Crash @mozilla::gl::GLContext::InitExtensions

RESOLVED FIXED in Firefox 11

Status

()

Core
Graphics
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: glandium, Assigned: glandium)

Tracking

({crash})

Trunk
mozilla13
All
Linux
crash
Points:
---

Firefox Tracking Flags

(firefox10 affected, firefox11 fixed, firefox12 fixed, firefox-esr1011+ verified, status1.9.2 unaffected)

Details

(Whiteboard: [qa!:esr10], crash signature)

Attachments

(1 attachment, 1 obsolete attachment)

I got a couple reports in Debian with the following stack trace:
#0  __strlen_sse2 () at ../sysdeps/x86_64/multiarch/../strlen.S:31
#1  0x00007ffff73c5876 in *__GI___strdup (s=0x0) at strdup.c:42
#2  0x00007ffff5748e96 in mozilla::gl::GLContext::InitExtensions (this=0x7fffc90f7800)
    at /tmp/buildd/iceweasel-9.0.1/gfx/thebes/GLContext.cpp:448
#3  0x00007ffff574a507 in mozilla::gl::GLContext::InitWithPrefix (this=0x7fffc90f7800, prefix=<value optimized out>, 
    trygl=<value optimized out>) at /tmp/buildd/iceweasel-9.0.1/gfx/thebes/GLContext.cpp:374
#4  0x00007ffff5757d72 in mozilla::gl::GLContextGLX::Init (format=<value optimized out>, display=0x7ffff6d96000, 
    drawable=<value optimized out>, cfg=<value optimized out>, vinfo=<value optimized out>, shareContext=0x7fffcaab0800, 
    deleteDrawable=<value optimized out>, pixmap=0x7fffcb5b6d80)
    at /tmp/buildd/iceweasel-9.0.1/gfx/thebes/GLContextProviderGLX.cpp:730

The code looks like this (in that particular version):

 443 void
 444 GLContext::InitExtensions()
 445 {
 446     MakeCurrent();
 447     const GLubyte *extensions = fGetString(LOCAL_GL_EXTENSIONS);
 448     char *exts = strdup((char *)extensions);

The problem is that fGetString(LOCAL_GL_EXTENSIONS) returns NULL, and strdup crashes when given a NULL argument.
Assignee: nobody → mh+mozilla
Created attachment 598640 [details] [diff] [review]
Avoid crashing when there are no GL extensions reported by the GL implementation
Attachment #598640 - Flags: review?(bjacob)
status-firefox-esr10: --- → affected
status-firefox10: --- → affected
status-firefox11: --- → affected
status-firefox12: --- → affected
status-firefox13: --- → affected

Updated

5 years ago
Severity: normal → critical
Crash Signature: [@ strlen | je_strdup | mozilla::gl::GLContext::InitExtensions()]
Keywords: crash
Comment on attachment 598640 [details] [diff] [review]
Avoid crashing when there are no GL extensions reported by the GL implementation

Review of attachment 598640 [details] [diff] [review]:
-----------------------------------------------------------------

r=me with this caveat:

::: dom/base/nsGlobalWindowCommands.cpp
@@ +66,5 @@
>  #include "nsIClipboardDragDropHookList.h"
>  
>  using namespace mozilla;
>  
> +static const char sSelectAllString[] = "cmd_selectAll";

That unrelated hunk should be handled separately.
Attachment #598640 - Flags: review?(bjacob) → review+
(In reply to Benoit Jacob [:bjacob] from comment #2)
> > +static const char sSelectAllString[] = "cmd_selectAll";
> 
> That unrelated hunk should be handled separately.

That wasn't meant to be there.
Created attachment 598777 [details] [diff] [review]
Avoid crashing when there are no GL extensions reported by the GL implementation

Refreshed to only contain the relevant part
Attachment #598640 - Attachment is obsolete: true
https://hg.mozilla.org/integration/mozilla-inbound/rev/356382604d2d
https://hg.mozilla.org/mozilla-central/rev/356382604d2d
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla13

Updated

5 years ago
status-firefox13: affected → ---
Comment on attachment 598777 [details] [diff] [review]
Avoid crashing when there are no GL extensions reported by the GL implementation

[Approval Request Comment]
User impact if declined: Firefox may crash when the system GL libraries provide no extensions
Risk to taking this patch (and alternatives if risky): It's a simple NULL check. No risk.
String changes made by this patch: None
Attachment #598777 - Flags: approval-mozilla-beta?
Attachment #598777 - Flags: approval-mozilla-aurora?
tracking-firefox-esr10: --- → ?
Comment on attachment 598777 [details] [diff] [review]
Avoid crashing when there are no GL extensions reported by the GL implementation

[Triage Comment]
please land this today if possible (02/27/12) for tomorrow's go-to-build on beta5 and also land on mozilla-esr10 branch before Thursday March 1, 2012 in preparation for March 2 go-to-build on esr. 

See https://wiki.mozilla.org/Release_Management/ESR_Landing_Process for details
Attachment #598777 - Flags: approval-mozilla-esr10+
Attachment #598777 - Flags: approval-mozilla-beta?
Attachment #598777 - Flags: approval-mozilla-beta+
Attachment #598777 - Flags: approval-mozilla-aurora?
Attachment #598777 - Flags: approval-mozilla-aurora+
http://hg.mozilla.org/releases/mozilla-aurora/rev/6061fc798602
http://hg.mozilla.org/releases/mozilla-beta/rev/db9e90094ab8
http://hg.mozilla.org/releases/mozilla-esr10/rev/7b68d8316c3d
status1.9.2: --- → unaffected
status-firefox-esr10: affected → fixed
status-firefox11: affected → fixed
status-firefox12: affected → fixed
tracking-firefox-esr10: ? → 11+
Mozilla/5.0 (Windows NT 6.1; rv:10.0.3) Gecko/20100101 Firefox/10.0.3

No new crash reports having the signature: [@ strlen | je_strdup | mozilla::gl::GLContext::InitExtensions()] appear in Socorro after the patch landed.
Marking this as Verified on Firefox 10.0.3 ESR.
status-firefox-esr10: fixed → verified
Whiteboard: [qa!:esr10]
You need to log in before you can comment on or make changes to this bug.