1317640 - Crash [@ mozalloc_abort]

Status: RESOLVED WORKSFORME

(Core :: Graphics: CanvasWebGL, defect, P3)

Description

[Raymond Forbes[:rforbes]]

The following testcase crashes on mozilla-inbound revision 20161109-310ae43d23b7 (build with (buildFlags not available), run with ):

See attachment.


Backtrace:

Launch command: /home/ubuntu/firefox/firefox -no-remote -profile /tmp/ffprof_HJN4WI http://127.0.0.1:56637

J
[5703] ###!!! ABORT: Divide by zero: file /home/worker/workspace/build/src/toolkit/xre/nsSigHandlers.cpp, line 156
==5703==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffe5a11e000; bottom 0x7f07510c7000; size: 0x00f709057000 (1061008273408)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
[5703] ###!!! ABORT: Divide by zero: file /home/worker/workspace/build/src/toolkit/xre/nsSigHandlers.cpp, line 156
ASAN:DEADLYSIGNAL
=================================================================
==5703==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000004e114b bp 0x7f07510c8550 sp 0x7f07510c8540 T0)
    #0 0x4e114a in mozalloc_abort(char const*) /home/worker/workspace/build/src/memory/mozalloc/mozalloc_abort.cpp:33:5
    #1 0x7f07347e5da5 in Abort(char const*) /home/worker/workspace/build/src/xpcom/base/nsDebugImpl.cpp:449:3
    #2 0x7f07347e5b4c in NS_DebugBreak /home/worker/workspace/build/src/xpcom/base/nsDebugImpl.cpp:405:7
    #3 0x7f073cf3403a in fpehandler(int, siginfo*, void*) /home/worker/workspace/build/src/toolkit/xre/nsSigHandlers.cpp:156:5
    #4 0x7f0750cac3df  (/lib/x86_64-linux-gnu/libpthread.so.0+0x113df)
    #5 0x7f073da92d9b in TType::getObjectSize() const /home/worker/workspace/build/src/gfx/angle/src/compiler/translator/Types.cpp:331:40
    #6 0x7f073da184da in TParseContext::checkConstructorArguments(TSourceLoc const&, TIntermNode*, TFunction const&, TOperator, TType const&) /home/worker/workspace/build/src/gfx/angle/src/compiler/translator/ParseContext.cpp:568:49
    #7 0x7f073da2850b in TParseContext::addConstructor(TIntermNode*, TOperator, TFunction*, TSourceLoc const&) /home/worker/workspace/build/src/gfx/angle/src/compiler/translator/ParseContext.cpp:2352:10
    #8 0x7f073da35e3e in TParseContext::addFunctionCallOrMethod(TFunction*, TIntermNode*, TIntermNode*, TSourceLoc const&, bool*) /home/worker/workspace/build/src/gfx/angle/src/compiler/translator/ParseContext.cpp:3787:20
    #9 0x7f073d91e93e in yyparse(TParseContext*, void*) /home/worker/workspace/build/src/gfx/angle/src/compiler/translator/glslang_tab.cpp:2481:42
    #10 0x7f073da382ee in PaParseStrings(unsigned long, char const* const*, int const*, TParseContext*) /home/worker/workspace/build/src/gfx/angle/src/compiler/translator/ParseContext.cpp:3955:17
    #11 0x7f073d95dd74 in TCompiler::compileTreeImpl(char const* const*, unsigned long, unsigned long) /home/worker/workspace/build/src/gfx/angle/src/compiler/translator/Compiler.cpp:232:10
    #12 0x7f073d962532 in TCompiler::compile(char const* const*, unsigned long, unsigned long) /home/worker/workspace/build/src/gfx/angle/src/compiler/translator/Compiler.cpp:418:25
    #13 0x7f07392c3b2c in ValidateAndTranslate /home/worker/workspace/build/src/dom/canvas/WebGLShaderValidator.cpp:205:12
    #14 0x7f07392c3b2c in Translate /home/worker/workspace/build/src/dom/canvas/WebGLShader.cpp:28
    #15 0x7f07392c3b2c in mozilla::WebGLShader::CompileShader() /home/worker/workspace/build/src/dom/canvas/WebGLShader.cpp:217
    #16 0x7f0738792917 in mozilla::dom::WebGLRenderingContextBinding::compileShader(JSContext*, JS::Handle<JSObject*>, mozilla::WebGLContext*, JSJitMethodCallArgs const&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/WebGLRenderingContextBinding.cpp:12125:3
    #17 0x7f0739066d30 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:2879:13
    #18 0x7f073f3ec74c in CallJSNative /home/worker/workspace/build/src/js/src/jscntxtinlines.h:239:15
    #19 0x7f073f3ec74c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:447
    #20 0x7f073f3cc893 in CallFromStack /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:510:12
    #21 0x7f073f3cc893 in Interpret(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2922
    #22 0x7f073f3b1986 in js::RunScript(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:405:12
    #23 0x7f073f3ef212 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:686:15
    #24 0x7f073f3efaab in js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:718:12
    #25 0x7f073eee2194 in Evaluate(JSContext*, js::ScopeKind, JS::Handle<JSObject*>, JS::ReadOnlyCompileOptions const&, JS::SourceBufferHolder&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/jsapi.cpp:4415:19
    #26 0x7f073eee2eeb in Evaluate /home/worker/workspace/build/src/js/src/jsapi.cpp:4442:12
    #27 0x7f073eee2eeb in JS::Evaluate(JSContext*, JS::AutoObjectVector&, JS::ReadOnlyCompileOptions const&, JS::SourceBufferHolder&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/jsapi.cpp:4500
    #28 0x7f07376c4287 in nsJSUtils::EvaluateString(JSContext*, JS::SourceBufferHolder&, JS::Handle<JSObject*>, JS::CompileOptions&, nsJSUtils::EvaluateOptions const&, JS::MutableHandle<JS::Value>, void**) /home/worker/workspace/build/src/dom/base/nsJSUtils.cpp:207:12
    #29 0x7f07376c5499 in nsJSUtils::EvaluateString(JSContext*, JS::SourceBufferHolder&, JS::Handle<JSObject*>, JS::CompileOptions&, void**) /home/worker/workspace/build/src/dom/base/nsJSUtils.cpp:274:10
    #30 0x7f0737750481 in nsScriptLoader::EvaluateScript(nsScriptLoadRequest*) /home/worker/workspace/build/src/dom/base/nsScriptLoader.cpp:2193:14
    #31 0x7f073774d2b1 in nsScriptLoader::ProcessRequest(nsScriptLoadRequest*) /home/worker/workspace/build/src/dom/base/nsScriptLoader.cpp:1979:10
    #32 0x7f0737734681 in nsScriptLoader::ProcessScriptElement(nsIScriptElement*) /home/worker/workspace/build/src/dom/base/nsScriptLoader.cpp:1712:10
    #33 0x7f0737731002 in nsScriptElement::MaybeProcessScript() /home/worker/workspace/build/src/dom/base/nsScriptElement.cpp:149:10
    #34 0x7f07367c0c64 in AttemptToExecute /home/worker/workspace/build/src/dom/base/nsIScriptElement.h:222:18
    #35 0x7f07367c0c64 in nsHtml5TreeOpExecutor::RunScript(nsIContent*) /home/worker/workspace/build/src/parser/html/nsHtml5TreeOpExecutor.cpp:666
    #36 0x7f07367bf3d5 in nsHtml5TreeOpExecutor::RunFlushLoop() /home/worker/workspace/build/src/parser/html/nsHtml5TreeOpExecutor.cpp:489:7
    #37 0x7f07367c3dab in nsHtml5ExecutorFlusher::Run() /home/worker/workspace/build/src/parser/html/nsHtml5StreamParser.cpp:128:9
    #38 0x7f0734931e5b in nsThread::ProcessNextEvent(bool, bool*) /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1216:7
    #39 0x7f07349b4d8c in NS_ProcessNextEvent(nsIThread*, bool) /home/worker/workspace/build/src/xpcom/glue/nsThreadUtils.cpp:361:10
    #40 0x7f073573e5cf in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /home/worker/workspace/build/src/ipc/glue/MessagePump.cpp:96:21
    #41 0x7f07356ae698 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:232:3
    #42 0x7f07356ae698 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:225
    #43 0x7f07356ae698 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:205
    #44 0x7f073ad6960f in nsBaseAppShell::Run() /home/worker/workspace/build/src/widget/nsBaseAppShell.cpp:156:3
    #45 0x7f073cda0781 in nsAppStartup::Run() /home/worker/workspace/build/src/toolkit/components/startup/nsAppStartup.cpp:283:19
    #46 0x7f073cf1fb5e in XREMain::XRE_mainRun() /home/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4467:10
    #47 0x7f073cf21072 in XREMain::XRE_main(int, char**, nsXREAppData const*) /home/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4600:8
    #48 0x7f073cf21f2c in XRE_main /home/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4691:16
    #49 0x4df8ca in do_main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:282:10
    #50 0x4df8ca in main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:415
    #51 0x7f074fc4582f in __libc_start_main /build/glibc-Qz8a69/glibc-2.23/csu/../csu/libc-start.c:291
    #52 0x41ba38 in _start (/home/ubuntu/firefox/firefox+0x41ba38)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/worker/workspace/build/src/memory/mozalloc/mozalloc_abort.cpp:33:5 in mozalloc_abort(char const*)
==5703==ABORTING
[Exit code: 1]

Comment 1

[Raymond Forbes[:rforbes]]

Attachment: Testcase

Comment 2

[Raymond Forbes[:rforbes]]

Attachment: reduced test case

Comment 3

[Peter Chang[:pchang]]

Ethan, please take a look.

Comment 4

[Ethan Lin[:ethlin]]

It looks like a division by zero problem in ANGLE validator. I'll check if it's fixed by new ANGLE.

Comment 5

[Ethan Lin[:ethlin]]

(In reply to Ethan Lin[:ethlin] from comment #4)
> It looks like a division by zero problem in ANGLE validator. I'll check if
> it's fixed by new ANGLE.

The problem is fixed after I updated ANGLE to 2920. We should have a ANGLE update for m-c and maybe cherry-pick the related commit to 51/52 for this bug.

Comment 6

[Ethan Lin[:ethlin]]

Bug 1319004 is fixed. I tested with the latest Nightly (2016-11-17) on windows and the web page looked fine.