Last Comment Bug 740313 - Uninitialised value use in mozilla::gl::GLContext::ApplyFilterToBoundTexture
: Uninitialised value use in mozilla::gl::GLContext::ApplyFilterToBoundTexture
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: Graphics (show other bugs)
: Trunk
: ARM Android
: -- normal (vote)
: mozilla14
Assigned To: Ali Juma [:ajuma]
:
: Milan Sreckovic [:milan]
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-03-29 05:55 PDT by Julian Seward [:jseward]
Modified: 2012-03-30 13:01 PDT (History)
2 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Specify which filter to apply in ThebesLayerBufferOGL::RenderTo (1.29 KB, patch)
2012-03-29 07:35 PDT, Ali Juma [:ajuma]
b56girard: review-
Details | Diff | Splinter Review
Initialize TextureImage::mFilter (820 bytes, patch)
2012-03-29 07:58 PDT, Ali Juma [:ajuma]
b56girard: review+
Details | Diff | Splinter Review

Description Julian Seward [:jseward] 2012-03-29 05:55:38 PDT
m-c, Android on Xoom.  Start up and wait for a while (couple of mins).
I think this happens some time during the drawing of the thumbnails of
recently visited pages -- not sure though.

From a brief peer at the sources, kinda looks like
TiledTextureImage::mFilter is being used uninitialised.

Conditional jump or move depends on uninitialised value(s)
   at 0x2CA3ECE2: mozilla::gl::GLContext::ApplyFilterToBoundTexture(gfxPattern::GraphicsFilter) (GLContext.cpp:695)
   by 0x2CA3ED4B: mozilla::gl::TiledTextureImage::ApplyFilter() (GLContext.cpp:1123)
   by 0x2CA3663D: mozilla::layers::ThebesLayerBufferOGL::RenderTo(nsIntPoint const&, mozilla::layers::LayerManagerOGL*, unsigned int) (ThebesLayerOGL.cpp:302)
   by 0x2CA3831B: mozilla::layers::ShadowThebesLayerOGL::RenderLayer(int, nsIntPoint const&) (ThebesLayerOGL.cpp:1341)
   by 0x2CA2D799: mozilla::layers::ShadowContainerLayerOGL::RenderLayer(int, nsIntPoint const&) (ContainerLayerOGL.cpp:252)
   by 0x2CA35205: mozilla::layers::LayerManagerOGL::Render() (LayerManagerOGL.cpp:810)
   by 0x2CA355C5: mozilla::layers::LayerManagerOGL::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) (LayerManagerOGL.cpp:454)
   by 0x2CA30CD9: mozilla::layers::LayerManagerOGL::EndEmptyTransaction() (LayerManagerOGL.cpp:427)
   by 0x2CA3B9BB: mozilla::layers::CompositorParent::Composite() (CompositorParent.cpp:200)
   by 0x2CA3AFCF: RunnableMethod<mozilla::layers::CompositorParent, void (mozilla::layers::CompositorParent::*)(), Tuple0>::Run() (tuple.h:383)
   by 0x2C9C9CCD: MessageLoop::RunTask(Task*) (message_loop.cc:318)
   by 0x2C9CA85F: MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) (message_loop.cc:326)

 Uninitialised value was created by a heap allocation
   at 0x4805318: malloc (vg_replace_malloc.c:263)
   by 0x2D1FF66B: moz_xmalloc (mozalloc.cpp:103)
   by 0x2CA453BF: mozilla::gl::GLContextEGL::CreateTextureImage(nsIntSize const&, gfxASurface::gfxContentType, unsigned int, bool) (mozalloc.h:229)
   by 0x2CA35C1F: mozilla::layers::CreateClampOrRepeatTextureImage(mozilla::gl::GLContext*, nsIntSize const&, gfxASurface::gfxContentType, unsigned int) (ThebesLayerOGL.cpp:81)
   by 0x2CA3748D: mozilla::layers::ShadowBufferOGL::EnsureTexture(nsIntSize, gfxASurface::gfxContentType) (ThebesLayerOGL.cpp:932)
   by 0x2CA374DD: mozilla::layers::ShadowBufferOGL::DirectUpdate(gfxASurface*, nsIntRegion&) (ThebesLayerOGL.cpp:940)
   by 0x2CA37611: mozilla::layers::ShadowBufferOGL::Upload(gfxASurface*, nsIntRegion const&, nsIntRect const&, nsIntPoint const&, bool, nsIntRegion&) (ThebesLayerOGL.cpp:976)
   by 0x2CA37905: mozilla::layers::ShadowThebesLayerOGL::Swap(mozilla::layers::ThebesBuffer const&, nsIntRegion const&, mozilla::layers::OptionalThebesBuffer*, nsIntRegion*, mozilla::layers::OptionalThebesBuffer*, nsIntRegion*) (ThebesLayerOGL.cpp:1230)
   by 0x2CA3DCDD: mozilla::layers::ShadowLayersParent::RecvUpdate(InfallibleTArray<mozilla::layers::Edit> const&, bool const&, InfallibleTArray<mozilla::layers::EditReply>*) (ShadowLayersParent.cpp:334)
   by 0x2C916EDF: mozilla::layers::PLayersParent::OnMessageReceived(IPC::Message const&, IPC::Message*&) (PLayersParent.cpp:318)
   by 0x2C91306F: mozilla::layers::PCompositorParent::OnMessageReceived(IPC::Message const&, IPC::Message*&) (PCompositorParent.cpp:338)
   by 0x2C8ED5E5: mozilla::ipc::SyncChannel::OnDispatchMessage(IPC::Message const&) (SyncChannel.cpp:175)
Comment 1 Ali Juma [:ajuma] 2012-03-29 07:31:05 PDT
ThebesLayerBufferOGL::RenderTo is neglecting to call SetFilter before calling ApplyFilter. I think we should just be explicit here that we want FILTER_GOOD.
Comment 2 Ali Juma [:ajuma] 2012-03-29 07:35:35 PDT
Created attachment 610541 [details] [diff] [review]
Specify which filter to apply in ThebesLayerBufferOGL::RenderTo
Comment 3 Benoit Girard (:BenWa) 2012-03-29 07:49:48 PDT
Comment on attachment 610541 [details] [diff] [review]
Specify which filter to apply in ThebesLayerBufferOGL::RenderTo

I think this would break crisp edge, let's initialize TiledTextureImage::mFilter instead.
Comment 4 Ali Juma [:ajuma] 2012-03-29 07:58:03 PDT
Created attachment 610547 [details] [diff] [review]
Initialize TextureImage::mFilter

(In reply to Benoit Girard (:BenWa) from comment #3)
> I think this would break crisp edge, let's initialize
> TiledTextureImage::mFilter instead.

mFilter is uninitialized in TextureImage in general, not just TiledTextureImage, so let's fix that.
Comment 5 Mozilla RelEng Bot 2012-03-29 08:10:32 PDT
Autoland Patchset:
	Patches: 610547
	Branch: mozilla-central => try
	Destination: http://hg.mozilla.org/try/pushloghtml?changeset=84f7dd5410ff
Try run started, revision 84f7dd5410ff. To cancel or monitor the job, see: https://tbpl.mozilla.org/?tree=Try&rev=84f7dd5410ff
Comment 6 Julian Seward [:jseward] 2012-03-29 13:26:34 PDT
(In reply to Ali Juma [:ajuma] from comment #4)
> Created attachment 610547 [details] [diff] [review]
> Initialize TextureImage::mFilter

WFM, in the sense that I can no longer reproduce the complaint
in comment #0 with the patch in place.
Comment 7 Mozilla RelEng Bot 2012-03-29 14:17:38 PDT
Try run for 84f7dd5410ff is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=84f7dd5410ff
Results (out of 218 total builds):
    exception: 1
    success: 195
    warnings: 22
Builds (or logs if builds failed) available at:
http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/autolanduser@mozilla.com-84f7dd5410ff
Comment 9 Ed Morley [:emorley] 2012-03-30 13:01:38 PDT
https://hg.mozilla.org/mozilla-central/rev/7cec359d6736

Note You need to log in before you can comment on or make changes to this bug.