736850 - crash in mozilla::layers::ShadowBufferOGL::EnsureTexture

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Scoobidiver (away)]

It first appeared in 14.0a1/20120318. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ecaad3ae9964&tochange=e94edfdb1f5b
It's likely caused by bug 732917.

Signature 	mozilla::layers::ShadowBufferOGL::EnsureTexture More Reports Search
UUID	47e561bf-5e20-4d8b-8be2-898222120318
Date Processed	2012-03-18 14:42:02
Uptime	36
Last Crash	8.7 weeks before submission
Install Age	36 seconds since version was first installed.
Install Time	2012-03-18 14:41:14
Product	FennecAndroid
Version	14.0a1
Build ID	20120318031036
Release Channel	nightly
OS	Linux
OS Version	0.0.0 Linux 2.6.35.14-cyanogenmod-g9e5cdf1 #1 PREEMPT Sat Oct 8 02:25:15 CEST 2011 armv7l
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGSEGV
Crash Address	0x10
App Notes 	
EGL? EGL+ AdapterVendorID: vision, AdapterDeviceID: HTC Vision.
AdapterDescription: 'Android, Model: 'HTC Vision', Product: 'htc_vision', Manufacturer: 'HTC', Hardware: 'vision''.
GL Context? GL Context+ GL Layers? GL Layers+ 
HTC HTC Vision
htc_wwe/htc_vision/vision:2.3.3/GRI40/84109:user/release-keys
EMCheckCompatibility	True

Frame 	Module 	Signature [Expand] 	Source
0 	libxul.so 	mozilla::layers::ShadowBufferOGL::EnsureTexture 	nsAutoPtr.h:1037
1 	libxul.so 	mozilla::layers::ShadowThebesLayerOGL::ProgressiveUpload 	gfx/layers/opengl/ThebesLayerOGL.cpp:1130
2 	libxul.so 	RunnableMethod<mozilla::layers::ShadowThebesLayerOGL, void , Tuple0>::Run 	ipc/chromium/src/base/tuple.h:383
3 	libxul.so 	MessageLoop::RunTask 	ipc/chromium/src/base/message_loop.cc:318
4 	libxul.so 	MessageLoop::DeferOrRunPendingTask 	ipc/chromium/src/base/message_loop.cc:326
5 	libxul.so 	MessageLoop::DoDelayedWork 	ipc/chromium/src/base/message_loop.cc:453
6 	libxul.so 	base::MessagePumpDefault::Run 	ipc/chromium/src/base/message_pump_default.cc:27
7 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:208
8 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:201
9 	libxul.so 	base::Thread::ThreadMain 	ipc/chromium/src/base/thread.cc:156
10 	libxul.so 	ThreadFunc 	ipc/chromium/src/base/platform_thread_posix.cc:26
11 	libc.so 	__thread_entry 	
12 	libc.so 	pthread_create 	
13 		@0x19e8932 

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Alayers%3A%3AShadowBufferOGL%3A%3AEnsureTexture

Comment 1

[Scoobidiver (away)]

The last crashes don't happen on CyanogemMod.

Comment 2

[Chris Lord [:cwiiis]]

This would happen if mBuffer disappeared before the task was run - which I think may be possible as I don't cancel the task on destruction (bad me :(). I'll cook up a patch that takes care of this and addresses a couple of tidying issues I missed.

Comment 3

[Chris Lord [:cwiiis]]

Attachment: Cancel progressive upload task on buffer destruction

The main function of this patch is to cancel the progressive upload task on buffer destruction, but this also does some minor tidy-up and adds a little robustness.

Comment 4

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/734c1ef36151