571061 - crash [@ mozilla::WebGLContext::ReadPixels(int, int, int, int, unsigned int, unsigned int) ]

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect)

Description

[Mickael Medel (:aSydiK)]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.3) Gecko/20100423 Ubuntu/10.04 (lucid) Firefox/3.6.3
Build Identifier: 

Background details:  I'm trying to readPixels off an invisible (back-buffer) 3D canvas and draw it on an invisible (back-buffer) 2D canvas (red - for differentiation).  I use the said 2D canvas (red) and draw it on a rendered 2D canvas (green).

Doing this, crashes the browser.  I was getting security errors a little while back... but now it's just a crash.  The crash reports are attached in the additional info.

Reproducible: Always

Steps to Reproduce:
1. Open site attached
2. Wait a few seconds
3. Crash
Actual Results:  
Crashed

Expected Results:  
Rendered a 2D canvas with a green background and a 3D canvas with a red background and moving objects drawn in the 2D one.

Crash report on Windows: http://crash-stats.mozilla.com/report/index/bp-062d0f27-de3b-46d4-94bf-f743e2100609
Crash report on Linux (less useful as there's no stack): http://crash-stats.mozilla.com/report/index/96ca8c2d-0a82-4bbc-8cae-726832100609

Comment 1

[David Humphrey (:humph)]

Crash on Mac, too:

http://crash-stats.mozilla.com/report/index/bp-7f780675-7b35-48cb-968b-f2aca2100609

Comment 2

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

That's weird, I can't reproduce this crash in either a debug or regular build (on win32)...

Comment 3

[David Humphrey (:humph)]

Takes me upwards of 30 seconds for it to happen, never happens right away.

Comment 4

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Yeah, no go, been running for 5-10 min now...

Comment 5

[Mickael Medel (:aSydiK)]

I was able to reproduce it 4 times now on Windows... though there was a new development... it would only first crash if I brought up the error console (so I could check on the problems)... after the first crash, just bringing up the page would crash it again.  Won't include the crash reports as they look the same as the first one.

Comment 6

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

So the only thing I can think of is that the canvas element is null; can I get you to get it in a debugger (WinDbg is fine) and look at the value of mCanvasElement at the crash?  (Should be able to pull in symbols via the mozilla symbol server.)

Comment 7

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Can someone who sees this get a full minidump?  That would probably help a lot.

Comment 8

[David Humphrey (:humph)]

I've got a browser with symbols and am trying to get this via gdb, but I can no longer reproduce this with the current page at the URL listed.  Mickael, did you update the page at the URL above?  When it crashed for me previously, I only saw 1 canvas, now I see 3.

Comment 9

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

I only ever saw 3.  Were the others perhaps doing multiple getContext() calls on the same canvas?  I can think of that causing the problem described here.

Comment 10

[Mickael Medel (:aSydiK)]

Ugh... no wonder... wrong link... sorry.

Comment 11

[Mickael Medel (:aSydiK)]

Changed to proper link.

Comment 12

[Benoit Jacob [:bjacob] (mostly away)]

ReadPixels has just been rewritten (landed 2 days ago). I've tried your URL today and it's not crashing Minefield. Can you retry and confirm?

Comment 13

[Mickael Medel (:aSydiK)]

Sorry for the late reply.  Just checked my page and Minefield isn't crashing... awesome!

Comment 14

[Benoit Jacob [:bjacob] (mostly away)]

great, thanks for confirming.