619934 - startup crash [@ mozilla::gl::GLContext::UploadSurfaceToTexture(gfxASurface*, nsIntRect const&, unsigned int&, bool, nsIntPoint const&, bool) ] [@ mozilla::gl::GLContext::UploadSurfaceToTexture ]

Status: VERIFIED FIXED

(Core :: Graphics, defect)

Description

[Scoobidiver (away)]

It is a new crash signature that appeared in 4.0b8pre/20101217.

Signature	mozilla::gl::GLContext::UploadSurfaceToTexture(gfxASurface*, nsIntRect const&, unsigned int&, bool, nsIntPoint const&, bool)
UUID	6bc05861-a9b3-4132-bcd4-5d9752101217
Time 	2010-12-17 07:05:53.700208
Uptime	3
Last Crash	6 seconds before submission
Install Age	8 seconds since version was first installed.
Product	Firefox
Version	4.0b9pre
Build ID	20101217030324
Branch	2.0
OS	Windows NT
OS Version	6.1.7600
CPU	x86
CPU Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x20
App Notes 	AdapterVendorID: 10de, AdapterDeviceID: 0614
MSAFD Tcpip [TCP/IP] : 2 : 1 :
MSAFD Tcpip [UDP/IP] : 2 : 2 : %SystemRoot%\system32\mswsock.dll
MSAFD Tcpip [RAW/IP] : 2 : 3 :
MSAFD Tcpip [TCP/IPv6] : 2 : 1 : %SystemRoot%\system32\mswsock.dll
MSAFD Tcpip [UDP/IPv6] : 2 : 2 :
MSAFD Tcpip [RAW/IPv6] : 2 : 3 : %SystemRoot%\system32\mswsock.dll
Поставщик услуг RSVP TCPv6 : 2 : 1 :
Поставщик услуг RSVP TCP : 2 : 1 : %SystemRoot%\system32\mswsock.dll
Поставщик услуг RSVP UDPv6 : 2 : 2 :
Поставщик услуг RSVP UDP : 2 : 2 : %SystemRoot%\system32\mswsock.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip_{52F74D85-D93C-4EED-BD9E-6612FAC50C17}] SEQPACKET 1 : 2 : 5 :
MSAFD NetBIOS [\Device\NetBT_Tcpip_{52F74D85-D93C-4EED-BD9E-6612FAC50C17}] DATAGRAM 1 : 2 : 2 : %SystemRoot%\system32\mswsock.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{433E8E17-4EB9-4832-9989-C86BDC87AE14}] SEQPACKET 11 : 2 : 5 :
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{433E8E17-4EB9-4832-9989-C86BDC87AE14}] DATAGRAM 11 :

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	mozilla::gl::GLContext::UploadSurfaceToTexture 	gfx/thebes/GLContext.cpp:1296
1 	xul.dll 	mozilla::gl::BasicTextureImage::EndUpdate 	gfx/thebes/GLContext.cpp:621
2 	xul.dll 	mozilla::layers::ThebesLayerBufferOGL::RenderTo 	gfx/layers/opengl/ThebesLayerOGL.cpp:186
3 	xul.dll 	mozilla::layers::ThebesLayerOGL::RenderLayer 	gfx/layers/opengl/ThebesLayerOGL.cpp:563
4 	xul.dll 	mozilla::layers::ContainerRender<mozilla::layers::ContainerLayerOGL> 	gfx/layers/opengl/ContainerLayerOGL.cpp:236
5 	xul.dll 	mozilla::layers::ContainerLayerOGL::RenderLayer 	gfx/layers/opengl/ContainerLayerOGL.cpp:328
6 	xul.dll 	mozilla::layers::LayerManagerOGL::Render 	gfx/layers/opengl/LayerManagerOGL.cpp:600
7 	xul.dll 	mozilla::layers::LayerManagerOGL::EndTransaction 	gfx/layers/opengl/LayerManagerOGL.cpp:418
8 	xul.dll 	nsDisplayList::PaintForFrame 	layout/base/nsDisplayList.cpp:477
9 	xul.dll 	nsLayoutUtils::PaintFrame 	layout/base/nsLayoutUtils.cpp:1433
10 	xul.dll 	PresShell::Paint 	layout/base/nsPresShell.cpp:6093
11 	xul.dll 	nsViewManager::RenderViews 	view/src/nsViewManager.cpp:447
12 	xul.dll 	nsViewManager::Refresh 	view/src/nsViewManager.cpp:413
13 	xul.dll 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:912
14 	xul.dll 	AttachedHandleEvent 	view/src/nsView.cpp:193
15 	xul.dll 	nsWindow::DispatchEvent 	widget/src/windows/nsWindow.cpp:3620
16 	xul.dll 	nsWindow::DispatchWindowEvent 	widget/src/windows/nsWindow.cpp:3648
17 	xul.dll 	nsWindow::OnPaint 	
18 	mozjs.dll 	StopRequest 	js/src/jsapi.cpp:875
19 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1931
20 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1932

The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a5413c3c1013&tochange=d1da1005b6d6

More reports at:
http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=mozilla%3A%3Agl%3A%3AGLContext%3A%3AUploadSurfaceToTexture%28gfxASurface*%2C%20nsIntRect%20const%26%2C%20unsigned%20int%26%2C%20bool%2C%20nsIntPoint%20const%26%2C%20bool%29
http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=mozilla%3A%3Agl%3A%3AGLContext%3A%3AUploadSurfaceToTexture%28gfxASurface*%2C%20nsIntRect%20const%26%2C%20unsigned%20int%26%2C%20bool%2C%20nsIntPoint%20const%26%2C%20bool%29

Comment 1

[Jeff Muizelaar [:jrmuizel]]

Looks like we're not checking the return value of GetAsImageSurface() when we should be.

Comment 2

[Matt Woodrow (:mattwoodrow)]

Attachment: Don't read imageSurface data until we are sure it's valid

Probably don't need to block on this as such since it will only occur on windows with OpenGL enabled (not a supported configuration).

Comment 3

[Jeff Muizelaar [:jrmuizel]]

You can do a=jrmuizel if you want. I'm sure joe will approve this.

Comment 4

[Benoit Jacob [:bjacob] (mostly away)]

I get this crash too, on linux x86-64.

Comment 5

[Benoit Jacob [:bjacob] (mostly away)]

This currently shows up in 8th position on the home page of http://crash-stats.mozilla.com . All the crashes I see there are on Linux.

http://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&signature=mozilla%3A%3Agl%3A%3AGLContext%3A%3AUploadSurfaceToTexture&version=Firefox%3A4.0b9pre

Comment 6

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: stack trace with XPCOM_DEBUG_BREAK=abort

Comment 7

[Joe Drew (not getting mail)]

Comment on attachment 498487 [details] [diff] [review]
Don't read imageSurface data until we are sure it's valid

jeff was right!

Comment 8

[Jeff Muizelaar [:jrmuizel]]

http://hg.mozilla.org/mozilla-central/rev/be8006fc9c4a

Comment 9

[Marcia Knous [:marcia]]

No crashes seen in crash stats since 20101218030347 build, verifying fixed.