Closed Bug 1317640 Opened 8 years ago Closed 8 years ago

Crash [@ mozalloc_abort]

Categories

(Core :: Graphics: CanvasWebGL, defect, P3)

x86_64
Linux
defect

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox52 --- affected

People

(Reporter: rforbes, Assigned: ethlin)

References

Details

(4 keywords, Whiteboard: [sg:dos][gfx-noted])

Crash Data

Attachments

(2 files)

The following testcase crashes on mozilla-inbound revision 20161109-310ae43d23b7 (build with (buildFlags not available), run with ): See attachment. Backtrace: Launch command: /home/ubuntu/firefox/firefox -no-remote -profile /tmp/ffprof_HJN4WI http://127.0.0.1:56637 J [5703] ###!!! ABORT: Divide by zero: file /home/worker/workspace/build/src/toolkit/xre/nsSigHandlers.cpp, line 156 ==5703==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffe5a11e000; bottom 0x7f07510c7000; size: 0x00f709057000 (1061008273408) False positive error reports may follow For details see https://github.com/google/sanitizers/issues/189 [5703] ###!!! ABORT: Divide by zero: file /home/worker/workspace/build/src/toolkit/xre/nsSigHandlers.cpp, line 156 ASAN:DEADLYSIGNAL ================================================================= ==5703==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000004e114b bp 0x7f07510c8550 sp 0x7f07510c8540 T0) #0 0x4e114a in mozalloc_abort(char const*) /home/worker/workspace/build/src/memory/mozalloc/mozalloc_abort.cpp:33:5 #1 0x7f07347e5da5 in Abort(char const*) /home/worker/workspace/build/src/xpcom/base/nsDebugImpl.cpp:449:3 #2 0x7f07347e5b4c in NS_DebugBreak /home/worker/workspace/build/src/xpcom/base/nsDebugImpl.cpp:405:7 #3 0x7f073cf3403a in fpehandler(int, siginfo*, void*) /home/worker/workspace/build/src/toolkit/xre/nsSigHandlers.cpp:156:5 #4 0x7f0750cac3df (/lib/x86_64-linux-gnu/libpthread.so.0+0x113df) #5 0x7f073da92d9b in TType::getObjectSize() const /home/worker/workspace/build/src/gfx/angle/src/compiler/translator/Types.cpp:331:40 #6 0x7f073da184da in TParseContext::checkConstructorArguments(TSourceLoc const&, TIntermNode*, TFunction const&, TOperator, TType const&) /home/worker/workspace/build/src/gfx/angle/src/compiler/translator/ParseContext.cpp:568:49 #7 0x7f073da2850b in TParseContext::addConstructor(TIntermNode*, TOperator, TFunction*, TSourceLoc const&) /home/worker/workspace/build/src/gfx/angle/src/compiler/translator/ParseContext.cpp:2352:10 #8 0x7f073da35e3e in TParseContext::addFunctionCallOrMethod(TFunction*, TIntermNode*, TIntermNode*, TSourceLoc const&, bool*) /home/worker/workspace/build/src/gfx/angle/src/compiler/translator/ParseContext.cpp:3787:20 #9 0x7f073d91e93e in yyparse(TParseContext*, void*) /home/worker/workspace/build/src/gfx/angle/src/compiler/translator/glslang_tab.cpp:2481:42 #10 0x7f073da382ee in PaParseStrings(unsigned long, char const* const*, int const*, TParseContext*) /home/worker/workspace/build/src/gfx/angle/src/compiler/translator/ParseContext.cpp:3955:17 #11 0x7f073d95dd74 in TCompiler::compileTreeImpl(char const* const*, unsigned long, unsigned long) /home/worker/workspace/build/src/gfx/angle/src/compiler/translator/Compiler.cpp:232:10 #12 0x7f073d962532 in TCompiler::compile(char const* const*, unsigned long, unsigned long) /home/worker/workspace/build/src/gfx/angle/src/compiler/translator/Compiler.cpp:418:25 #13 0x7f07392c3b2c in ValidateAndTranslate /home/worker/workspace/build/src/dom/canvas/WebGLShaderValidator.cpp:205:12 #14 0x7f07392c3b2c in Translate /home/worker/workspace/build/src/dom/canvas/WebGLShader.cpp:28 #15 0x7f07392c3b2c in mozilla::WebGLShader::CompileShader() /home/worker/workspace/build/src/dom/canvas/WebGLShader.cpp:217 #16 0x7f0738792917 in mozilla::dom::WebGLRenderingContextBinding::compileShader(JSContext*, JS::Handle<JSObject*>, mozilla::WebGLContext*, JSJitMethodCallArgs const&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/WebGLRenderingContextBinding.cpp:12125:3 #17 0x7f0739066d30 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:2879:13 #18 0x7f073f3ec74c in CallJSNative /home/worker/workspace/build/src/js/src/jscntxtinlines.h:239:15 #19 0x7f073f3ec74c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:447 #20 0x7f073f3cc893 in CallFromStack /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:510:12 #21 0x7f073f3cc893 in Interpret(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2922 #22 0x7f073f3b1986 in js::RunScript(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:405:12 #23 0x7f073f3ef212 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:686:15 #24 0x7f073f3efaab in js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:718:12 #25 0x7f073eee2194 in Evaluate(JSContext*, js::ScopeKind, JS::Handle<JSObject*>, JS::ReadOnlyCompileOptions const&, JS::SourceBufferHolder&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/jsapi.cpp:4415:19 #26 0x7f073eee2eeb in Evaluate /home/worker/workspace/build/src/js/src/jsapi.cpp:4442:12 #27 0x7f073eee2eeb in JS::Evaluate(JSContext*, JS::AutoObjectVector&, JS::ReadOnlyCompileOptions const&, JS::SourceBufferHolder&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/jsapi.cpp:4500 #28 0x7f07376c4287 in nsJSUtils::EvaluateString(JSContext*, JS::SourceBufferHolder&, JS::Handle<JSObject*>, JS::CompileOptions&, nsJSUtils::EvaluateOptions const&, JS::MutableHandle<JS::Value>, void**) /home/worker/workspace/build/src/dom/base/nsJSUtils.cpp:207:12 #29 0x7f07376c5499 in nsJSUtils::EvaluateString(JSContext*, JS::SourceBufferHolder&, JS::Handle<JSObject*>, JS::CompileOptions&, void**) /home/worker/workspace/build/src/dom/base/nsJSUtils.cpp:274:10 #30 0x7f0737750481 in nsScriptLoader::EvaluateScript(nsScriptLoadRequest*) /home/worker/workspace/build/src/dom/base/nsScriptLoader.cpp:2193:14 #31 0x7f073774d2b1 in nsScriptLoader::ProcessRequest(nsScriptLoadRequest*) /home/worker/workspace/build/src/dom/base/nsScriptLoader.cpp:1979:10 #32 0x7f0737734681 in nsScriptLoader::ProcessScriptElement(nsIScriptElement*) /home/worker/workspace/build/src/dom/base/nsScriptLoader.cpp:1712:10 #33 0x7f0737731002 in nsScriptElement::MaybeProcessScript() /home/worker/workspace/build/src/dom/base/nsScriptElement.cpp:149:10 #34 0x7f07367c0c64 in AttemptToExecute /home/worker/workspace/build/src/dom/base/nsIScriptElement.h:222:18 #35 0x7f07367c0c64 in nsHtml5TreeOpExecutor::RunScript(nsIContent*) /home/worker/workspace/build/src/parser/html/nsHtml5TreeOpExecutor.cpp:666 #36 0x7f07367bf3d5 in nsHtml5TreeOpExecutor::RunFlushLoop() /home/worker/workspace/build/src/parser/html/nsHtml5TreeOpExecutor.cpp:489:7 #37 0x7f07367c3dab in nsHtml5ExecutorFlusher::Run() /home/worker/workspace/build/src/parser/html/nsHtml5StreamParser.cpp:128:9 #38 0x7f0734931e5b in nsThread::ProcessNextEvent(bool, bool*) /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1216:7 #39 0x7f07349b4d8c in NS_ProcessNextEvent(nsIThread*, bool) /home/worker/workspace/build/src/xpcom/glue/nsThreadUtils.cpp:361:10 #40 0x7f073573e5cf in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /home/worker/workspace/build/src/ipc/glue/MessagePump.cpp:96:21 #41 0x7f07356ae698 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:232:3 #42 0x7f07356ae698 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:225 #43 0x7f07356ae698 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:205 #44 0x7f073ad6960f in nsBaseAppShell::Run() /home/worker/workspace/build/src/widget/nsBaseAppShell.cpp:156:3 #45 0x7f073cda0781 in nsAppStartup::Run() /home/worker/workspace/build/src/toolkit/components/startup/nsAppStartup.cpp:283:19 #46 0x7f073cf1fb5e in XREMain::XRE_mainRun() /home/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4467:10 #47 0x7f073cf21072 in XREMain::XRE_main(int, char**, nsXREAppData const*) /home/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4600:8 #48 0x7f073cf21f2c in XRE_main /home/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4691:16 #49 0x4df8ca in do_main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:282:10 #50 0x4df8ca in main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:415 #51 0x7f074fc4582f in __libc_start_main /build/glibc-Qz8a69/glibc-2.23/csu/../csu/libc-start.c:291 #52 0x41ba38 in _start (/home/ubuntu/firefox/firefox+0x41ba38) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /home/worker/workspace/build/src/memory/mozalloc/mozalloc_abort.cpp:33:5 in mozalloc_abort(char const*) ==5703==ABORTING [Exit code: 1]
Attached file Testcase
Attached file reduced test case
Group: gfx-core-security
Group: gfx-core-security
Keywords: csectype-dos
Whiteboard: [sg:dos]
Ethan, please take a look.
Assignee: nobody → ethlin
Priority: -- → P3
Whiteboard: [sg:dos] → [sg:dos][gfx-noted]
It looks like a division by zero problem in ANGLE validator. I'll check if it's fixed by new ANGLE.
(In reply to Ethan Lin[:ethlin] from comment #4) > It looks like a division by zero problem in ANGLE validator. I'll check if > it's fixed by new ANGLE. The problem is fixed after I updated ANGLE to 2920. We should have a ANGLE update for m-c and maybe cherry-pick the related commit to 51/52 for this bug.
See Also: → 1316533
Depends on: 1319004
Bug 1319004 is fixed. I tested with the latest Nightly (2016-11-17) on windows and the web page looked fine.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: