126846/#review130704

> My guess is that this is breaking when our 'screen' is actually a non-default framebuffer, so ReadBuffer(BACK) isn't valid, and we should be using ReadBuffer(COLOR_ATTACHMENT0).
> 
> gl->Screen()->SetReadBuffer(BACK) will take care of this for us.

Good suggestion! thanks.

Comment 8

a year ago
mozreview-review
Comment on attachment 8854921 [details]
Bug 1349102 - Making read back buffer use the default framebuffer when doing snapshot;

https://reviewboard.mozilla.org/r/126846/#review131480

Fix the issue any this should be good!

::: dom/canvas/WebGLContext.cpp:1967
(Diff revision 4)
> -            gl->fReadBuffer(LOCAL_GL_BACK);
> +            gl->Screen()->SetReadBuffer(LOCAL_GL_BACK);
>          }
>          ReadPixelsIntoDataSurface(gl, surf);
>  
>          if (readBufferMode != LOCAL_GL_BACK) {
>              gl->fReadBuffer(readBufferMode);

Here too.
Attachment #8854921 - Flags: review?(jgilbert) → review+
Comment hidden (mozreview-request)

Comment 10

a year ago
Pushed by dmu@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/e1fa99e13ff4
Making read back buffer use the default framebuffer when doing snapshot; r=jgilbert

Comment 11

a year ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/e1fa99e13ff4
Status: NEW → RESOLVED
Last Resolved: a year ago
status-firefox55: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla55
status-firefox52: --- → wontfix
status-firefox53: --- → wontfix
status-firefox54: --- → wontfix
status-firefox-esr52: --- → wontfix
You need to log in before you can comment on or make changes to this bug.