860466 - crash in mozilla::gl::GLContextEGL::GetSharedHandleDetails

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Scoobidiver (away)]

It's currently #1 top crasher in today's build with already 82 crashes!

The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=9db46ddfb517&tochange=ee5ca214e87c
It's likely a regression from bug 825928.

Signature 	mozilla::gl::GLContextEGL::GetSharedHandleDetails(mozilla::gl::GLContext::SharedTextureShareType, unsigned int, mozilla::gl::GLContext::SharedHandleDetails&) More Reports Search
UUID	66d89611-db9e-4cab-90b4-6f50b2130410
Date Processed	2013-04-10 20:23:34
Uptime	1158
Last Crash	2.0 weeks before submission
Install Age	19.3 minutes since version was first installed.
Install Time	2013-04-10 20:04:08
Product	FennecAndroid
Version	23.0a1
Build ID	20130410065939
Release Channel	nightly
OS	Android
OS Version	0.0.0 Linux 3.0.21-04326-g33f2761 #1 SMP PREEMPT Tue Feb 26 07:39:00 UTC 2013 armv7l Android/jem/jem:4.0.4/IMM76D/8.3.0_user_3014220:user/release-keys
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGSEGV
Crash Address	0x4
App Notes 	
AdapterDescription: 'Imagination Technologies -- PowerVR SGX 544 -- OpenGL ES 2.0 build 1.9.RC2@2130229 -- Model: KFJWI, Product: Kindle Fire, Manufacturer: Amazon, Hardware: bowser'
GL Layers! EGL? EGL+ GL Context? GL Context+ GL Layers+ 
Amazon KFJWI
Android/jem/jem:4.0.4/IMM76D/8.3.0_user_3014220:user/release-keys
Processor Notes 	sp-processor03.phx1.mozilla.com_20800:2008; exploitablity tool: ERROR: unable to analyze dump
EMCheckCompatibility	True
Adapter Vendor ID	Imagination Technologies
Adapter Device ID	PowerVR SGX 544
Device	Amazon KFJWI
Android API Version	15 (REL)
Android CPU ABI	armeabi-v7a

Frame 	Module 	Signature 	Source
0 	libxul.so 	mozilla::gl::GLContextEGL::GetSharedHandleDetails 	gfx/gl/GLContextProviderEGL.cpp:1017
1 	libxul.so 	mozilla::layers::SharedTextureHostOGL::SwapTexturesImpl 	gfx/layers/opengl/TextureHostOGL.cpp:258
2 	libmozglue.so 	__wrap_malloc 	memory/mozjemalloc/jemalloc.c:4247
3 	libxul.so 	mozilla::layers::SharedTextureHostOGL::UpdateImpl 	gfx/layers/opengl/TextureHostOGL.cpp:236
4 	libxul.so 	nsContentList::Item 	content/base/src/nsContentList.cpp:644
5 	libxul.so 	PlaceholderTxn::GetTxnName 	editor/libeditor/base/PlaceholderTxn.cpp:216
6 	libxul.so 	mozilla::net::HttpInfo::GetHttpConnectionData 	netwerk/protocol/http/HttpInfo.cpp:14
7 	libxul.so 	mozilla::layers::CompositableHost::Update 	gfx/layers/composite/CompositableHost.cpp:27
8 	libxul.so 	mozilla::layers::ImageHostSingle::SetCompositor 	gfx/layers/composite/ImageHost.cpp:23
9 	libxul.so 	mozilla::layers::CompositableParentManager::ReceiveCompositableUpdate 	gfx/layers/ipc/CompositableTransactionParent.cpp:112
10 	libxul.so 	mozilla::layers::CompositableOperation::~CompositableOperation 	obj-firefox/ipc/ipdl/LayerTransaction.cpp:4091
11 	libxul.so 	mozilla::layers::PLayersParent::Read 	obj-firefox/ipc/ipdl/PLayersParent.cpp:2091

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Agl%3A%3AGLContextEGL%3A%3AGetSharedHandleDetails%28mozilla%3A%3Agl%3A%3AGLContext%3A%3ASharedTextureShareType%2C+unsigned+int%2C+mozilla%3A%3Agl%3A%3AGLContext%3A%3ASharedHandleDetails%26%29

Comment 1

[Milan Sreckovic [:milan] (needinfo for best results)]

'Morning Nick - can you jump on this one?

Comment 2

[Nick Cameron [:nrc]]

SO, this is a crash when using flash on fennec, just using flash is enough to crash it. I've fixed the crash locally, but now I'm just rendering a black box rather than the video.

I notice we need to take account of the texture transform, but that is not what is causing rendering to fail.

We also seem to be missing a call to fBlendFuncSeparate, playing with that now. I'm not particularly hopeful though.

Comment 3

[Nick Cameron [:nrc]]

Attachment: WIP patch

fixes the crash, but we render black. Plus a whole bunch of printfs for debugging.

Comment 4

[Bas Schouten (:bas.schouten)]

Attachment: Properly deal with SharedTextureOGL

There were a number of issues with the current implementation. It couldn't deal with NULL mSharedHandles. Additionally it was binding things to the wrong samplers. Finally it was not properly setting the texture transform (which defaults to all 0). Finally in a debug build an assert would be hit upon client shutdown due to it not clearing mDescriptor.

This patch fixes all of those issues.

Comment 5

[Matt Woodrow (:mattwoodrow)]

Comment on attachment 736257 [details] [diff] [review]
Properly deal with SharedTextureOGL

Review of attachment 736257 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/layers/opengl/TextureHostOGL.cpp
@@ +62,5 @@
>  
> +  gl->fTexParameteri(LOCAL_GL_TEXTURE_2D, LOCAL_GL_TEXTURE_MIN_FILTER, LOCAL_GL_LINEAR);
> +  gl->fTexParameteri(LOCAL_GL_TEXTURE_2D, LOCAL_GL_TEXTURE_MAG_FILTER, LOCAL_GL_LINEAR);
> +  gl->fTexParameteri(LOCAL_GL_TEXTURE_2D, LOCAL_GL_TEXTURE_WRAP_S, LOCAL_GL_CLAMP_TO_EDGE);
> +  gl->fTexParameteri(LOCAL_GL_TEXTURE_2D, LOCAL_GL_TEXTURE_WRAP_T, LOCAL_GL_CLAMP_TO_EDGE);

These changes will break OMTC Mac plugins unfortunately.

Mac plugins use LOCAL_GL_TEXTURE_RECTANGLE_ARB, and we need to initialize the texture using that.

Comment 6

[Kelsey Gilbert [:jgilbert]]

Also, IIRC, didn't we need TEXTURE_EXTERNAL stuff to handle video rendering on android/b2g?

Comment 7

[Jeff Muizelaar [:jrmuizel]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0a06b9069085

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/0a06b9069085

Comment 10

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

There are these signatures in 20.0.1 in a very low volume.  Not sure if we will see this in 21 or 22.  no more crashes so far in 23 after 12th.