884077 - [valgrind] invalid write creating DrawBuffer

Status: RESOLVED INCOMPLETE

(Core :: Graphics: CanvasWebGL, defect)

Description

[Ralph Giles (:rillian)]

Trying to reproduce bug 882589 (crash on cubeslam.com) I got the following valgrind report:

Assertion failure: formats.samples > 0, at /home/giles/mozilla/firefox/gfx/gl/GLContext.cpp:1045
==8537== Thread 1:
==8537== Invalid write of size 4
==8537==    at 0x924C57C: mozilla::gl::GLContext::CreateRenderbuffersForOffscreen(mozilla::gl::GLFormats const&, nsIntSize const&, bool, unsigned int*, unsigned int*, unsigned int*) (GLContext.cpp:1045)
==8537==    by 0x9257425: mozilla::gl::DrawBuffer::Create(mozilla::gl::GLContext*, mozilla::gfx::SurfaceCaps const&, mozilla::gl::GLFormats const&, nsIntSize const&) (GLScreenBuffer.cpp:514)
==8537==    by 0x9256F83: mozilla::gl::GLScreenBuffer::CreateDraw(nsIntSize const&) (GLScreenBuffer.cpp:429)
==8537==    by 0x9256BCB: mozilla::gl::GLScreenBuffer::Attach(mozilla::gfx::SharedSurface*, nsIntSize const&) (GLScreenBuffer.cpp:364)
==8537==    by 0x9256F17: mozilla::gl::GLScreenBuffer::Resize(nsIntSize const&) (GLScreenBuffer.cpp:418)
==8537==    by 0x92514AC: mozilla::gl::GLContext::CreateScreenBufferImpl(nsIntSize const&, mozilla::gfx::SurfaceCaps const&) (GLContext.cpp:2864)
==8537==    by 0x92428D5: mozilla::gl::GLContext::CreateScreenBuffer(nsIntSize const&, mozilla::gfx::SurfaceCaps const&) (GLContext.h:1224)
==8537==    by 0x924276E: mozilla::gl::GLContext::InitOffscreen(nsIntSize const&, mozilla::gfx::SurfaceCaps const&) (GLContext.h:1197)
==8537==    by 0x9246BB6: mozilla::gl::GLContextProviderGLX::CreateOffscreen(nsIntSize const&, mozilla::gfx::SurfaceCaps const&, mozilla::gl::GLContext::ContextFlags) (GLContextProviderGLX.cpp:1413)
==8537==    by 0x7A04601: mozilla::WebGLContext::SetDimensions(int, int) (WebGLContext.cpp:544)
==8537==    by 0x7B04AC9: mozilla::dom::HTMLCanvasElement::UpdateContext(JSContext*, JS::Handle<JS::Value>) (HTMLCanvasElement.cpp:827)
==8537==    by 0x7B04581: mozilla::dom::HTMLCanvasElement::GetContext(JSContext*, nsAString_internal const&, JS::Handle<JS::Value>, mozilla::ErrorResult&) (HTMLCanvasElement.cpp:754)
==8537==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==8537==