622676 - Crash [@ js::gc::Cell::compartment() ] running WebGL mochitest on win7 test slave with debug build

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Benoit Jacob [:bjacob] (mostly away)]

In bug 582053 I'm trying to enable the WebGL mochitest. But with a debug build, on windows 7 tryserver, it crashes:

http://tinderbox.mozilla.org/showlog.cgi?log=MozillaTry/1294019379.1294020487.19860.gz&fulltext=1#err0

PROCESS-CRASH | /tests/content/canvas/test/webgl/test_webgl_conformance_test_suite.html | application crashed (minidump found)
Operating system: Windows NT
                  6.1.7600 
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXCEPTION_ACCESS_VIOLATION_READ
Crash address: 0x0

Thread 0 (crashed)
 0  mozjs.dll!js::gc::Cell::compartment() [jsgc.h:f9e1c28c78a7 : 446 + 0xf]
    eip = 0x6da20486   esp = 0x0016b550   ebp = 0x0016b554   ebx = 0x039301e0
    esi = 0x0c750864   edi = 0x10072dc0   eax = 0x00000000   ecx = 0x00000000
    edx = 0x00000000   efl = 0x00010246
    Found by: given as instruction pointer in context
 1  mozjs.dll!JSCompartment::wrap(JSContext *,js::Value *) [jscompartment.cpp:f9e1c28c78a7 : 153 + 0xe]
    eip = 0x6dac7553   esp = 0x0016b55c   ebp = 0x0016b59c
    Found by: call frame info
 2  mozjs.dll!JS_WrapValue [jsapi.cpp:f9e1c28c78a7 : 1226 + 0x1b]
    eip = 0x6da20820   esp = 0x0016b5a4   ebp = 0x0016b5b4
    Found by: call frame info
 3  xul.dll!XPCConvert::NativeData2JS(XPCLazyCallContext &,jsval_layout *,void const *,nsXPTType const &,nsID const *,JSObject *,unsigned int *) [xpcconvert.cpp:f9e1c28c78a7 : 308 + 0xd]
    eip = 0x6b3f94f5   esp = 0x0016b5bc   ebp = 0x0016b728
    Found by: call frame info
 4  xul.dll!XPCConvert::NativeData2JS(XPCCallContext &,jsval_layout *,void const *,nsXPTType const &,nsID const *,JSObject *,unsigned int *) [xpcprivate.h:f9e1c28c78a7 : 3196 + 0x23]
    eip = 0x6b3fdad6   esp = 0x0016b730   ebp = 0x0016b810
    Found by: call frame info
 5  xul.dll!CallMethodHelper::GatherAndConvertResults() [xpcwrappednative.cpp:f9e1c28c78a7 : 2584 + 0x2f]
    eip = 0x6b406824   esp = 0x0016b818   ebp = 0x0016b98c
    Found by: call frame info
 6  xul.dll!CallMethodHelper::Call() [xpcwrappednative.cpp:f9e1c28c78a7 : 2341 + 0x7]
    eip = 0x6b405f2c   esp = 0x0016b994   ebp = 0x0016b9a0
    Found by: call frame info
 7  xul.dll!XPCWrappedNative::CallMethod(XPCCallContext &,XPCWrappedNative::CallMode) [xpcwrappednative.cpp:f9e1c28c78a7 : 2290 + 0x15]
    eip = 0x6b405c5d   esp = 0x0016b9a8   ebp = 0x0016bb24
    Found by: call frame info
 8  xul.dll!XPC_WN_CallMethod(JSContext *,unsigned int,jsval_layout *) [xpcwrappednativejsops.cpp:f9e1c28c78a7 : 1588 + 0xd]
    eip = 0x6b3ed5cc   esp = 0x0016bb2c   ebp = 0x0016bbf8
    Found by: call frame info
 9  mozjs.dll!js::CallJSNative(JSContext *,int (*)(JSContext *,unsigned int,js::Value *),unsigned int,js::Value *) [jscntxtinlines.h:f9e1c28c78a7 : 685 + 0xe]
    eip = 0x6dacc184   esp = 0x0016bc00   ebp = 0x0016bc1c
    Found by: call frame info
10  mozjs.dll!CallCompiler::generateNativeStub() [MonoIC.cpp:f9e1c28c78a7 : 691 + 0x34]
    eip = 0x6dcaa623   esp = 0x0016bc24   ebp = 0x0016c1ec
    Found by: call frame info
11  mozjs.dll!js::mjit::ic::NativeCall(js::VMFrame &,js::mjit::ic::CallICInfo *) [MonoIC.cpp:f9e1c28c78a7 : 898 + 0x7]
    eip = 0x6dcaa396   esp = 0x0016c1f4   ebp = 0x0016c20c
    Found by: call frame info
12  mozjs.dll!js::mjit::EnterMethodJIT(JSContext *,JSStackFrame *,void *,js::Value *) [MethodJIT.cpp:f9e1c28c78a7 : 745 + 0x14]
    eip = 0x6dc534fd   esp = 0x0016c254   ebp = 0x0016c24c
    Found by: call frame info with scanning

Comment 1

[Andreas Gal :gal]

Weird. The object is NULL here.

Comment 2

[Andreas Gal :gal]

Actually no if my source info lines up then a string value is NULL. Thats illegal.

Comment 3

[Benoit Jacob [:bjacob] (mostly away)]

Note that the optimized build doesn't crash, only the debug build does.

Comment 4

[Andreas Gal :gal]

Weird^2. If you catch this in gdb, I buy you lunch or dinner next time you are out here.

Comment 5

[Andreas Gal :gal]

We need some investigation here.

Comment 6

[Benoit Jacob [:bjacob] (mostly away)]

At the moment I can't reproduce a crash. Instead, what I get both in debug and optimized builds is very weird failures in this WebGL mochitest, which none of us can reproduce (not even on win7) on anything else than the win7 test slaves.

for example:

http://tinderbox.mozilla.org/showlog.cgi?log=MozillaTry/1294243609.1294245931.31774.gz&fulltext=1

Comment 7

[David Mandelin [:dmandelin]]

The crash in comment 0 is the most common variety of the topcrash in bug 605290.

Comment 8

[David Mandelin [:dmandelin]]

This might have been bug 623441, which has been fixed. Care to try this again and see if it's better now?

Comment 9

[Benoit Jacob [:bjacob] (mostly away)]

I have not been able to reproduce this for a few days, so I'm gladly marking this resolved, I'll reopen if it happens again.