708019 - Firefox Crash [@ gl::Context::clear(unsigned int) ]

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect)

Description

[Marcia Knous [:marcia]]

Seen while running the WebGL Conformance suite running  Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0) Gecko/20100101 Firefox/9.0 (Beta 3 build).

STR:

1. Run https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/tests/conformance/misc/object-deletion-behaviour.html
2. Crash

https://crash-stats.mozilla.com/report/index/bp-3279784d-6fab-4587-ba78-ec70c2111206

Frame 	Module 	Signature [Expand] 	Source
0 		@0x30004000 	
1 	libGLESv2.dll 	gl::Context::clear 	gfx/angle/src/libglesv2/Context.cpp:2399
2 	libGLESv2.dll 	glClear 	gfx/angle/src/libglesv2/libGLESv2.cpp:637
3 	xul.dll 	mozilla::WebGLContext::Clear 	content/canvas/src/WebGLContextGL.cpp:682
4 	xul.dll 	nsIDOMWebGLRenderingContext_Clear 	obj-firefox/js/src/xpconnect/src/dom_quickstubs.cpp:29588
5 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:660
6 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4036
7 	mozjs.dll 	js::ContextStack::pushExecuteFrame 	js/src/vm/Stack.cpp:739
8 	mozjs.dll 	js::ExecuteKernel 	js/src/jsinterp.cpp:814
9 	mozjs.dll 	js::GetBlockChainFast 	js/src/jsinterp.cpp:217
10 	mozjs.dll 	js::DirectEval 	js/src/jsobj.cpp:1346
11 	mozjs.dll 	js::mjit::stubs::Eval 	js/src/methodjit/InvokeHelpers.cpp:460
12 	mozjs.dll 	js::ContextStack::currentScript 	js/src/vm/Stack-inl.h:647
13 	mozjs.dll 	js::mjit::EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:884
14 	mozjs.dll 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:962
15 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4075
16 	mozjs.dll 	js::types::TypeScript::SetThis 	js/src/jsinferinlines.h:624
17 	mozjs.dll 	js::ExecuteKernel 	js/src/jsinterp.cpp:814
18 	mozjs.dll 	js::Execute 	js/src/jsinterp.cpp:853
19 	mozjs.dll 	EvaluateUCScriptForPrincipalsCommon 	js/src/jsapi.cpp:4933
20 	mozjs.dll 	JS_EvaluateUCScriptForPrincipalsVersion 	js/src/jsapi.cpp:4945
21 	xul.dll 	nsJSContext::EvaluateString 	dom/base/nsJSEnvironment.cpp:1476
22 	xul.dll 	nsScriptLoader::EvaluateScript 	content/base/src/nsScriptLoader.cpp:906
23 	xul.dll 	nsScriptLoader::ProcessRequest 	content/base/src/nsScriptLoader.cpp:799
24 	xul.dll 	nsScriptLoader::ProcessScriptElement 	content/base/src/nsScriptLoader.cpp:745
25 	xul.dll 	nsScriptElement::MaybeProcessScript 	content/base/src/nsScriptElement.cpp:182
26 	xul.dll 	nsHTMLScriptElement::MaybeProcessScript 	content/html/content/src/nsHTMLScriptElement.cpp:333
27 	xul.dll 	nsHTMLScriptElement::DoneAddingChildren 	content/html/content/src/nsHTMLScriptElement.cpp:260
28 	xul.dll 	nsHtml5TreeOpExecutor::RunScript 	parser/html/nsHtml5TreeOpExecutor.cpp:736
29 	xul.dll 	nsHtml5TreeOpExecutor::RunFlushLoop 	parser/html/nsHtml5TreeOpExecutor.cpp:531
30 	xul.dll 	xul.dll@0xe9894f 	
31 	xul.dll 	nsHtml5ExecutorFlusher::Run 	parser/html/nsHtml5StreamParser.cpp:156
32 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
33 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:134
34 	xul.dll 	xul.dll@0xbc03bf 	
35 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:201
36 	xul.dll 	_SEH_epilog4 	
37 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:175
38 	xul.dll 	nsStyleDisplay::CalcDifference 	layout/style/nsStyleStruct.cpp:2242
39 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:189
40 	xul.dll 	nsAppShell::Run 	widget/src/windows/nsAppShell.cpp:261
41 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:228
42 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3557
43 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:107
44 	firefox.exe 	firefox.exe@0x4033 	
45 	firefox.exe 	__tmainCRTStartup 	crtexe.c:594
46 	firefox.exe 	_SEH_epilog4 	
47 	kernel32.dll 	BaseThreadInitThunk 	
48 	ntdll.dll 	__RtlUserThreadStart 	
49 	kernel32.dll 	LoadStringByReference 	
50 	kernel32.dll 	LoadStringByReference

Comment 1

[Marcia Knous [:marcia]]

conformance/misc/object-deletion-behaviour.html is the test that is crashing on FF 9 Beta3 but I am not able to replicate the crash using Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:11.0a1) Gecko/20111206 Firefox/11.0a1.

Comment 2

[Marcia Knous [:marcia]]

This crashes using the Firefox 9 Beta 4 candidate build as well.

Comment 3

[Joe Drew (not getting mail)]

Another conformance crash :(

Comment 4

[Benoit Jacob [:bjacob] (mostly away)]

This is a ANGLE bug. As confirmed by comment 1, it's no longer hit by Firefox 11 since bug 704839 landed.

It would be nice to report it to ANGLE developers... CC'ing Daniel.

99% certainty that the bug is that the test is deleting some texture or renderbuffer used by current framebuffer, so it should stay alive as long as it's bound, the test then clears the framebuffer, that should work, but ANGLE gets it wrong and prematurely frees resources

Comment 5

[daniel-bzmz]

Please file ANGLE bugs in the ANGLE issue tracker: https://code.google.com/p/angleproject/issues/list
along with which version of ANGLE is affected.

Comment 6

[Benoit Jacob [:bjacob] (mostly away)]

Filed https://code.google.com/p/angleproject/issues/detail?id=271

Comment 7

[Benoit Jacob [:bjacob] (mostly away)]

Also, it's fixed on our side, though Firefox <= 10 is affected.

Comment 8

[Alex Keybl [:akeybl]]

I'm seeing a very low crash rate on FF9, so I don't believe it's necessary to track for 9/10.

Comment 9

[daniel-bzmz]

Fixed the underlying ANGLE issue in ANGLE r947/948, in case you want to consider picking it up for FF9 or 10.