crash in EnsureGLContext

RESOLVED FIXED in Firefox 26



5 years ago
4 years ago


(Reporter: kairo, Assigned: bjacob)




Firefox Tracking Flags

(firefox25 unaffected, firefox26- fixed)


(Whiteboard: [native-crash], crash signature)



5 years ago
This bug was filed from the Socorro interface and is 
report bp-9f01a452-c471-4ae1-b3cc-97cdc2130904.

Top frames:
0 	EnsureGLContext 	gfx/gl/GLContext.h
1 	GrGLBufferImpl::release(GrGpuGL*) 	gfx/skia/src/gpu/gl/GrGLBufferImpl.cpp
2 	GrResource::release() 	gfx/skia/src/gpu/GrResource.cpp
3 	GrGLIndexBuffer::~GrGLIndexBuffer() 	gfx/skia/src/gpu/gl/GrGLIndexBuffer.h
4 	GrGLIndexBuffer::~GrGLIndexBuffer() 	gfx/skia/src/gpu/gl/GrGLIndexBuffer.h
5 	DeleteCompiler(TCompiler*) 	gfx/angle/src/compiler/CodeGenGLSL.cpp
6 	SkPixelRef::globalUnref() 	gfx/skia/include/core/SkRefCnt.h
7 	GrAARectRenderer::reset() 	gfx/skia/include/gpu/GrRefCnt.h
8 	GrAARectRenderer::~GrAARectRenderer() 	gfx/skia/include/gpu/GrAARectRenderer.h
9 	GrAARectRenderer::~GrAARectRenderer() 	gfx/skia/include/gpu/GrAARectRenderer.h
10 	DeleteCompiler(TCompiler*) 	gfx/angle/src/compiler/CodeGenGLSL.cpp
11 	SkPixelRef::globalUnref() 	gfx/skia/include/core/SkRefCnt.h
12 	GrContext::~GrContext() 	gfx/skia/src/gpu/GrContext.cpp
13 	GrContext::~GrContext() 	gfx/skia/src/gpu/GrContext.cpp
14 	DeleteCompiler(TCompiler*) 	gfx/angle/src/compiler/CodeGenGLSL.cpp
15 	SkPixelRef::globalUnref() 	gfx/skia/include/core/SkRefCnt.h
16 	mozilla::gfx::DrawTargetSkia::~DrawTargetSkia() 	obj-firefox/dist/include/skia/SkRefCnt.h
17 	mozilla::gfx::DrawTargetSkia::~DrawTargetSkia() 	gfx/2d/DrawTargetSkia.cpp
18 	mozilla::detail::RefCounted<imgDecoderObserver, (mozilla::detail::RefCountAtomicity)1>::Release() 	obj-firefox/dist/include/mozilla/RefPtr.h
19 	mozilla::RefPtr<mozilla::gfx::DrawTarget>::assign(mozilla::gfx::DrawTarget*) 	
20 	mozilla::dom::CanvasRenderingContext2D::Reset() 	obj-firefox/dist/include/mozilla/RefPtr.h
21 	mozilla::dom::CanvasRenderingContext2D::ClearTarget() 	content/canvas/src/CanvasRenderingContext2D.cpp
22 	mozilla::dom::CanvasRenderingContext2D::SetDimensions(int, int) 	content/canvas/src/CanvasRenderingContext2D.cpp
23 	mozilla::dom::HTMLCanvasElement::UpdateContext(JSContext*, JS::Handle<JS::Value>) 	content/html/content/src/HTMLCanvasElement.cpp

This is a new crash in 26.0a1 Nightly since 2013-08-21 and is the #5 topcrash in Nightly at this point.

More reports can be found at
Where do SkiaGL bugs go?
Component: Graphics, Panning and Zooming → Graphics
Product: Firefox for Android → Core
Also CC'ing gw280 since snorp is PTO
We knew about this issue. Not sure if snorp filed a bug for it though... He was reproducing it by going to

We suspect a refcounting error as the GLContext object goes away. CCing bjacob as he's our refcounting king.

Comment 4

5 years ago
(In reply to Kartikaya Gupta ( from comment #1)
> Where do SkiaGL bugs go?

This particular stack has Canvas2D in it.
Component: Graphics → Canvas: 2D

Comment 5

5 years ago
The DeleteCompiler frames are of course wrong... thanks ICF.

Comment 6

5 years ago
I can't really say much without reproducing locally in GDB, which I can't do at the moment because I'm assigned other bugs that I must focus on, sorry. I'm happy to try helping anyone who's reproduced this in GDB. Anyway, all what I learnt about skia refcounting is in this email:!msg/
I hit it repeatedly on David Brin's blog so it seems very repeatable there, but I'm getting multiple different failures (maybe not too surprising). 

I can't gdb it since my devices appear incompatible with remote GDB (Nexus 10 4.3 and Galaxy S4 4.2.2, neither rooted), but it crashed at least 3 times in a row there.  See "scrolling Brin".  I also hit a crash in YCbCrImageDataDeserializer::ToDataSourceSurface() (no bug, but other reports say it's trivially reproducible) - Id 85eb62d4-6171-45a2-a984-b34c42130908 and also I hit bug 912173 (brin3) all at the same URL

Comment 8

5 years ago
I'm done with my other urgent bugs, I may have some time for this now, self-assigning.
Assignee: nobody → bjacob

Comment 9

5 years ago
This hasn't been seen in builds after 2013-09-06 even though a decent number of people have updated to yesterday's build. Maybe it has been fixed with some patches in between Sep 6th and 10th.
Nice. I think this is probably the same bug as 912173, then.
Alright, I'll unassign myself and work on bug 900020 instead. Ping me if this bug turns out to not be fixed after all. Otherwise, it sounds like this bug is going to be RESOLVED DUPLICATE soon.
Assignee: bjacob → nobody
tracking-firefox26: ? → +
If this is a dupe of bug 900020 there's nothing to track here, and it hasn't been seen lately so removing the topcrash until someone comes back and says it's back in high volume.
tracking-firefox26: + → -
Keywords: topcrash
Last Resolved: 4 years ago
Resolution: --- → FIXED
Duplicate of this bug: 912335
Assignee: nobody → bjacob
status-firefox26: affected → fixed
Depends on: 900020
Target Milestone: --- → mozilla27
You need to log in before you can comment on or make changes to this bug.