Closed Bug 1642994 Opened 2 months ago Closed 1 month ago

Crash in [@ mozilla::gl::SharedSurface_SurfaceTexture::LockProdImpl]

Categories

(Core :: Graphics, defect)

Unspecified
Android
defect

Tracking

()

RESOLVED FIXED
mozilla80
Tracking Status
firefox-esr68 --- unaffected
firefox-esr78 --- unaffected
firefox78 --- unaffected
firefox79 --- fixed
firefox80 --- fixed

People

(Reporter: fluffyemily, Assigned: imanol)

References

(Depends on 1 open bug, Regression)

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

This was presumed fixed a year ago under bug 1529697 but we've seen an uptick of recurrences recently.

This bug is for crash report bp-8684b10f-6107-428a-8196-914bf0200530.

Top 10 frames of crashing thread:

0 libxul.so mozilla::gl::SharedSurface_SurfaceTexture::LockProdImpl gfx/gl/SharedSurfaceEGL.cpp:218
1 libxul.so mozilla::gl::GLContext::Readback gfx/gl/GLContext.cpp:2250
2 libxul.so mozilla::layers::CopyableCanvasRenderer::ReadbackSurface gfx/layers/CopyableCanvasRenderer.cpp:154
3 libxul.so mozilla::layers::BasicCanvasLayer::Paint gfx/layers/basic/BasicCanvasLayer.cpp:41
4 libxul.so mozilla::layers::BasicLayerManager::PaintSelfOrChildren gfx/layers/basic/BasicLayerManager.cpp:703
5 libxul.so mozilla::layers::BasicLayerManager::PaintLayer gfx/layers/basic/BasicLayerManager.cpp
6 libxul.so mozilla::layers::BasicLayerManager::PaintSelfOrChildren gfx/layers/basic/BasicLayerManager.cpp:723
7 libxul.so mozilla::layers::BasicLayerManager::PaintLayer gfx/layers/basic/BasicLayerManager.cpp
8 libxul.so mozilla::layers::BasicLayerManager::EndTransactionInternal gfx/layers/basic/BasicLayerManager.cpp:609
9 libxul.so mozilla::FrameLayerBuilder::PaintItems gfx/layers/basic/BasicLayerManager.cpp:540
Component: General → Graphics
Product: GeckoView → Core

I take a look.

Assignee: nobody → sotaro.ikeda.g
Severity: -- → S3
  • WaitForBufferOwnership() must be called before locking the front buffer
  • Use mDefaultFB->mFB instead of 0 to fix a freeze in the readPixels call
  • SurfaceTexture.releaseTexImage must be called after each use

The original URL is not reliable to reproduce the issue. I think is caused by an ad that is not always present.

The problem is related to using a WebGL canvas with a CSS filter.

I created a better URL to reproduce the issue (grayscale filter): https://mortimergoro.github.io/webvr.info/samples/filter.html

Pushed by igorostizaga@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/7ba2f2cf6bde
Fix SurfaceTexture assertion failure in WebGLContext::GetFrontBuffer r=jgilbert
Assignee: sotaro.ikeda.g → imanol
Status: NEW → RESOLVED
Closed: 1 month ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla80

Comment on attachment 9162534 [details]
Bug 1642994 - Fix SurfaceTexture assertion failure in WebGLContext::GetFrontBuffer

Beta/Release Uplift Approval Request

  • User impact if declined: This fixes an issue where webgl canvas used with css filters on android can cause a content process crash. This patterns seems to be used in some ads and can thus affect popular sites that run this style of advertisement.
  • Is this code covered by automated tests?: Unknown
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): This patch ensures the resource is available before attempting to request it thus preventing a release assert.
  • String changes made/needed: none
Attachment #9162534 - Flags: approval-mozilla-beta?

Comment on attachment 9162534 [details]
Bug 1642994 - Fix SurfaceTexture assertion failure in WebGLContext::GetFrontBuffer

Approved for 79.0b7.

Attachment #9162534 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Depends on: 1654475
You need to log in before you can comment on or make changes to this bug.