964976 - MOZ_CRASH("Unknown gralloc pixel format") in PixelFormatForImageFormat()

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Botond Ballo [:botond]]

STR:
  1. Build B2G in debug mode.
  2. Start the B2G browser.
  3. Load a webpage.
  4. Tap on the URL bar.
  5. Pan left on the URL bar to scroll the address.

Stack trace:

Program received signal SIGSEGV, Segmentation fault.
0xb48163e0 in PixelFormatForImageFormat (aFormat=<optimized out>) at /home/botond/dev/mozilla/central/gfx/layers/ipc/ShadowLayerUtilsGralloc.cpp:176
176         MOZ_CRASH("Unknown gralloc pixel format");
(gdb) i s
#0  0xb48163e0 in PixelFormatForImageFormat (aFormat=<optimized out>) at /home/botond/dev/mozilla/central/gfx/layers/ipc/ShadowLayerUtilsGralloc.cpp:176
#1  mozilla::layers::PixelFormatForContentType (aContentType=ALPHA) at /home/botond/dev/mozilla/central/gfx/layers/ipc/ShadowLayerUtilsGralloc.cpp:205
#2  0xb4816a08 in PlatformAllocSurfaceDescriptor (aBuffer=0xb05c3ebc, aCaps=<optimized out>, aContent=ALPHA, aSize=..., this=0xae57e610) at /home/botond/dev/mozilla/central/gfx/layers/ipc/ShadowLayerUtilsGralloc.cpp:444
#3  mozilla::layers::ISurfaceAllocator::PlatformAllocSurfaceDescriptor (this=0xae57e610, aSize=..., aContent=ALPHA, aCaps=<optimized out>, aBuffer=0xb05c3ebc)
    at /home/botond/dev/mozilla/central/gfx/layers/ipc/ShadowLayerUtilsGralloc.cpp:390
#4  0xb484adf8 in mozilla::layers::ISurfaceAllocator::AllocSurfaceDescriptorWithCaps (this=0xae57e610, aSize=..., aContent=ALPHA, aCaps=0, aBuffer=0xb05c3ebc) at ../../../gfx/layers/ipc/ISurfaceAllocator.cpp:87
#5  0xb484aa54 in mozilla::layers::ISurfaceAllocator::AllocSurfaceDescriptor (this=<optimized out>, aSize=<optimized out>, aContent=<optimized out>, aBuffer=<optimized out>) at ../../../gfx/layers/ipc/ISurfaceAllocator.cpp:73
#6  0xb4830746 in mozilla::layers::DeprecatedTextureClientShmem::EnsureAllocated (this=0xb05c3eb0, aSize=..., aContentType=ALPHA) at /home/botond/dev/mozilla/central/gfx/layers/client/TextureClient.cpp:723
#7  0xb4830688 in mozilla::layers::AutoLockShmemClient::Update (this=0xbedf2c8c, aImage=<optimized out>, aContentFlags=0, aSurface=0xb028f940) at /home/botond/dev/mozilla/central/gfx/layers/client/TextureClient.cpp:934
#8  0xb482edfe in mozilla::layers::DeprecatedImageClientSingle::UpdateImage (this=0xafab3500, aContainer=0xaf490a60, aContentFlags=0) at /home/botond/dev/mozilla/central/gfx/layers/client/ImageClient.cpp:445
#9  0xb482af1e in mozilla::layers::ClientImageLayer::RenderLayer (this=0xada9de20) at /home/botond/dev/mozilla/central/gfx/layers/client/ClientImageLayer.cpp:159
#10 0xb482beb4 in mozilla::layers::ClientThebesLayer::RenderLayer (this=0xafae0af0) at /home/botond/dev/mozilla/central/gfx/layers/client/ClientThebesLayer.cpp:88
#11 0xb482ab1a in mozilla::layers::ClientContainerLayer::RenderLayer (this=<optimized out>) at /home/botond/dev/mozilla/central/gfx/layers/client/ClientContainerLayer.h:82
#12 0xb482ab1a in mozilla::layers::ClientContainerLayer::RenderLayer (this=<optimized out>) at /home/botond/dev/mozilla/central/gfx/layers/client/ClientContainerLayer.h:82
#13 0xb482ab1a in mozilla::layers::ClientContainerLayer::RenderLayer (this=<optimized out>) at /home/botond/dev/mozilla/central/gfx/layers/client/ClientContainerLayer.h:82
#14 0xb482b302 in mozilla::layers::ClientLayerManager::EndTransactionInternal (this=0xae4343a0, aCallback=
    0xb50c79c1 <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, aCallbackData=<optimized out>)
    at /home/botond/dev/mozilla/central/gfx/layers/client/ClientLayerManager.cpp:188
#15 0xb482bb40 in mozilla::layers::ClientLayerManager::EndTransaction (this=0xae4343a0, 
    aCallback=0xb50c79c1 <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, mozilla::layers::DrawRegionClip, nsIntRegion const&, void*)>, aCallbackData=0xbedf3150, 
    aFlags=mozilla::layers::LayerManager::END_DEFAULT) at /home/botond/dev/mozilla/central/gfx/layers/client/ClientLayerManager.cpp:211
#16 0xb50f97cc in nsDisplayList::PaintForFrame (this=0xbedf3134, aBuilder=0xbedf3150, aCtx=<optimized out>, aForFrame=<optimized out>, aFlags=13) at /home/botond/dev/mozilla/central/layout/base/nsDisplayList.cpp:1258
#17 0xb50f99f4 in nsDisplayList::PaintRoot (this=0xbedf3134, aBuilder=0xbedf3150, aCtx=0x0, aFlags=13) at /home/botond/dev/mozilla/central/layout/base/nsDisplayList.cpp:1102
#18 0xb5102722 in nsLayoutUtils::PaintFrame (aRenderingContext=0x0, aFrame=0xb00a22a0, aDirtyRegion=<optimized out>, aBackstop=0, aFlags=772) at /home/botond/dev/mozilla/central/layout/base/nsLayoutUtils.cpp:2339
#19 0xb50bb032 in PresShell::Paint (this=0xb6a5b780, aViewToPaint=<optimized out>, aDirtyRegion=..., aFlags=<optimized out>) at /home/botond/dev/mozilla/central/layout/base/nsPresShell.cpp:5857
#20 0xb4da62a4 in ProcessPendingUpdatesForView (aFlushDirtyRegion=<optimized out>, aView=0xafa1d5b0, this=0xafa0dfd0) at /home/botond/dev/mozilla/central/view/src/nsViewManager.cpp:421
#21 nsViewManager::ProcessPendingUpdatesForView (this=0xafa0dfd0, aView=0xafa1d5b0, aFlushDirtyRegion=<optimized out>) at /home/botond/dev/mozilla/central/view/src/nsViewManager.cpp:368
#22 0xb4da6458 in nsViewManager::ProcessPendingUpdates (this=0xafa0dfd0, aMode=nsViewManager::eTrySyncUpdate) at /home/botond/dev/mozilla/central/view/src/nsViewManager.cpp:1053
#23 0xb50c246a in nsRefreshDriver::Tick (this=0xb22ae1f0, aNowEpoch=<optimized out>, aNowTime=...) at /home/botond/dev/mozilla/central/layout/base/nsRefreshDriver.cpp:1207
#24 0xb50c2954 in mozilla::RefreshDriverTimer::Tick (this=0xb0260ec0) at /home/botond/dev/mozilla/central/layout/base/nsRefreshDriver.cpp:160
#25 0xb443c22e in nsTimerImpl::Fire (this=0xb0262420) at ../../../xpcom/threads/nsTimerImpl.cpp:551
#26 0xb443c3b8 in nsTimerEvent::Run (this=0xb0cd13f0) at ../../../xpcom/threads/nsTimerImpl.cpp:635
#27 0xb44397ba in ProcessNextEvent (result=0xbedf37d7, mayWait=<optimized out>, this=0xb6a34700) at ../../../xpcom/threads/nsThread.cpp:637
#28 nsThread::ProcessNextEvent (this=0xb6a34700, mayWait=<optimized out>, result=0xbedf37d7) at ../../../xpcom/threads/nsThread.cpp:568
#29 0xb43f3c88 in NS_ProcessNextEvent (thread=0xb6a34700, mayWait=<optimized out>) at ../../../xpcom/glue/nsThreadUtils.cpp:263
#30 0xb45d1ba8 in mozilla::ipc::MessagePump::Run (this=0xb6a01e50, aDelegate=0xb6a4e1a0) at ../../../ipc/glue/MessagePump.cpp:95
#31 0xb45c371a in MessageLoop::RunInternal (this=0xb6a4e1a0) at ../../../ipc/chromium/src/base/message_loop.cc:226
#32 0xb45c3732 in RunHandler (this=0xb6a4e1a0) at ../../../ipc/chromium/src/base/message_loop.cc:219
#33 MessageLoop::Run (this=0xb6a4e1a0) at ../../../ipc/chromium/src/base/message_loop.cc:193
#34 0xb4b18a02 in nsBaseAppShell::Run (this=0xb6ac4650) at ../../../widget/xpwidgets/nsBaseAppShell.cpp:157
#35 0xb53b81f6 in nsAppStartup::Run (this=0xb2247280) at ../../../../toolkit/components/startup/nsAppStartup.cpp:276
#36 0xb538c6ae in XREMain::XRE_mainRun (this=0xbedf396c) at ../../../toolkit/xre/nsAppRunner.cpp:4023
#37 0xb538c908 in XREMain::XRE_main (this=0xbedf396c, argc=<optimized out>, argv=<optimized out>, aAppData=<optimized out>) at ../../../toolkit/xre/nsAppRunner.cpp:4091
#38 0xb538ca74 in XRE_main (argc=1, argv=0xbedf5b24, aAppData=0x24920, aFlags=<optimized out>) at ../../../toolkit/xre/nsAppRunner.cpp:4331
#39 0x0000a49c in do_main (argv=0xbedf5b24, argc=1) at ../../../b2g/app/nsBrowserApp.cpp:163
#40 main (argc=<optimized out>, argv=<optimized out>) at ../../../b2g/app/nsBrowserApp.cpp:256

Comment 1

[Botond Ballo [:botond]]

This is with a recent master (pulled yesterday), and it wasn't happening before.

Comment 2

[Sotaro Ikeda [:sotaro]]

This seems a regression of Bug 958420.

Comment 3

[Sotaro Ikeda [:sotaro]]

PIXEL_FORMAT_A_8 is not supported by b2g's gralloc hal. Therefore, it is removed by Bug 958420. But the change did not care about that PIXEL_FORMAT_A_8 is tried to allocate in some situations.

Comment 4

[Sotaro Ikeda [:sotaro]]

schiu, can you comment about if Comment 3 is correct.

Comment 5

[Sotaro Ikeda [:sotaro]]

Attachment: patch - Prevent crash of unsupported pixel format gralloc allocation

Comment 6

[Sotaro Ikeda [:sotaro]]

Attachment: patch v2 - Prevent crash of unsupported pixel format gralloc allocation

Update nits.

Comment 7

[Sotaro Ikeda [:sotaro]]

Botond, does attachment 8367403 [details] [diff] [review] works for you?

Comment 8

[Botond Ballo [:botond]]

(In reply to Sotaro Ikeda [:sotaro] from comment #7)
> Botond, does attachment 8367403 [details] [diff] [review] works for you?

Yeah, I no longer see the crash with it. Thanks!

Comment 9

[Sotaro Ikeda [:sotaro]]

> Yeah, I no longer see the crash with it. Thanks!

Good. Thanks for the confirmation!

Comment 10

[Sotaro Ikeda [:sotaro]]

Attachment: patch v3 - Prevent crash of unsupported pixel format gralloc allocation(r=nical)

Committable patch.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/33c047525cdf

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/33c047525cdf