Uninitialised value use in mozilla::gl::GLContext::ApplyFilterToBoundTexture

RESOLVED FIXED in mozilla14



6 years ago
6 years ago


(Reporter: jseward, Assigned: ajuma)



Firefox Tracking Flags

(Not tracked)



(1 attachment, 1 obsolete attachment)



6 years ago
m-c, Android on Xoom.  Start up and wait for a while (couple of mins).
I think this happens some time during the drawing of the thumbnails of
recently visited pages -- not sure though.

From a brief peer at the sources, kinda looks like
TiledTextureImage::mFilter is being used uninitialised.

Conditional jump or move depends on uninitialised value(s)
   at 0x2CA3ECE2: mozilla::gl::GLContext::ApplyFilterToBoundTexture(gfxPattern::GraphicsFilter) (GLContext.cpp:695)
   by 0x2CA3ED4B: mozilla::gl::TiledTextureImage::ApplyFilter() (GLContext.cpp:1123)
   by 0x2CA3663D: mozilla::layers::ThebesLayerBufferOGL::RenderTo(nsIntPoint const&, mozilla::layers::LayerManagerOGL*, unsigned int) (ThebesLayerOGL.cpp:302)
   by 0x2CA3831B: mozilla::layers::ShadowThebesLayerOGL::RenderLayer(int, nsIntPoint const&) (ThebesLayerOGL.cpp:1341)
   by 0x2CA2D799: mozilla::layers::ShadowContainerLayerOGL::RenderLayer(int, nsIntPoint const&) (ContainerLayerOGL.cpp:252)
   by 0x2CA35205: mozilla::layers::LayerManagerOGL::Render() (LayerManagerOGL.cpp:810)
   by 0x2CA355C5: mozilla::layers::LayerManagerOGL::EndTransaction(void (*)(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) (LayerManagerOGL.cpp:454)
   by 0x2CA30CD9: mozilla::layers::LayerManagerOGL::EndEmptyTransaction() (LayerManagerOGL.cpp:427)
   by 0x2CA3B9BB: mozilla::layers::CompositorParent::Composite() (CompositorParent.cpp:200)
   by 0x2CA3AFCF: RunnableMethod<mozilla::layers::CompositorParent, void (mozilla::layers::CompositorParent::*)(), Tuple0>::Run() (tuple.h:383)
   by 0x2C9C9CCD: MessageLoop::RunTask(Task*) (message_loop.cc:318)
   by 0x2C9CA85F: MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) (message_loop.cc:326)

 Uninitialised value was created by a heap allocation
   at 0x4805318: malloc (vg_replace_malloc.c:263)
   by 0x2D1FF66B: moz_xmalloc (mozalloc.cpp:103)
   by 0x2CA453BF: mozilla::gl::GLContextEGL::CreateTextureImage(nsIntSize const&, gfxASurface::gfxContentType, unsigned int, bool) (mozalloc.h:229)
   by 0x2CA35C1F: mozilla::layers::CreateClampOrRepeatTextureImage(mozilla::gl::GLContext*, nsIntSize const&, gfxASurface::gfxContentType, unsigned int) (ThebesLayerOGL.cpp:81)
   by 0x2CA3748D: mozilla::layers::ShadowBufferOGL::EnsureTexture(nsIntSize, gfxASurface::gfxContentType) (ThebesLayerOGL.cpp:932)
   by 0x2CA374DD: mozilla::layers::ShadowBufferOGL::DirectUpdate(gfxASurface*, nsIntRegion&) (ThebesLayerOGL.cpp:940)
   by 0x2CA37611: mozilla::layers::ShadowBufferOGL::Upload(gfxASurface*, nsIntRegion const&, nsIntRect const&, nsIntPoint const&, bool, nsIntRegion&) (ThebesLayerOGL.cpp:976)
   by 0x2CA37905: mozilla::layers::ShadowThebesLayerOGL::Swap(mozilla::layers::ThebesBuffer const&, nsIntRegion const&, mozilla::layers::OptionalThebesBuffer*, nsIntRegion*, mozilla::layers::OptionalThebesBuffer*, nsIntRegion*) (ThebesLayerOGL.cpp:1230)
   by 0x2CA3DCDD: mozilla::layers::ShadowLayersParent::RecvUpdate(InfallibleTArray<mozilla::layers::Edit> const&, bool const&, InfallibleTArray<mozilla::layers::EditReply>*) (ShadowLayersParent.cpp:334)
   by 0x2C916EDF: mozilla::layers::PLayersParent::OnMessageReceived(IPC::Message const&, IPC::Message*&) (PLayersParent.cpp:318)
   by 0x2C91306F: mozilla::layers::PCompositorParent::OnMessageReceived(IPC::Message const&, IPC::Message*&) (PCompositorParent.cpp:338)
   by 0x2C8ED5E5: mozilla::ipc::SyncChannel::OnDispatchMessage(IPC::Message const&) (SyncChannel.cpp:175)

Comment 1

6 years ago
ThebesLayerBufferOGL::RenderTo is neglecting to call SetFilter before calling ApplyFilter. I think we should just be explicit here that we want FILTER_GOOD.

Comment 2

6 years ago
Created attachment 610541 [details] [diff] [review]
Specify which filter to apply in ThebesLayerBufferOGL::RenderTo
Assignee: nobody → ajuma
Attachment #610541 - Flags: review?(bgirard)
Comment on attachment 610541 [details] [diff] [review]
Specify which filter to apply in ThebesLayerBufferOGL::RenderTo

I think this would break crisp edge, let's initialize TiledTextureImage::mFilter instead.
Attachment #610541 - Flags: review?(bgirard) → review-

Comment 4

6 years ago
Created attachment 610547 [details] [diff] [review]
Initialize TextureImage::mFilter

(In reply to Benoit Girard (:BenWa) from comment #3)
> I think this would break crisp edge, let's initialize
> TiledTextureImage::mFilter instead.

mFilter is uninitialized in TextureImage in general, not just TiledTextureImage, so let's fix that.
Attachment #610541 - Attachment is obsolete: true
Attachment #610547 - Flags: review?(bgirard)


6 years ago
Attachment #610547 - Flags: review?(bgirard) → review+


6 years ago
Whiteboard: [autoland-try:-b do -p all -u all -t none]


6 years ago
Whiteboard: [autoland-try:-b do -p all -u all -t none] → [autoland-in-queue]

Comment 5

6 years ago
Autoland Patchset:
	Patches: 610547
	Branch: mozilla-central => try
	Destination: http://hg.mozilla.org/try/pushloghtml?changeset=84f7dd5410ff
Try run started, revision 84f7dd5410ff. To cancel or monitor the job, see: https://tbpl.mozilla.org/?tree=Try&rev=84f7dd5410ff

Comment 6

6 years ago
(In reply to Ali Juma [:ajuma] from comment #4)
> Created attachment 610547 [details] [diff] [review]
> Initialize TextureImage::mFilter

WFM, in the sense that I can no longer reproduce the complaint
in comment #0 with the patch in place.

Comment 7

6 years ago
Try run for 84f7dd5410ff is complete.
Detailed breakdown of the results available here:
Results (out of 218 total builds):
    exception: 1
    success: 195
    warnings: 22
Builds (or logs if builds failed) available at:


6 years ago
Whiteboard: [autoland-in-queue]

Comment 8

6 years ago
Target Milestone: --- → mozilla14

Comment 9

6 years ago
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.