Open Bug 1360913 Opened 7 years ago Updated 2 years ago

Crash in mozilla::layers::CompositorOGL::DrawGeometry<T>

Categories

(Core :: Graphics, defect)

55 Branch
Unspecified
Android
defect

Tracking

()

REOPENED
Tracking Status
firefox53 --- wontfix
firefox54 --- wontfix
firefox55 --- wontfix
firefox64 --- affected
firefox65 --- affected

People

(Reporter: calixte, Assigned: jnicol)

References

(Blocks 1 open bug)

Details

(Keywords: crash, Whiteboard: [clouseau])

Crash Data

This bug was filed from the Socorro interface and is 
report bp-4d86cba6-ab9a-4400-8f26-6ba7d0170430.
=============================================================

There is 1 crash in nightly 55 with buildid 20170429100412 . In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1360639.

[1] https://hg.mozilla.org/mozilla-central/rev?node=43268ba5e94c7222be3811cc8d7c223504006fea
Flags: needinfo?(rbarker)
Based on the stack trace, I do not believe the patch for Bug 1360639 is responsible for this crash. The reason this new patch shows up is only because it now the first thing to try and draw to the surface. With out this patch I believe it would have just crashed later when trying to composite the first layer.
Flags: needinfo?(rbarker)
Someone mentioned a repeatable crash on http://grouek.com/feed.
I can reproduce a crash using http://grouek.com/feed

As I stated in comment #1, I don't think the patch for bug 1360639 is causing this crash. It is crashing there only because it was the first thing to try and draw to the context. When the patch for Bug 1358775 lands with the toolbar draw occurring after the content has been draw, the crash will move to a different location.
 
The stack trace I get with the patch for Bug 1358775 applied seems to show the patch for bug 1360639 is unrelated:

#0  0xcde36694 in Display (this=<optimized out>) at /Volumes/firefox/toolbar/obj-arm-linux-androideabi-debug/dist/include/GLLibraryEGL.h:301
#1  mozilla::layers::EGLImageTextureHost::Lock (this=0xbc0601c0) at /Volumes/firefox/toolbar/gfx/layers/opengl/TextureHostOGL.cpp:605
#2  0xcde0ceee in mozilla::layers::ImageHost::Lock (this=0xbc015ee0) at /Volumes/firefox/toolbar/gfx/layers/composite/ImageHost.cpp:403
#3  0xcde0c9a0 in AutoLockCompositableHost (aHost=0xbc015ee0, this=0xc1d7edc0) at /Volumes/firefox/toolbar/gfx/layers/composite/CompositableHost.h:259
#4  mozilla::layers::ImageHost::Composite (this=0xbc015ee0, aCompositor=0xc22f9f60, aLayer=0xbc66de84, aEffectChain=..., aOpacity=1, aTransform=..., 
    aSamplingFilter=mozilla::gfx::POINT, aClipRect=..., aVisibleRegion=0x0, aGeometry=...) at /Volumes/firefox/toolbar/gfx/layers/composite/ImageHost.cpp:217
#5  0xcddf3072 in mozilla::layers::CanvasLayerComposite::<lambda(mozilla::layers::EffectChain&, const IntRect&)>::operator()(mozilla::layers::EffectChain &, const mozilla::gfx::IntRect &) const (__closure=__closure@entry=0xc1d7eef4, effectChain=..., clipRect=...) at /Volumes/firefox/toolbar/gfx/layers/composite/CanvasLayerComposite.cpp:96
#6  0xcddf36da in mozilla::layers::RenderWithAllMasks<mozilla::layers::CanvasLayerComposite::RenderLayer(const IntRect&, const mozilla::Maybe<mozilla::gfx::PolygonTyped<mozilla::gfx::UnknownUnits> >&)::<lambda(mozilla::layers::EffectChain&, const IntRect&)> >(mozilla::layers::Layer *, mozilla::layers::Compositor *, const mozilla::gfx::IntRect &, mozilla::layers::CanvasLayerComposite::<lambda(mozilla::layers::EffectChain&, const IntRect&)>) (aLayer=aLayer@entry=0xbc66dc00, aCompositor=0xc22f9f60, aClipRect=..., 
    aRenderCallback=...) at /Volumes/firefox/toolbar/obj-arm-linux-androideabi-debug/dist/include/mozilla/layers/LayerManagerComposite.h:748
#7  0xcddf3a2c in mozilla::layers::CanvasLayerComposite::RenderLayer (this=0xbc66dc00, aClipRect=..., aGeometry=...)
    at /Volumes/firefox/toolbar/gfx/layers/composite/CanvasLayerComposite.cpp:97
#8  0xcde04090 in mozilla::layers::RenderLayers<mozilla::layers::ContainerLayerComposite> (aContainer=0xbc0d3000, aManager=0xc1fd2a60, aClipRect=..., aGeometry=...)
    at /Volumes/firefox/toolbar/gfx/layers/composite/ContainerLayerComposite.cpp:452
#9  0xcde0460c in mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerComposite> (aContainer=0xbc0d3000, aManager=0xc1fd2a60, aClipRect=..., aGeometry=...)
    at /Volumes/firefox/toolbar/gfx/layers/composite/ContainerLayerComposite.cpp:617
#10 0xcde04090 in mozilla::layers::RenderLayers<mozilla::layers::ContainerLayerComposite> (aContainer=0xbf829400, aManager=0xc1fd2a60, aClipRect=..., aGeometry=...)
    at /Volumes/firefox/toolbar/gfx/layers/composite/ContainerLayerComposite.cpp:452
#11 0xcde0460c in mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerComposite> (aContainer=0xbf829400, aManager=0xc1fd2a60, aClipRect=..., aGeometry=...)
    at /Volumes/firefox/toolbar/gfx/layers/composite/ContainerLayerComposite.cpp:617
#12 0xcde0f668 in mozilla::layers::LayerManagerComposite::Render (this=this@entry=0xc1fd2a60, aInvalidRegion=..., aOpaqueRegion=...)
    at /Volumes/firefox/toolbar/gfx/layers/composite/LayerManagerComposite.cpp:936
#13 0xcde0fe50 in mozilla::layers::LayerManagerComposite::UpdateAndRender (this=this@entry=0xc1fd2a60)
    at /Volumes/firefox/toolbar/gfx/layers/composite/LayerManagerComposite.cpp:515
#14 0xcde10014 in mozilla::layers::LayerManagerComposite::EndTransaction (this=0xc1fd2a60, aTimeStamp=..., aFlags=<optimized out>)
    at /Volumes/firefox/toolbar/gfx/layers/composite/LayerManagerComposite.cpp:436
#15 0xcde1bce4 in mozilla::layers::CompositorBridgeParent::CompositeToTarget (this=0xc1338400, aTarget=0x0, aRect=<optimized out>)
    at /Volumes/firefox/toolbar/gfx/layers/ipc/CompositorBridgeParent.cpp:1014
#16 0xcde188aa in mozilla::layers::CompositorVsyncScheduler::Composite (this=0xc1fde4c0, aVsyncTimestamp=...)
    at /Volumes/firefox/toolbar/gfx/layers/ipc/CompositorVsyncScheduler.cpp:258
#17 0xcde230b2 in applyImpl<mozilla::layers::CompositorVsyncScheduler, void (mozilla::layers::CompositorVsyncScheduler::*)(mozilla::TimeStamp), StoreCopyPassByConstLRef<mozilla::TimeStamp>, 0u> (args=..., m=<optimized out>, o=<optimized out>) at /Volumes/firefox/toolbar/obj-arm-linux-androideabi-debug/dist/include/nsThreadUtils.h:874
#18 apply<mozilla::layers::CompositorVsyncScheduler, void (mozilla::layers::CompositorVsyncScheduler::*)(mozilla::TimeStamp)> (m=<optimized out>, o=<optimized out>, 
    this=<optimized out>) at /Volumes/firefox/toolbar/obj-arm-linux-androideabi-debug/dist/include/nsThreadUtils.h:881
#19 mozilla::detail::RunnableMethodImpl<mozilla::layers::CompositorVsyncScheduler*, void (mozilla::layers::CompositorVsyncScheduler::*)(mozilla::TimeStamp), true, true, mozilla::TimeStamp>::Run (this=<optimized out>) at /Volumes/firefox/toolbar/obj-arm-linux-androideabi-debug/dist/include/nsThreadUtils.h:909
#20 0xcd8fde9e in MessageLoop::RunTask (this=0xc1d7f84c, aTask=...) at /Volumes/firefox/toolbar/ipc/chromium/src/base/message_loop.cc:361
#21 0xcd8ff4c0 in MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask&&) (this=<optimized out>, pending_task=<optimized out>)
    at /Volumes/firefox/toolbar/ipc/chromium/src/base/message_loop.cc:369
#22 0xcd8ff550 in MessageLoop::DoWork (this=0xc1d7f84c) at /Volumes/firefox/toolbar/ipc/chromium/src/base/message_loop.cc:444
#23 0xcd8fa6d0 in base::MessagePumpDefault::Run (this=0xc2087c20, delegate=0xc1d7f84c) at /Volumes/firefox/toolbar/ipc/chromium/src/base/message_pump_default.cc:36
#24 0xcd8fb4b4 in MessageLoop::RunInternal (this=this@entry=0xc1d7f84c) at /Volumes/firefox/toolbar/ipc/chromium/src/base/message_loop.cc:238
#25 0xcd8fb4d0 in RunHandler (this=0xc1d7f84c) at /Volumes/firefox/toolbar/ipc/chromium/src/base/message_loop.cc:231
#26 MessageLoop::Run (this=0xc1d7f84c) at /Volumes/firefox/toolbar/ipc/chromium/src/base/message_loop.cc:211
#27 0xcd9067b2 in base::Thread::ThreadMain (this=0xc2087ba0) at /Volumes/firefox/toolbar/ipc/chromium/src/base/thread.cc:179
#28 0xcd903418 in ThreadFunc (closure=<optimized out>) at /Volumes/firefox/toolbar/ipc/chromium/src/base/platform_thread_posix.cc:38
Of the 10 crashes I see in the past week, 8 are on 53 and 2 are on 52. Randall, safe to assume this shouldn't be tracked as a 55 regression?
Flags: needinfo?(rbarker)
(In reply to Mike Taylor [:miketaylr] from comment #4)
> Of the 10 crashes I see in the past week, 8 are on 53 and 2 are on 52.
> Randall, safe to assume this shouldn't be tracked as a 55 regression?

Correct, the dynamic toolbar v3 is only in 55 which is why it was probably set that way, but as I said in early comments, I didn't think it was responsible for the crash.
Flags: needinfo?(rbarker)
Thanks. Let's not track as a regression then, just a regular™ bug.
(In reply to Mike Taylor [:miketaylr] from comment #6)
> Thanks. Let's not track as a regression then, just a regular™ bug.

Don't know if it needs to be escalated but the page in comment #2 (http://grouek.com/feed) crashes 100% in nightly for me which is not good.
Let's ni? jchen to make that call.
Flags: needinfo?(nchen)
(In reply to Mike Taylor [:miketaylr] from comment #8)
> Let's ni? jchen to make that call.

I think it's up to the Taiwan folks. FWIW that page works for me. I noticed some flicker but no crash.
Flags: needinfo?(nchen)
(In reply to Jim Chen [:jchen] [:darchons] from comment #9)
> (In reply to Mike Taylor [:miketaylr] from comment #8)
> > Let's ni? jchen to make that call.
> 
> I think it's up to the Taiwan folks. FWIW that page works for me. I noticed
> some flicker but no crash.

Were you running debug? I think it is an assert. So maybe not as serious as I first thought? But looks like a gfx bug too me. Either should fix the assert or remove it if it isn't actually a condition that should assert.
I've been out of the office so haven't had a device, but I can take this now.
Assignee: nobody → jnicol
The flickering and debug assertion are a regression from bug 1328797. I'm unsure whether that is the same cause as the crash, as I cannot reproduce the crash on any of my devices, but if that url is indeed causing this crash then it could indeed be related.

I'll try to fix the flickering without reintroducing a sync transaction (rather than just reverting the patch), and then we can see if the crashes go away.
Component: GeckoView → Graphics
Product: Firefox for Android → Core
Closing because no crashes reported for 12 weeks.
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → WONTFIX
There are still some crashes so reopen it.
Status: RESOLVED → REOPENED
Resolution: WONTFIX → ---

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.

Severity: critical → S3
You need to log in before you can comment on or make changes to this bug.