1642994 - Crash in [@ mozilla::gl::SharedSurface_SurfaceTexture::LockProdImpl]

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Emily Toop (:fluffyemily)]

This was presumed fixed a year ago under bug 1529697 but we've seen an uptick of recurrences recently.

This bug is for crash report bp-8684b10f-6107-428a-8196-914bf0200530.

Top 10 frames of crashing thread:

0 libxul.so mozilla::gl::SharedSurface_SurfaceTexture::LockProdImpl gfx/gl/SharedSurfaceEGL.cpp:218
1 libxul.so mozilla::gl::GLContext::Readback gfx/gl/GLContext.cpp:2250
2 libxul.so mozilla::layers::CopyableCanvasRenderer::ReadbackSurface gfx/layers/CopyableCanvasRenderer.cpp:154
3 libxul.so mozilla::layers::BasicCanvasLayer::Paint gfx/layers/basic/BasicCanvasLayer.cpp:41
4 libxul.so mozilla::layers::BasicLayerManager::PaintSelfOrChildren gfx/layers/basic/BasicLayerManager.cpp:703
5 libxul.so mozilla::layers::BasicLayerManager::PaintLayer gfx/layers/basic/BasicLayerManager.cpp
6 libxul.so mozilla::layers::BasicLayerManager::PaintSelfOrChildren gfx/layers/basic/BasicLayerManager.cpp:723
7 libxul.so mozilla::layers::BasicLayerManager::PaintLayer gfx/layers/basic/BasicLayerManager.cpp
8 libxul.so mozilla::layers::BasicLayerManager::EndTransactionInternal gfx/layers/basic/BasicLayerManager.cpp:609
9 libxul.so mozilla::FrameLayerBuilder::PaintItems gfx/layers/basic/BasicLayerManager.cpp:540

Comment 1

[Sotaro Ikeda [:sotaro]]

I take a look.

Comment 2

[Randall Barker [:rbarker]]

Step to reproduce in FxR reported here: https://github.com/MozillaReality/FirefoxReality/issues/3628

Comment 3

[Imanol Fernandez]

Attachment: Bug 1642994 - Fix SurfaceTexture assertion failure in WebGLContext::GetFrontBuffer

• WaitForBufferOwnership() must be called before locking the front buffer
• Use mDefaultFB->mFB instead of 0 to fix a freeze in the readPixels call
• SurfaceTexture.releaseTexImage must be called after each use

Comment 4

[Imanol Fernandez]

The original URL is not reliable to reproduce the issue. I think is caused by an ad that is not always present.

The problem is related to using a WebGL canvas with a CSS filter.

I created a better URL to reproduce the issue (grayscale filter): https://mortimergoro.github.io/webvr.info/samples/filter.html

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7ba2f2cf6bde
Fix SurfaceTexture assertion failure in WebGLContext::GetFrontBuffer r=jgilbert

Comment 6

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/7ba2f2cf6bde

Comment 7

[Randall Barker [:rbarker]]

Comment on attachment 9162534 [details]
Bug 1642994 - Fix SurfaceTexture assertion failure in WebGLContext::GetFrontBuffer

Beta/Release Uplift Approval Request

• User impact if declined: This fixes an issue where webgl canvas used with css filters on android can cause a content process crash. This patterns seems to be used in some ads and can thus affect popular sites that run this style of advertisement.
• Is this code covered by automated tests?: Unknown
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This patch ensures the resource is available before attempting to request it thus preventing a release assert.
• String changes made/needed: none

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9162534 [details]
Bug 1642994 - Fix SurfaceTexture assertion failure in WebGLContext::GetFrontBuffer

Approved for 79.0b7.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/d496ab520df9