Closed Bug 563343 Opened 14 years ago Closed 10 years ago

Firefox crash [@ dtoa ]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
major

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: chofmann, Unassigned)

Details

(Keywords: crash)

Crash Data

noticed while looking at 3.6.4 data (#35 topcrash), but this is around in previous releases.  #51 in 3.6.4.

checking --- ^dtoa 20100502-crashdata.csv
found in: 3.6.3 3.5.9 3.6 3.7a5pre 3.6.4 3.6b3 3.6.2 3.5.8 3.5.2 3.6b2 3.5.3 3.6b4 3.5 3.5.7 3.5.6 3.0.3 3.0.19
release total-crashes
              ^dtoa crashes
                         pct.
all     364268  798     0.00219069
3.6.3   255580  650     0.00254323
3.5.9   34026   81      0.00238053
3.6     14089   23      0.00163248
3.7a5pre        1928    8       0.00414938
3.6.4   15611   10      0.000640574
3.6b3   377     6       0.0159151
3.6.2   5047    9       0.00178324
3.5.8   1674    4       0.00238949
3.5.2   996     4       0.00401606



http://crash-stats.mozilla.com/report/index/01069c01-5c42-41cc-86f6-b03ad2100502

Frame  	Module  	Signature [Expand]  	Source
0 	js3250.dll 	dtoa 	js/src/dtoa.c:3024
1 	js3250.dll 	JS_dtostr 	js/src/jsdtoa.cpp:164
2 	js3250.dll 	Str 	js/src/json.cpp:474
3 	js3250.dll 	JO 	js/src/json.cpp:349
4 	js3250.dll 	Str 	js/src/json.cpp:492
5 	js3250.dll 	JO 	js/src/json.cpp:349
6 	js3250.dll 	Str 	js/src/json.cpp:492
7 	js3250.dll 	js_Stringify 	js/src/json.cpp:548
8 	js3250.dll 	js_json_stringify 	js/src/json.cpp:133
9 	js3250.dll 	js_Interpret 	js/src/jsops.cpp:2208
10 	js3250.dll 	js_Invoke 	js/src/jsinterp.cpp:1368
11 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1696
12 	xul.dll 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:570
13 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114
14 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141
15 	nspr4.dll 	nspr4.dll@0xccef 	
16 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:435
17 	xul.dll 	xul.dll@0x9b3f63 	
18 	nspr4.dll 	_PR_MD_UNLOCK 	nsprpub/pr/src/md/windows/w95cv.c:344
19 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:519
20 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:527
21 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:142
22 	xul.dll 	xul.dll@0x9a4307 	
23 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:199
24 	mozcrt19.dll 	malloc 	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:5790
25 	xul.dll 	xul.dll@0x307d13 	
26 	xul.dll 	xul.dll@0x34e7e9 	
27 	firefox.exe 	firefox.exe@0x1b97 	
28 	ntdll.dll 	ntdll.dll@0x7041c 	
29 	ntdll.dll 	ntdll.dll@0x39d44 	
30 	firefox.exe 	firefox.exe@0x183f 	
31 	firefox.exe 	firefox.exe@0x183f 	

more at http://crash-stats.mozilla.com/report/list?version=Firefox%3A3.6.4&signature=dtoa

comments:

I was on Yahoo while listining to music and all of a sudden all of the icons go dark and so does the page.

Dell website, "My Support"

i was playing doom 2 and then this

domains of sites
  41 \N//
  32 http://www.ninjavideo.net
  30 http://www.miniclip.com
  29 //
  24 http://stagevu.com
  19 http://www.facebook.com
  17 http://www.youtube.com
  15 http://www.jeux.fr
  15 http://www.gry.pl
  15 http://apps.facebook.com
  14 http://www.minijuegos.com
  13 http://www.movshare.net

sample of test urls
   1 http://www.ninjavideo.net/video/65881
   1 http://www.ninjavideo.net/video/65858
   1 http://www.ninjavideo.net/video/65843
   1 http://www.ninjavideo.net/video/65823
   1 http://www.ninjavideo.net/video/65822
   1 http://www.ninjavideo.net/video/65793
   1 http://www.ninjavideo.net/video/65614
   1 http://www.ninjavideo.net/video/65587
   1 http://www.ninjavideo.net/video/65126
   1 http://www.ninjavideo.net/video/64987
   1 http://www.ninjavideo.net/video/64432

   1 http://www.miniclip.com/games/snowball-warfare/en/
   1 http://www.miniclip.com/games/sky-golf/ro/
   1 http://www.miniclip.com/games/sky-golf/de/
   1 http://www.miniclip.com/games/show-jumping/en/
   1 http://www.miniclip.com/games/sewer-run/hu/
   1 http://www.miniclip.com/games/run-the-rapids/es/
   1 http://www.miniclip.com/games/police-chopper/en/
   1 http://www.miniclip.com/games/motocross-country-fever/en/

   1 http://www.jeux.fr/jeu/horse-race.html
   1 http://www.jeux.fr/jeu/ffx-runner.html
   1 http://www.jeux.fr/jeu/R-Style-Supreme-2.html
   1 http://www.jeux.fr/jeu/Designer-Trends-3D.html
   1 http://www.jeux.fr/jeu/Cannons-Yo-Ho.html
   1 http://www.jeux.fr/jeu/3d-penalty.html
Keywords: crash
OS: Mac OS X → Windows XP
I just received this crash on www.shacknews.com. It partially loads the page, the entire browser hangs and eventually crashes:

http://crash-stats.mozilla.com/report/index/63117337-a1a5-4f38-a0c4-17dfc2100511

I haven't seen it anywhere else.
I can get this consistently by going here: http://www.wolframalpha.com/input/?i=2048!%2F%28256!+*+%282048+-+256%29!%29

Wait for the page to load then try and scroll. It freezes then crashes.
Seem to be hitting this quite often again in recent builds. First time it has been this common since my last post.
Severity: normal → major
I get this crash only when I'm connected to a VPN using VPN Dialer 4.8.00.0440

On the Firefox Restore screen, I removed Progress Quest and all LAN websites, but still got the crash.

Disconnected from the VPN and restarted, no crash.
The crash reports in comment 0 and comment 2 both blame this line of code in dtoa.c:

    if (i == ilim) {

which is odd because 'i' and 'ilim' are both integers, so I don't see how that line could cause a crash.
so, we've run into problems in dtoa involving VPN kernel drivers mucking w/ system state. the results are painful to debug and entirely not our fault. We are not capable of defending ourselves against rogue or buggy kernel drivers.

Comment 4 points to this problem.
(In reply to comment #6)
> so, we've run into problems in dtoa involving VPN kernel drivers mucking w/
> system state. the results are painful to debug and entirely not our fault. We
> are not capable of defending ourselves against rogue or buggy kernel drivers.

Yuk!  Is there any reason why this tends to show up in dtoa?  Or does it show up in other places too?
Dtoa is sensitive to floating point precision changes and floating point state. Third party libraries tend to mess up the former. VPN drivers tend to corrupt the latter. 

We can in theory do something about third party libraries, by blocklisting them -- but that doesn't work for drivers (we don't see them, can't stop them etc.).

I believe we might see them somewhere else too, but dtoa is definitely the primary spot where these problems are seen. iirc the floating point precision flavor can appear somewhere else in JS land too. I think part of the reason we see it in dtoa is that it runs often...
This hovers around #40 on 3.6, the correlations in https://crash-stats.mozilla.com/report/list?signature=dtoa&version=Firefox%3A3.6.17 have a few relatively strong indicators of third-party libs disturbing us here. Can we do something to make us less vulnerable of this?
Crash Signature: [@ dtoa ]
I got this crash when restarting a sessoin after FF crashed related to the CISCO VPN problem. I get into crash reporter - which cannot send the report - and press to restart FF. Then I went into "restore windows" and bang FF is gone again.
Usually I get the "cairo" variation of crash, now the first time dtoa. It can very well be that Cisco and its old 4.xxx VPN client is to blame. BUT, 1. I cannot change it (large corporation) 2. IE does not crash. I hate to use it, but have to as FF is crashing on me 10 times a day.
I've never seen a crash signature with useless crash comments in my life - https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=dtoa&reason_type=contains&date=12%2F10%2F2012%2021%3A10%3A07&range_value=4&range_unit=weeks&hang_type=any&process_type=all&do_query=1&signature=dtoa

no correlations. 
for all releases, 95% winxp.
for current releases only 43 crashes in past month, 63% are XP

most crashes cite youtube and facebook, plus comments about movies.
The vast majority of crashes are version 3.x and 10.x. And the few stacks I looked at for current versions don't align with this bug report.

So I suggest this is WFM. Or needs refocus
Flags: needinfo?(kairo)
https://crash-stats.mozilla.com/report/list?signature=dtoa

65 crashes all in all over the last 7 days, 5 of which are in versions newer than Fx10. I agree.
Status: NEW → RESOLVED
Closed: 10 years ago
Flags: needinfo?(kairo)
Resolution: --- → WORKSFORME
I'm experiencing the same problem on a few websites such as http://www.lacasacofidis.es/, http://www.mundijuegos.com/ and http://rockapproll.com/apps/action-games.
(In reply to Almudena from comment #15)
> I'm experiencing the same problem on a few websites such as
> http://www.lacasacofidis.es/, http://www.mundijuegos.com/ and
> http://rockapproll.com/apps/action-games.

Are you sure it's the same crash? During the last week, we have had a total of two reported crashes with this signature in recent versions of Firefox.
(In reply to David Rajchenbach-Teller [:Yoric] (away until November 17th - use "needinfo") from comment #16)
> (In reply to Almudena from comment #15)
> > I'm experiencing the same problem on a few websites such as
> > http://www.lacasacofidis.es/, http://www.mundijuegos.com/ and
> > http://rockapproll.com/apps/action-games.
> 
> Are you sure it's the same crash? During the last week, we have had a total
> of two reported crashes with this signature in recent versions of Firefox.

Ok, I will review if it is the same crash, thank you!
You need to log in before you can comment on or make changes to this bug.