crash in EnsureGLContext

RESOLVED FIXED in Firefox 26

Status

()

--
critical
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: kairo, Assigned: bjacob)

Tracking

({crash})

unspecified
mozilla27
All
Android
crash
Points:
---

Firefox Tracking Flags

(firefox25 unaffected, firefox26- fixed)

Details

(Whiteboard: [native-crash], crash signature)

(Reporter)

Description

5 years ago
This bug was filed from the Socorro interface and is 
report bp-9f01a452-c471-4ae1-b3cc-97cdc2130904.
=============================================================

Top frames:
0 	libxul.so 	EnsureGLContext 	gfx/gl/GLContext.h
1 	libxul.so 	GrGLBufferImpl::release(GrGpuGL*) 	gfx/skia/src/gpu/gl/GrGLBufferImpl.cpp
2 	libxul.so 	GrResource::release() 	gfx/skia/src/gpu/GrResource.cpp
3 	libxul.so 	GrGLIndexBuffer::~GrGLIndexBuffer() 	gfx/skia/src/gpu/gl/GrGLIndexBuffer.h
4 	libxul.so 	GrGLIndexBuffer::~GrGLIndexBuffer() 	gfx/skia/src/gpu/gl/GrGLIndexBuffer.h
5 	libxul.so 	DeleteCompiler(TCompiler*) 	gfx/angle/src/compiler/CodeGenGLSL.cpp
6 	libxul.so 	SkPixelRef::globalUnref() 	gfx/skia/include/core/SkRefCnt.h
7 	libxul.so 	GrAARectRenderer::reset() 	gfx/skia/include/gpu/GrRefCnt.h
8 	libxul.so 	GrAARectRenderer::~GrAARectRenderer() 	gfx/skia/include/gpu/GrAARectRenderer.h
9 	libxul.so 	GrAARectRenderer::~GrAARectRenderer() 	gfx/skia/include/gpu/GrAARectRenderer.h
10 	libxul.so 	DeleteCompiler(TCompiler*) 	gfx/angle/src/compiler/CodeGenGLSL.cpp
11 	libxul.so 	SkPixelRef::globalUnref() 	gfx/skia/include/core/SkRefCnt.h
12 	libxul.so 	GrContext::~GrContext() 	gfx/skia/src/gpu/GrContext.cpp
13 	libxul.so 	GrContext::~GrContext() 	gfx/skia/src/gpu/GrContext.cpp
14 	libxul.so 	DeleteCompiler(TCompiler*) 	gfx/angle/src/compiler/CodeGenGLSL.cpp
15 	libxul.so 	SkPixelRef::globalUnref() 	gfx/skia/include/core/SkRefCnt.h
16 	libxul.so 	mozilla::gfx::DrawTargetSkia::~DrawTargetSkia() 	obj-firefox/dist/include/skia/SkRefCnt.h
17 	libxul.so 	mozilla::gfx::DrawTargetSkia::~DrawTargetSkia() 	gfx/2d/DrawTargetSkia.cpp
18 	libxul.so 	mozilla::detail::RefCounted<imgDecoderObserver, (mozilla::detail::RefCountAtomicity)1>::Release() 	obj-firefox/dist/include/mozilla/RefPtr.h
19 	libxul.so 	mozilla::RefPtr<mozilla::gfx::DrawTarget>::assign(mozilla::gfx::DrawTarget*) 	
20 	libxul.so 	mozilla::dom::CanvasRenderingContext2D::Reset() 	obj-firefox/dist/include/mozilla/RefPtr.h
21 	libxul.so 	mozilla::dom::CanvasRenderingContext2D::ClearTarget() 	content/canvas/src/CanvasRenderingContext2D.cpp
22 	libxul.so 	mozilla::dom::CanvasRenderingContext2D::SetDimensions(int, int) 	content/canvas/src/CanvasRenderingContext2D.cpp
23 	libxul.so 	mozilla::dom::HTMLCanvasElement::UpdateContext(JSContext*, JS::Handle<JS::Value>) 	content/html/content/src/HTMLCanvasElement.cpp


This is a new crash in 26.0a1 Nightly since 2013-08-21 and is the #5 topcrash in Nightly at this point.

More reports can be found at https://crash-stats.mozilla.com/report/list?signature=EnsureGLContext
Where do SkiaGL bugs go?
Component: Graphics, Panning and Zooming → Graphics
Product: Firefox for Android → Core
Also CC'ing gw280 since snorp is PTO
We knew about this issue. Not sure if snorp filed a bug for it though... He was reproducing it by going to http://ie.microsoft.com/testdrive/Performance/FishBowl/Default.html

We suspect a refcounting error as the GLContext object goes away. CCing bjacob as he's our refcounting king.
(Assignee)

Comment 4

5 years ago
(In reply to Kartikaya Gupta (email:kats@mozilla.com) from comment #1)
> Where do SkiaGL bugs go?

This particular stack has Canvas2D in it.
Component: Graphics → Canvas: 2D
(Assignee)

Comment 5

5 years ago
The DeleteCompiler frames are of course wrong... thanks ICF.
(Assignee)

Comment 6

5 years ago
I can't really say much without reproducing locally in GDB, which I can't do at the moment because I'm assigned other bugs that I must focus on, sorry. I'm happy to try helping anyone who's reproduced this in GDB. Anyway, all what I learnt about skia refcounting is in this email:

https://groups.google.com/forum/#!msg/mozilla.dev.platform/0Xe5YLQDkuU/kIjmJnnNO44J
I hit it repeatedly on David Brin's blog so it seems very repeatable there, but I'm getting multiple different failures (maybe not too surprising). 

I can't gdb it since my devices appear incompatible with remote GDB (Nexus 10 4.3 and Galaxy S4 4.2.2, neither rooted), but it crashed at least 3 times in a row there.  See "scrolling Brin".  I also hit a crash in YCbCrImageDataDeserializer::ToDataSourceSurface() (no bug, but other reports say it's trivially reproducible) - Id 85eb62d4-6171-45a2-a984-b34c42130908 and also I hit bug 912173 (brin3) all at the same URL
(Assignee)

Comment 8

5 years ago
I'm done with my other urgent bugs, I may have some time for this now, self-assigning.
Assignee: nobody → bjacob
(Reporter)

Comment 9

5 years ago
This hasn't been seen in builds after 2013-09-06 even though a decent number of people have updated to yesterday's build. Maybe it has been fixed with some patches in between Sep 6th and 10th.
Nice. I think this is probably the same bug as 912173, then.
Alright, I'll unassign myself and work on bug 900020 instead. Ping me if this bug turns out to not be fixed after all. Otherwise, it sounds like this bug is going to be RESOLVED DUPLICATE soon.
Assignee: bjacob → nobody
tracking-firefox26: ? → +
If this is a dupe of bug 900020 there's nothing to track here, and it hasn't been seen lately so removing the topcrash until someone comes back and says it's back in high volume.
tracking-firefox26: + → -
Keywords: topcrash
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Duplicate of this bug: 912335
Assignee: nobody → bjacob
status-firefox26: affected → fixed
Depends on: 900020
Target Milestone: --- → mozilla27
You need to log in before you can comment on or make changes to this bug.