912522 - crash in EnsureGLContext

Status: RESOLVED FIXED

(Core :: Graphics: Canvas2D, defect)

Description

[Robert Kaiser]

This bug was filed from the Socorro interface and is 
report bp-9f01a452-c471-4ae1-b3cc-97cdc2130904.
=============================================================

Top frames:
0 	libxul.so 	EnsureGLContext 	gfx/gl/GLContext.h
1 	libxul.so 	GrGLBufferImpl::release(GrGpuGL*) 	gfx/skia/src/gpu/gl/GrGLBufferImpl.cpp
2 	libxul.so 	GrResource::release() 	gfx/skia/src/gpu/GrResource.cpp
3 	libxul.so 	GrGLIndexBuffer::~GrGLIndexBuffer() 	gfx/skia/src/gpu/gl/GrGLIndexBuffer.h
4 	libxul.so 	GrGLIndexBuffer::~GrGLIndexBuffer() 	gfx/skia/src/gpu/gl/GrGLIndexBuffer.h
5 	libxul.so 	DeleteCompiler(TCompiler*) 	gfx/angle/src/compiler/CodeGenGLSL.cpp
6 	libxul.so 	SkPixelRef::globalUnref() 	gfx/skia/include/core/SkRefCnt.h
7 	libxul.so 	GrAARectRenderer::reset() 	gfx/skia/include/gpu/GrRefCnt.h
8 	libxul.so 	GrAARectRenderer::~GrAARectRenderer() 	gfx/skia/include/gpu/GrAARectRenderer.h
9 	libxul.so 	GrAARectRenderer::~GrAARectRenderer() 	gfx/skia/include/gpu/GrAARectRenderer.h
10 	libxul.so 	DeleteCompiler(TCompiler*) 	gfx/angle/src/compiler/CodeGenGLSL.cpp
11 	libxul.so 	SkPixelRef::globalUnref() 	gfx/skia/include/core/SkRefCnt.h
12 	libxul.so 	GrContext::~GrContext() 	gfx/skia/src/gpu/GrContext.cpp
13 	libxul.so 	GrContext::~GrContext() 	gfx/skia/src/gpu/GrContext.cpp
14 	libxul.so 	DeleteCompiler(TCompiler*) 	gfx/angle/src/compiler/CodeGenGLSL.cpp
15 	libxul.so 	SkPixelRef::globalUnref() 	gfx/skia/include/core/SkRefCnt.h
16 	libxul.so 	mozilla::gfx::DrawTargetSkia::~DrawTargetSkia() 	obj-firefox/dist/include/skia/SkRefCnt.h
17 	libxul.so 	mozilla::gfx::DrawTargetSkia::~DrawTargetSkia() 	gfx/2d/DrawTargetSkia.cpp
18 	libxul.so 	mozilla::detail::RefCounted<imgDecoderObserver, (mozilla::detail::RefCountAtomicity)1>::Release() 	obj-firefox/dist/include/mozilla/RefPtr.h
19 	libxul.so 	mozilla::RefPtr<mozilla::gfx::DrawTarget>::assign(mozilla::gfx::DrawTarget*) 	
20 	libxul.so 	mozilla::dom::CanvasRenderingContext2D::Reset() 	obj-firefox/dist/include/mozilla/RefPtr.h
21 	libxul.so 	mozilla::dom::CanvasRenderingContext2D::ClearTarget() 	content/canvas/src/CanvasRenderingContext2D.cpp
22 	libxul.so 	mozilla::dom::CanvasRenderingContext2D::SetDimensions(int, int) 	content/canvas/src/CanvasRenderingContext2D.cpp
23 	libxul.so 	mozilla::dom::HTMLCanvasElement::UpdateContext(JSContext*, JS::Handle<JS::Value>) 	content/html/content/src/HTMLCanvasElement.cpp


This is a new crash in 26.0a1 Nightly since 2013-08-21 and is the #5 topcrash in Nightly at this point.

More reports can be found at https://crash-stats.mozilla.com/report/list?signature=EnsureGLContext

Comment 1

[Kartikaya Gupta (email:[e-mail])]

Where do SkiaGL bugs go?

Comment 2

[Kartikaya Gupta (email:[e-mail])]

Also CC'ing gw280 since snorp is PTO

Comment 3

[George Wright (:gw280) (needinfo me!)]

We knew about this issue. Not sure if snorp filed a bug for it though... He was reproducing it by going to http://ie.microsoft.com/testdrive/Performance/FishBowl/Default.html

We suspect a refcounting error as the GLContext object goes away. CCing bjacob as he's our refcounting king.

Comment 4

[Benoit Jacob [:bjacob] (mostly away)]

(In reply to Kartikaya Gupta (email:[e-mail]) from comment #1)
> Where do SkiaGL bugs go?

This particular stack has Canvas2D in it.

Comment 5

[Benoit Jacob [:bjacob] (mostly away)]

The DeleteCompiler frames are of course wrong... thanks ICF.

Comment 6

[Benoit Jacob [:bjacob] (mostly away)]

I can't really say much without reproducing locally in GDB, which I can't do at the moment because I'm assigned other bugs that I must focus on, sorry. I'm happy to try helping anyone who's reproduced this in GDB. Anyway, all what I learnt about skia refcounting is in this email:

https://groups.google.com/forum/#!msg/mozilla.dev.platform/0Xe5YLQDkuU/kIjmJnnNO44J

Comment 7

[Randell Jesup [:jesup] (needinfo me)]

I hit it repeatedly on David Brin's blog so it seems very repeatable there, but I'm getting multiple different failures (maybe not too surprising). 

I can't gdb it since my devices appear incompatible with remote GDB (Nexus 10 4.3 and Galaxy S4 4.2.2, neither rooted), but it crashed at least 3 times in a row there.  See "scrolling Brin".  I also hit a crash in YCbCrImageDataDeserializer::ToDataSourceSurface() (no bug, but other reports say it's trivially reproducible) - Id 85eb62d4-6171-45a2-a984-b34c42130908 and also I hit bug 912173 (brin3) all at the same URL

Comment 8

[Benoit Jacob [:bjacob] (mostly away)]

I'm done with my other urgent bugs, I may have some time for this now, self-assigning.

Comment 9

[Robert Kaiser]

This hasn't been seen in builds after 2013-09-06 even though a decent number of people have updated to yesterday's build. Maybe it has been fixed with some patches in between Sep 6th and 10th.

Comment 10

[James Willcox (:snorp) ([e-mail]) (he/him)]

Nice. I think this is probably the same bug as 912173, then.

Comment 11

[Benoit Jacob [:bjacob] (mostly away)]

Alright, I'll unassign myself and work on bug 900020 instead. Ping me if this bug turns out to not be fixed after all. Otherwise, it sounds like this bug is going to be RESOLVED DUPLICATE soon.

Comment 12

[Lukas Blakk [:lsblakk] use ?needinfo]

If this is a dupe of bug 900020 there's nothing to track here, and it hasn't been seen lately so removing the topcrash until someone comes back and says it's back in high volume.