If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

CGL context creation crashes on Mac Tryserver

RESOLVED FIXED in mozilla2.0b7

Status

()

Core
Graphics
--
critical
RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: bjacob, Assigned: bjacob)

Tracking

Trunk
mozilla2.0b7
Points:
---

Firefox Tracking Flags

(blocking2.0 beta7+)

Details

Attachments

(2 attachments)

This comes from bug 582053, where I've done a tryserver run with the WebGL mochitest enabled on native OpenGL.

I'm getting a crash on Mac:
  http://tinderbox.mozilla.org/showlog.cgi?log=MozillaTry/1284130180.1284130571.16454.gz

Here are the last lines of output before the crash:

34282 INFO TEST-START |
/tests/content/canvas/test/webgl/test_webgl_conformance_test_suite.html
colorbits: 24 alpha: 8 depth: 16 stencil: 0
2010-09-10 07:55:31.396 firefox-bin[442:903] invalid pixel format
2010-09-10 07:55:31.396 firefox-bin[442:903] invalid context
TEST-UNEXPECTED-FAIL |
/tests/content/canvas/test/webgl/test_webgl_conformance_test_suite.html |
Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:04:14.276568
INFO | automation.py | Reading PID log:
/var/folders/H5/H5TD8hgwEqKq9hgKlayjWU+++TM/-Tmp-/tmpguBCIwpidlog
PROCESS-CRASH |
/tests/content/canvas/test/webgl/test_webgl_conformance_test_suite.html |
application crashed (minidump found)


Here's the relevant crash info:

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x1f

Thread 0 (crashed)
 0  XUL!mozilla::gl::GLContextProviderCGL::GetGlobalContext
[GLContext.h:c7ab78580846 : 407 + 0x0]
    rbx = 0x00000000   r12 = 0x00000000   r13 = 0x5fbfa460   r14 = 0x1ecba670
    r15 = 0x5fbfa530   rip = 0x00db165e   rsp = 0x5fbfa3a0   rbp = 0x00000000
 1  XUL!mozilla::gl::CreateOffscreenFBOContext
[GLContextProviderCGL.mm:c7ab78580846 : 326 + 0x4]
    rbx = 0x00000001   r12 = 0x00000000   r13 = 0x5fbfa460   r14 = 0x1ecba670
    r15 = 0x5fbfa530   rip = 0x00db1449   rsp = 0x5fbfa400   rbp = 0x5fbfa4e0
 2  XUL!mozilla::gl::GLContextProviderCGL::CreateOffscreen
[GLContextProviderCGL.mm:c7ab78580846 : 483 + 0x11]
    rbx = 0x00000000   r12 = 0x00000000   r13 = 0x5fbfa460   r14 = 0x1ecba670
    r15 = 0x5fbfa530   rip = 0x00db2149   rsp = 0x5fbfa440   rbp = 0x5fbfa4e0
 3  XUL!mozilla::WebGLContext::SetDimensions [WebGLContext.cpp:c7ab78580846 :
342 + 0xc]
    rbx = 0x1ece6570   r12 = 0x0000012c   r13 = 0x00000096   r14 = 0x1ecba670
    r15 = 0x5fbfa530   rip = 0x00443d87   rsp = 0x5fbfa4e0   rbp = 0x80004005
 4  XUL!nsHTMLCanvasElement::GetContext [nsHTMLCanvasElement.cpp:c7ab78580846 :
449 + 0xc]
    rbx = 0x1ece6578   r12 = 0x004456c0   r13 = 0x5fbfa640   r14 = 0x1ecba670
    r15 = 0x5fbfa670   rip = 0x004a2c72   rsp = 0x5fbfa590   rbp = 0x1ecba5f0


So there are a few questions:
 - where do these messages, "invalid pixel format" and "invalid context" come
from?
 - why are we still continuing doing GL stuff after such messages have been
printed?
 - why are we jumping to bogus address 0x1F ?
(Assignee)

Updated

7 years ago
Blocks: 582053
Severity: normal → critical
(Assignee)

Comment 1

7 years ago
Ah, "good news", it also crashes on the Mac debug build:
http://tinderbox.mozilla.org/showlog.cgi?log=MozillaTry/1284131034.1284131928.22378.gz&fulltext=1#err1

Interesting part:

34287 INFO TEST-START | /tests/content/canvas/test/webgl/test_webgl_conformance_test_suite.html
--DOMWINDOW == 20 (0x11f6060c8) [serial = 737] [outer = 0x1159f1c60] [url = http://mochi.test:8888/tests/content/canvas/test/test_canvas_font_setter.html]
--DOMWINDOW == 19 (0x126faf468) [serial = 732] [outer = 0x1159f1c60] [url = http://mochi.test:8888/tests/content/canvas/test/test_2d.gradient.radial.outside2.html]
--DOMWINDOW == 18 (0x11c3f2628) [serial = 735] [outer = 0x1159f1c60] [url = http://mochi.test:8888/tests/content/canvas/test/test_2d.path.rect.selfintersect.html]
--DOMWINDOW == 17 (0x11b355a98) [serial = 734] [outer = 0x1159f1c60] [url = http://mochi.test:8888/tests/content/canvas/test/test_2d.path.arc.shape.3.html]
--DOMWINDOW == 16 (0x11c5cc7c8) [serial = 733] [outer = 0x1159f1c60] [url = http://mochi.test:8888/tests/content/canvas/test/test_2d.gradient.radial.outside3.html]
++DOMWINDOW == 17 (0x121239bb8) [serial = 739] [outer = 0x1159f1c60]
++DOCSHELL 0x11b1c53c0 == 9
++DOMWINDOW == 18 (0x11ef65c58) [serial = 740] [outer = 0x0]
WARNING: NS_ENSURE_TRUE(shell) failed: file /builds/slave/tryserver-macosx64-debug/build/docshell/base/nsDocShell.cpp, line 10596
WARNING: NS_ENSURE_TRUE(sf) failed: file /builds/slave/tryserver-macosx64-debug/build/docshell/base/nsDocShell.cpp, line 4913
WARNING: NS_ENSURE_TRUE(shell) failed: file /builds/slave/tryserver-macosx64-debug/build/docshell/base/nsDocShell.cpp, line 10596
WARNING: NS_ENSURE_TRUE(sf) failed: file /builds/slave/tryserver-macosx64-debug/build/docshell/base/nsDocShell.cpp, line 4913
WARNING: Context has no global.: file /builds/slave/tryserver-macosx64-debug/build/dom/base/nsJSEnvironment.cpp, line 2444
WARNING: Context has no global.: file /builds/slave/tryserver-macosx64-debug/build/dom/base/nsJSEnvironment.cpp, line 2444
++DOMWINDOW == 19 (0x11c689fc8) [serial = 741] [outer = 0x11ef65bf0]
colorbits: 24 alpha: 8 depth: 16 stencil: 0
2010-09-10 08:18:12.961 firefox-bin[340:903] invalid pixel format
2010-09-10 08:18:12.962 firefox-bin[340:903] invalid context
###!!! ASSERTION: You can't dereference a NULL nsRefPtr with operator->().: 'mRawPtr != 0', file ../../../dist/include/nsAutoPtr.h, line 1117
nsRefPtr<mozilla::gl::GLContext>::operator-> [nsAutoPtr.h:1118]
mozilla::gl::GLContextProviderCGL::GetGlobalContext [gfx/thebes/GLContextProviderCGL.mm:524]
mozilla::gl::GetGlobalContextCGL [gfx/thebes/GLContextProviderCGL.mm:327]
mozilla::gl::CreateOffscreenFBOContext [gfx/thebes/GLContextProviderCGL.mm:449]
mozilla::gl::GLContextProviderCGL::CreateOffscreen [gfx/thebes/GLContextProviderCGL.mm:483]
mozilla::WebGLContext::SetDimensions [content/canvas/src/WebGLContext.cpp:342]
nsHTMLCanvasElement::UpdateContext [content/html/content/src/nsHTMLCanvasElement.cpp:449]
nsHTMLCanvasElement::GetContext [content/html/content/src/nsHTMLCanvasElement.cpp:382]
nsIDOMHTMLCanvasElement_GetContext [dom_quickstubs.cpp:21000]
js::Interpret [js/src/jsinterp.cpp:4696]
js::InvokeCommon<JSBool (*)(JSContext*, JSObject*, uintN, js::Value*, js::Value*)> [js/src/jsinterp.cpp:577]
js::Invoke [js/src/jsinterp.cpp:696]
js::InternalInvoke [js/src/jsinterp.cpp:736]
js::InternalCall [js/src/jsinterp.h:651]
JS_CallFunctionValue [js/src/jsapi.cpp:4874]
nsJSContext::CallEventHandler [dom/base/nsJSEnvironment.cpp:2174]
nsJSEventListener::HandleEvent [dom/src/events/nsJSEventListener.cpp:228]
nsEventListenerManager::HandleEventSubType [content/events/src/nsEventListenerManager.cpp:1112]
nsEventListenerManager::HandleEventInternal [content/events/src/nsEventListenerManager.cpp:1209]
nsEventListenerManager::HandleEvent [content/events/src/nsEventListenerManager.h:146]
nsEventTargetChainItem::HandleEvent [content/events/src/nsEventDispatcher.cpp:213]
nsEventTargetChainItem::HandleEventTargetChain [content/events/src/nsEventDispatcher.cpp:343]
nsEventDispatcher::Dispatch [content/events/src/nsEventDispatcher.cpp:628]
DocumentViewerImpl::LoadComplete [layout/base/nsDocumentViewer.cpp:1033]
nsDocShell::EndPageLoad [docshell/base/nsDocShell.cpp:5996]
nsDocShell::OnStateChange [docshell/base/nsDocShell.cpp:5855]
nsDocLoader::FireOnStateChange [uriloader/base/nsDocLoader.cpp:1318]
nsDocLoader::doStopDocumentLoad [uriloader/base/nsDocLoader.cpp:953]
nsDocLoader::DocLoaderIsEmpty [uriloader/base/nsDocLoader.cpp:820]
nsDocLoader::ChildDoneWithOnload [uriloader/base/nsDocLoader.h:206]
nsDocLoader::DocLoaderIsEmpty [uriloader/base/nsDocLoader.cpp:823]
nsDocLoader::OnStopRequest [uriloader/base/nsDocLoader.cpp:705]
nsLoadGroup::RemoveRequest [netwerk/base/src/nsLoadGroup.cpp:680]
nsDocument::DoUnblockOnload [content/base/src/nsDocument.cpp:7273]
nsDocument::UnblockOnload [content/base/src/nsDocument.cpp:7211]
nsDocument::DispatchContentLoadedEvents [content/base/src/nsDocument.cpp:4190]
nsRunnableMethodImpl<void (nsDocument::*)(),true>::Run [nsThreadUtils.h:348]
nsThread::ProcessNextEvent [xpcom/threads/nsThread.cpp:547]
NS_ProcessPendingEvents_P [nsThreadUtils.cpp:200]
nsBaseAppShell::NativeEventCallback [widget/src/xpwidgets/nsBaseAppShell.cpp:132]
nsAppShell::ProcessGeckoEvents [widget/src/cocoa/nsAppShell.mm:395]
CoreFoundation + 0x4d271
CoreFoundation + 0x4b469
CoreFoundation + 0x4ac2f
HIToolbox + 0x2ea4e
HIToolbox + 0x2e7b1
HIToolbox + 0x2e70c
AppKit + 0x441f2
-AppKit + 0x43b41
-AppKit + 0x9747
nsAppShell::Run [widget/src/cocoa/nsAppShell.mm:747]
nsAppStartup::Run [toolkit/components/startup/src/nsAppStartup.cpp:191]
XRE_main [toolkit/xre/nsAppRunner.cpp:3665]
main [browser/app/nsBrowserApp.cpp:158]
NEXT ERROR TEST-UNEXPECTED-FAIL | /tests/content/canvas/test/webgl/test_webgl_conformance_test_suite.html | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:11:56.122560
INFO | automation.py | Reading PID log: /var/folders/H5/H5TD8hgwEqKq9hgKlayjWU+++TM/-Tmp-/tmp6gxH2cpidlog
PROCESS-CRASH | /tests/content/canvas/test/webgl/test_webgl_conformance_test_suite.html | application crashed (minidump found)
Operating system: Mac OS X
                  10.6.2 10C540
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x1f

Thread 0 (crashed)
 0  XUL!mozilla::gl::GLContext::SetIsGlobalSharedContext [GLContext.h:c7ab78580846 : 407 + 0x9]
    rbx = 0x26f83488   r12 = 0x006f3577   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x016f2898   rsp = 0x5fbf9e80   rbp = 0x5fbf9e80
 1  XUL!mozilla::gl::GLContextProviderCGL::GetGlobalContext [GLContextProviderCGL.mm:c7ab78580846 : 524 + 0x18]
    rbx = 0x26f83488   r12 = 0x006f3577   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x016f19b7   rsp = 0x5fbf9e90   rbp = 0x5fbf9ef0
 2  XUL!mozilla::gl::GetGlobalContextCGL [GLContextProviderCGL.mm:c7ab78580846 : 326 + 0x4]
    rbx = 0x26f83488   r12 = 0x006f3577   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x016f19d6   rsp = 0x5fbf9f00   rbp = 0x5fbf9f00
 3  XUL!mozilla::gl::CreateOffscreenFBOContext [GLContextProviderCGL.mm:c7ab78580846 : 449 + 0xa]
    rbx = 0x26f83488   r12 = 0x006f3577   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x016f169d   rsp = 0x5fbf9f10   rbp = 0x5fbf9fc0
 4  XUL!mozilla::gl::GLContextProviderCGL::CreateOffscreen [GLContextProviderCGL.mm:c7ab78580846 : 483 + 0x11]
    rbx = 0x26f83488   r12 = 0x006f3577   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x016f274a   rsp = 0x5fbf9fd0   rbp = 0x5fbfa070
 5  XUL!mozilla::WebGLContext::SetDimensions [WebGLContext.cpp:c7ab78580846 : 342 + 0x24]
    rbx = 0x26f83488   r12 = 0x006f3577   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x006f16b0   rsp = 0x5fbfa080   rbp = 0x5fbfa150
 6  XUL!nsHTMLCanvasElement::UpdateContext [nsHTMLCanvasElement.cpp:c7ab78580846 : 449 + 0x24]
    rbx = 0x26f83488   r12 = 0x006f3577   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x0077e29b   rsp = 0x5fbfa160   rbp = 0x5fbfa190
 7  XUL!nsHTMLCanvasElement::GetContext [nsHTMLCanvasElement.cpp:c7ab78580846 : 382 + 0x8]
    rbx = 0x5fbfa2b0   r12 = 0x0077e4dc   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x0077e684   rsp = 0x5fbfa1a0   rbp = 0x5fbfa1e0
 8  XUL!nsIDOMHTMLCanvasElement_GetContext [dom_quickstubs.cpp : 21000 + 0x50]
    rbx = 0x5fbfa2b0   r12 = 0x0077e4dc   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x00f109c8   rsp = 0x5fbfa1f0   rbp = 0x5fbfa440
 9  XUL!js::Interpret [jsinterp.cpp:c7ab78580846 : 4696 + 0x20]
    rbx = 0x0000000e   r12 = 0x0c1b52c8   r13 = 0x159f1f00   r14 = 0x00921836
    r15 = 0x5fbfbdf0   rip = 0x0182c81c   rsp = 0x5fbfa450   rbp = 0x5fbfb780
(Assignee)

Comment 2

7 years ago
So the interesting part was:

###!!! ASSERTION: You can't dereference a NULL nsRefPtr with operator->().:
'mRawPtr != 0', file ../../../dist/include/nsAutoPtr.h, line 1117
nsRefPtr<mozilla::gl::GLContext>::operator-> [nsAutoPtr.h:1118]
mozilla::gl::GLContextProviderCGL::GetGlobalContext
[gfx/thebes/GLContextProviderCGL.mm:524]

The code at GLContextProviderCGL.mm:524 is:

        gGlobalContext->SetIsGlobalSharedContext(PR_TRUE);

So the problem is that gGlobalContext is unexpectedly null.
Yeah, you're derefing a NULL pointer here:
http://mxr.mozilla.org/mozilla-central/source/gfx/thebes/GLContext.h#407
(0x1F is just the offset to that member variable)

Probably because you don't NULL check here:
http://mxr.mozilla.org/mozilla-central/source/gfx/thebes/GLContextProviderCGL.mm#515
(Assignee)

Comment 4

7 years ago
Created attachment 474065 [details] [diff] [review]
Fix CGL crash with null gGlobalContext

Yes, indeed, here's a 1-liner.
Assignee: nobody → bjacob
Status: NEW → ASSIGNED
Attachment #474065 - Flags: review+
(Assignee)

Updated

7 years ago
blocking2.0: --- → ?
blocking2.0: ? → beta6+
(Assignee)

Comment 5

7 years ago
Created attachment 474082 [details] [diff] [review]
patch ready to import

That's ready to be committed...
(Assignee)

Comment 6

7 years ago
http://hg.mozilla.org/mozilla-central/rev/0dec15896c45
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla2.0b6
You need to log in before you can comment on or make changes to this bug.