The default bug view has changed. See this FAQ.

crash in GLEngine@0xaa... with Flash 11.2.202.233

RESOLVED FIXED in Firefox 15

Status

()

Core
Graphics
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: mccr8, Unassigned)

Tracking

(Blocks: 1 bug, 4 keywords)

15 Branch
mozilla15
x86_64
Mac OS X
crash, regression, reproducible, topcrash
Points:
---

Firefox Tracking Flags

(firefox15+ fixed)

Details

(Whiteboard: [qa-], crash signature)

(Reporter)

Description

5 years ago
This bug was filed from the Socorro interface and is 
report bp-5b576f82-7fd6-4fd0-8821-d06492120509 .
============================================================= 
In Google Reader, I am subscribed to the "Official Gmail Blog".  Twice now, when I've clicked on the link to bring up the entries for the blog, then clicked on the latest entry, it has crashed immediately with this signature.  

https://crash-stats.mozilla.com/report/index/bp-5b576f82-7fd6-4fd0-8821-d06492120509
https://crash-stats.mozilla.com/report/index/bp-3d48dd46-cae8-4a9f-9d27-6e92d2120509
(Reporter)

Comment 1

5 years ago
I get similar crashes when I load the Amazon Cloud player:
https://crash-stats.mozilla.com/report/index/bp-1d396c56-0a38-4e86-8916-a29f72120509
https://crash-stats.mozilla.com/report/index/bp-812295b7-cc83-4d0b-b6c1-8e6712120509
(Reporter)

Comment 2

5 years ago
I used the Amazon Cloud player yesterday, so this is probably a very recent regression.
Andrew: I tried to repro on Amazon Cloud player and with Google Reader using Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:15.0) Gecko/15.0 Firefox/15.0a1 but so far I have not luck reproducing. Wondering if maybe an extension is tickling the crash?
Crash Signature: [@ GLEngine@0xaa5ba] → [@ GLEngine@0xaa5ba] [@ GLEngine@0xaaf9d]
(Reporter)

Comment 4

5 years ago
Yeah, it turns out I can't reproduce on a clean profile either.  I'll try figuring out if it is an addon.
(Reporter)

Comment 5

5 years ago
I still get it without any extensions, in my main profile.  I tried enabling/disabling incremental GC but it didn't seem to matter.  If I disable Flash, then it loads up without crashing, but of course it doesn't actually play anything.
(Reporter)

Comment 6

5 years ago
I have Flash 11.2.202.233, which is apparently out of date.  I'll try upgrading it.
(Reporter)

Comment 7

5 years ago
Both that Google Reader entry and the Amazon Cloud player work just fine with Flash 11.2.202.235, so maybe this was some kind of Flash bug.
(Reporter)

Updated

5 years ago
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → WORKSFORME
(Reporter)

Updated

5 years ago
Summary: crash in GLEngine@0xaa5ba → crash in GLEngine@0xaa5ba with Flash 11.2.202.233
Adding Sal from Adobe - would be interesting to know why that flash version is crashing in this instance. I was running with the latest version Version: 11.2.202.235 and that was likely why I was not able to reproduce the crash.
(Reporter)

Comment 9

5 years ago
I couldn't reproduce on a clean profile even with 233, so maybe my profile was just mangled in some odd way.

Comment 10

5 years ago
i'm glad it's working for you on a clean profile.  11,2,202,235 was a security update only.

Comment 11

5 years ago
It's hit by many users and is currently #3 top crasher in today's build.
The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1092c1a3ac50&tochange=dd29535bac5f
It might be a regression from bug 749678.

More reports at:
https://crash-stats.mozilla.com/report/list?signature=GLEngine%400xaaf9d
https://crash-stats.mozilla.com/report/list?signature=GLEngine%400xaa5ba
Status: RESOLVED → REOPENED
tracking-firefox15: --- → ?
Keywords: regression, reproducible, topcrash
Hardware: All → x86_64
Resolution: WORKSFORME → ---
Summary: crash in GLEngine@0xaa5ba with Flash 11.2.202.233 → crash in GLEngine@0xaa... with Flash 11.2.202.233
Version: Trunk → 15 Branch
Crash Signature: [@ GLEngine@0xaa5ba] [@ GLEngine@0xaaf9d] → [@ GLEngine@0xaa5ba] [@ GLEngine@0xaaf9d] [@ GLEngine@0xae365]
Crash Signature: [@ GLEngine@0xaa5ba] [@ GLEngine@0xaaf9d] [@ GLEngine@0xae365] → [@ GLEngine@0xaa5ba] [@ GLEngine@0xaaf9d] [@ GLEngine@0xae365] [@ GLEngine@0x4230d]
I can reproduce this consistently in my daily profile by visiting http://blog.mozilla.org/about_mozilla/2012/05/08/tracking-the-trackers-become-a-mobile-test-driver-and-more/ and clicking on the "teaser reel" link.
I can also reproduce it consistently by opening http://udp.github.com in a new tab.
Indeed, there is clearly a regression with plugins using OpenGL, which means in particular Flash on Mac OSX, from bug 749678.

I just backed it out on inbound:
http://hg.mozilla.org/integration/mozilla-inbound/rev/3e0f7b9a39d7

With this commit message:

Unfortunately, in-process plugins using OpenGL break the assumption made by these patches, that the current GL context is only changed by GLContext::MakeCurrent. Another issue, regardless of in-process, is that our host-side code in nsCoreAnimationSupport.mm uses direct CGL calls, bypassing GLContext.

Updated

5 years ago
Blocks: 749678

Updated

5 years ago
tracking-firefox15: ? → +

Comment 15

5 years ago
There are no crashes after 15.0a1/20120513. It's fixed by the backout of bug 749678.
Status: REOPENED → RESOLVED
Last Resolved: 5 years ago5 years ago
status-firefox15: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla15

Updated

5 years ago
Whiteboard: [qa-]
You need to log in before you can comment on or make changes to this bug.