Crash in OpenGL when switching or closing tabs

RESOLVED DUPLICATE of bug 696768

Status

()

--
critical
RESOLVED DUPLICATE of bug 696768
7 years ago
7 years ago

People

(Reporter: joe, Assigned: ajuma)

Tracking

({crash})

Trunk
ARM
Android
crash
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [mobile-crash], crash signature)

(Reporter)

Description

7 years ago
Fennec crashes on my Nexus S whenever I switch tabs or close tabs with GLES layers enabled. Looks like a null pointer dereference.

I imagine most of the crashes in Fennec at that address are me using Fennec nightlies.
(Reporter)

Comment 1

7 years ago
bp-d34c58fa-0084-4ea5-82e0-8566c2111017 is the most recent example of this crash.

Updated

7 years ago
Blocks: 607684
Severity: normal → critical
Keywords: crash
Whiteboard: [mobile-crash]
(Assignee)

Comment 2

7 years ago
This happens in the Sept. 8 nightly (and onwards) but not in the Sept. 7 nightly. Also, this doesn't happen with debug builds, and doesn't happen on the Galaxy Tab.
Keywords: regression
(Assignee)

Comment 3

7 years ago
Correction: this does indeed happen in the Sept. 7 nightly. In fact, this happens at least as far back as the March 1 nightly.
Assignee: nobody → ajuma
Keywords: regression

Updated

7 years ago
Blocks: 623493
(Assignee)

Comment 4

7 years ago
This crash is happening inside the call to fTexSubImage2D made by TextureImageEGL::EndUpdate. This crash only happens when the currently bound framebuffer is non-zero.

Interestingly, simply adding a call to fCheckFramebufferStatus (but doing nothing with the return value) right before the call to fTexSubImage2D prevents the crash.

So why aren't we seeing this crash in debug builds? In debug builds, LayerManagerOGL::CreateFBOWithTexture makes a call to fCheckFramebufferStatus. Making this call also happen in non-debug builds also turns out to be sufficient for preventing the crash.

The currently bound framebuffer shouldn't have any effect on a call to fTexSubImage2D, nor should calls to fCheckFramebufferStatus have any effects on subsequent calls to fTexSubImage2D, so we seem to be hitting a driver bug.
Status: NEW → ASSIGNED
Pasting in the Crashing Thread:
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	libGLESv2_POWERVR_SGX540_120.so 	libGLESv2_POWERVR_SGX540_120.so@0xe854 	
1 	libGLESv2_POWERVR_SGX540_120.so 	libGLESv2_POWERVR_SGX540_120.so@0x1d53b 	
2 	libGLESv2_POWERVR_SGX540_120.so 	libGLESv2_POWERVR_SGX540_120.so@0x1fd37 	
3 	libGLESv2_POWERVR_SGX540_120.so 	libGLESv2_POWERVR_SGX540_120.so@0x4338b 	
4 	libGLESv2_POWERVR_SGX540_120.so 	libGLESv2_POWERVR_SGX540_120.so@0x4338b 	
5 	libGLESv2_POWERVR_SGX540_120.so 	libGLESv2_POWERVR_SGX540_120.so@0x4338b 	
6 	dalvik-heap (deleted) 	dalvik-heap @0x356fff 	
7 	dalvik-heap (deleted) 	dalvik-heap @0x556fff 	
8 	dalvik-heap (deleted) 	dalvik-heap @0x59efff 	
9 	dalvik-heap (deleted) 	dalvik-heap @0x502fff 	
10 	dalvik-heap (deleted) 	dalvik-heap @0x366fff 	
11 	dalvik-heap (deleted) 	dalvik-heap @0x55afff 	
12 	dalvik-heap (deleted) 	dalvik-heap @0x596fff 	
13 	dalvik-heap (deleted) 	dalvik-heap @0x4fafff

Updated

7 years ago
Depends on: 696768

Updated

7 years ago
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 696768

Updated

7 years ago
No longer depends on: 696768
You need to log in before you can comment on or make changes to this bug.