708136 - Firefox 11.0a1 Crash [@ mozilla::gl::GLContext::DeleteOffscreenFBO ]

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect)

Description

[Marcia Knous [:marcia]]

Seen while running trunk.

STR:

1. Load the WebGL Conformance Suite page.
2. Crash.

https://crash-stats.mozilla.com/report/index/bp-05dffd93-21e0-419d-b143-25b042111206

Frame 	Module 	Signature [Expand] 	Source
0 		@0xe34f8bc0 	
1 	libxul.so 	mozilla::gl::GLContext::DeleteOffscreenFBO 	gfx/gl/GLContext.h:2545
2 	libxul.so 	mozilla::gl::GLContext::MarkDestroyed 	gfx/gl/GLContext.cpp:1521
3 	libxul.so 	mozilla::gl::GLContextGLX::~GLContextGLX 	gfx/gl/GLContextProviderGLX.cpp:750
4 	libxul.so 	mozilla::gl::GLContextGLX::~GLContextGLX 	gfx/gl/GLContextProviderGLX.cpp:765
5 	libxul.so 	mozilla::gl::GLContext::Release 	GLContext.h:530
6 	libxul.so 	mozilla::gl::GLContextGLX::CreateGLContext 	nsAutoPtr.h:963
7 	libxul.so 	mozilla::gl::CreateOffscreenPixmapContext 	gfx/gl/GLContextProviderGLX.cpp:1280
8 	libxul.so 	mozilla::gl::GLContextProviderGLX::GetGlobalContext 	gfx/gl/GLContextProviderGLX.cpp:1379
9 	libxul.so 	mozilla::gl::CreateOffscreenPixmapContext 	gfx/gl/GLContextProviderGLX.cpp:1035
10 	libxul.so 	mozilla::gl::GLContextProviderGLX::CreateOffscreen 	gfx/gl/GLContextProviderGLX.cpp:1291
11 	libxul.so 	mozilla::WebGLContext::SetDimensions 	content/canvas/src/WebGLContext.cpp:617
12 	libxul.so 	nsHTMLCanvasElement::UpdateContext 	content/html/content/src/nsHTMLCanvasElement.cpp:622
13 	libxul.so 	nsHTMLCanvasElement::GetContext 	content/html/content/src/nsHTMLCanvasElement.cpp:543
14 	libxul.so 	nsIDOMHTMLCanvasElement_GetContext 	obj-firefox/js/xpconnect/src/dom_quickstubs.cpp:18794
15 	libxul.so 	js::InvokeKernel 	js/src/jscntxtinlines.h:297
16 	libxul.so 	js::Interpret 	js/src/jsinterp.cpp:3461
17 	libxul.so 	js::InvokeKernel 	js/src/jsinterp.cpp:644
18 	libxul.so 	js::Invoke 	js/src/jsinterp.h:148
19 	libxul.so 	JS_CallFunctionValue 	js/src/jsapi.cpp:5181
20 	libxul.so 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:1922
21 	libxul.so 	nsJSEventListener::HandleEvent 	dom/src/events/nsJSEventListener.cpp:209
22 	libxul.so 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:734
23 	libxul.so 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:791
24 	libxul.so 	nsEventTargetChainItem::HandleEvent 	content/events/src/nsEventListenerManager.h:168
25 	libxul.so 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:344
26 	libxul.so 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:677
27 	libxul.so 	DocumentViewerImpl::LoadComplete 	layout/base/nsDocumentViewer.cpp:1049
28 	libxul.so 	nsDocShell::EndPageLoad 	docshell/base/nsDocShell.cpp:6140
29 	libxul.so 	nsDocShell::OnStateChange 	docshell/base/nsDocShell.cpp:5979
30 	libxul.so 	nsDocLoader::DoFireOnStateChange 	uriloader/base/nsDocLoader.cpp:1383
31 	libxul.so 	nsDocLoader::doStopDocumentLoad 	uriloader/base/nsDocLoader.cpp:963
32 	libxul.so 	nsDocLoader::DocLoaderIsEmpty 	uriloader/base/nsDocLoader.cpp:852
33 	libxul.so 	nsDocLoader::DocLoaderIsEmpty 	uriloader/base/nsDocLoader.cpp:855
34 	libxul.so 	nsDocLoader::OnStopRequest 	uriloader/base/nsDocLoader.cpp:736
35 	libxul.so 	nsLoadGroup::RemoveRequest 	netwerk/base/src/nsLoadGroup.cpp:731
36 	libxul.so 	nsDocument::DoUnblockOnload 	content/base/src/nsDocument.cpp:7178
37 	libxul.so 	nsBindingManager::DoProcessAttachedQueue 	content/xbl/src/nsBindingManager.cpp:1029
38 	libxul.so 	nsRunnableMethodImpl<void , true>::Run 	nsThreadUtils.h:345
39 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:625
40 	libxul.so 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:245
41 	libxul.so 	nsXULWindow::ShowModal 	xpfe/appshell/src/nsXULWindow.cpp:420
42 	libxul.so 	nsContentTreeOwner::ShowAsModal 	xpfe/appshell/src/nsContentTreeOwner.cpp:564
43 	libxul.so 	nsWindowWatcher::OpenWindowJSInternal 	embedding/components/windowwatcher/src/nsWindowWatcher.cpp:1023
44 	libxul.so 	nsWindowWatcher::OpenWindow 	embedding/components/windowwatcher/src/nsWindowWatcher.cpp:414
45 	libxul.so 	libxul.so@0xf397db 	
46 	libxul.so 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:2929
47 	libxul.so 	XPC_WN_CallMethod 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1554
48 	libxul.so 	js::InvokeKernel 	js/src/jscntxtinlines.h:297
49 	libxul.so 	js::Interpret 	js/src/jsinterp.cpp:3461
50 	libxul.so 	js::InvokeKernel 	js/src/jsinterp.cpp:644
51 	libxul.so 	js::Invoke 	js/src/jsinterp.h:148
52 	libxul.so 	JS_CallFunctionValue 	js/src/jsapi.cpp:5181
53 	libxul.so 	nsXPCWrappedJSClass::CallMethod 	js/xpconnect/src/XPCWrappedJSClass.cpp:1530
54 	libxul.so 	nsXPCWrappedJS::CallMethod 	js/xpconnect/src/XPCWrappedJS.cpp:611
55 	libxul.so 	PrepareAndDispatch 	xptcstubs_gcc_x86_unix.cpp:92
56 	libxul.so 	nsAsyncAlert::Run 	security/manager/boot/src/nsSecurityWarningDialogs.cpp:208
57 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:625
58 	libxul.so 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:245
59 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
60 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:208
61 	libxul.so 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:189
62 	libxul.so 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:220
63 	libxul.so 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3561
64 	firefox 	main 	browser/app/nsBrowserApp.cpp:201
65 	libc-2.9.so 	libc-2.9.so@0x16774 	
66 	firefox 	firefox@0x14d0 	
67 	firefox 	firefox@0x15ff 	
68 	ld-2.9.so 	ld-2.9.so@0xe7af 	
69 	ld-2.9.so 	ld-2.9.so@0x19d82

Comment 1

[Marcia Knous [:marcia]]

Added the URL. Perhaps this crash is expected since the app notes state: GLXtest process failed (exited with status 1): GLX version older than the required 1.3.

Comment 2

[Joe Drew (not getting mail)]

We shouldn't crash if we can't use GL!

Comment 3

[Kelsey Gilbert [:jgilbert]]

Attachment: Only teardown GL objects if makecurrent succeeds.

I don't know if we can get a repro or fix confirmation here, but this should fix the problem.

According to the report, we're crashing in one of the glDelete*() functions in DeleteOffscreenFBO(). This is called in MarkDestroyed(), where we call MakeCurrent() beforehand. However, MakeCurrent is fallible, and could return false. If it does, we certainly shouldn't try to teardown GL objects on a broken context. Instead, just do normal teardown.

Comment 4

[Kelsey Gilbert [:jgilbert]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2ddc5dea534b

Derp, forgot to add that after pushing.

Comment 5

[(no longer active)]

https://hg.mozilla.org/mozilla-central/rev/2ddc5dea534b