Closed Bug 575010 Opened 15 years ago Closed 12 years ago

reftest-d2d crash during or after aja-linear-3-ref.html or 518172-a-ref.html [@ arena_run_tree_remove]

Categories

(Core :: General, defect)

Product:
Core
Component:
General
Platform:
x86
Windows 7
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: philor, Unassigned)

References

Details

(Keywords: crash, intermittent-failure)

Crash Data

Attachments

(1 file)

Full crashdump
53.50 KB, text/plain
Details
Attached file Full crashdump —
(As always, I'm just guessing about components and who's a victim and who's to blame.) http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1277595612.1277596350.25429.gz Rev3 WINNT 6.1 mozilla-central opt test reftest-d2d on 2010/06/26 16:40:12 s: talos-r3-w7-039 REFTEST TEST-START | file:///c:/talos-slave/mozilla-central-win7-opt-u-reftest-d2d/build/reftest/tests/layout/reftests/css-gradients/aja-linear-3a.html REFTEST TEST-START | file:///c:/talos-slave/mozilla-central-win7-opt-u-reftest-d2d/build/reftest/tests/layout/reftests/css-gradients/aja-linear-3-ref.html REFTEST TEST-PASS | file:///c:/talos-slave/mozilla-central-win7-opt-u-reftest-d2d/build/reftest/tests/layout/reftests/css-gradients/aja-linear-3a.html | REFTEST INFO | Loading a blank page TEST-UNEXPECTED-FAIL | file:///c:/talos-slave/mozilla-central-win7-opt-u-reftest-d2d/build/reftest/tests/layout/reftests/css-gradients/aja-linear-3-ref.html | Exited with code -1073741819 during test run INFO | automation.py | Application ran for: 0:03:16.907000 INFO | automation.py | Reading PID log: c:\users\cltbld\appdata\local\temp\tmpjqtvlppidlog ==> process 3676 launched child process 1052 INFO | automation.py | Checking for orphan process with PID: 1052 TEST-UNEXPECTED-FAIL | automation.py | child process 1052 still alive after shutdown PROCESS-CRASH | file:///c:/talos-slave/mozilla-central-win7-opt-u-reftest-d2d/build/reftest/tests/layout/reftests/css-gradients/aja-linear-3-ref.html | application crashed (minidump found) Operating system: Windows NT 6.1.7600 CPU: x86 GenuineIntel family 6 model 23 stepping 10 2 CPUs Crash reason: EXCEPTION_ACCESS_VIOLATION Crash address: 0xb4 Thread 0 (crashed) 0 mozcrt19.dll!arena_run_tree_remove [jemalloc.c:0030881d9ad1 : 2741 + 0x13b] eip = 0x735c605b esp = 0x0025c7fc ebp = 0x04000514 ebx = 0x00000001 esi = 0x040004fc edi = 0xffffffff eax = 0x040004b4 ecx = 0x040004fd edx = 0x000000b0 efl = 0x00210206 Found by: given as instruction pointer in context 1 mozcrt19.dll!arena_bin_nonfull_run_get [jemalloc.c:0030881d9ad1 : 3457 + 0x6] eip = 0x735c8ed7 esp = 0x0025c824 ebp = 0x003d0040 ebx = 0x003d02a8 Found by: call frame info 2 mozcrt19.dll!arena_malloc_small [jemalloc.c:0030881d9ad1 : 3722 + 0x7] eip = 0x735c9082 esp = 0x0025c834 ebp = 0x003d0040 Found by: call frame info 3 mozcrt19.dll!malloc [jemalloc.c:0030881d9ad1 : 5811 + 0x2e] eip = 0x735c9a1d esp = 0x0025c84c ebp = 0x0060e340 ebx = 0x069dbb00 Found by: call frame info 4 mozjs.dll!js::NewObjectWithGivenProto [jsobjinlines.h:0030881d9ad1 : 655 + 0x7c] eip = 0x72eb9a49 esp = 0x0025c85c ebp = 0x0060e340 Found by: call frame info 5 mozjs.dll!js_InitClass [jsobj.cpp:0030881d9ad1 : 3495 + 0x1e] eip = 0x72eaaf94 esp = 0x0025c88c ebp = 0x0025c9cc Found by: call frame info 6 mozjs.dll!js_InitTypedArrayClasses [jstypedarray.cpp:0030881d9ad1 : 1408 + 0x22] eip = 0x72ec18e1 esp = 0x0025c9d4 ebp = 0x0025ca00 Found by: previous frame's frame pointer 7 mozjs.dll!JS_ResolveStandardClass [jsapi.cpp:0030881d9ad1 : 1451 + 0x5] eip = 0x72ecc01b esp = 0x0025ca08 ebp = 0x00629e00 Found by: previous frame's frame pointer 8 xul.dll!nsWindowSH::NewResolve(nsIXPConnectWrappedNative *,JSContext *,JSObject *,int,unsigned int,JSObject * *,int *) [nsDOMClassInfo.cpp:0030881d9ad1 : 6573 + 0x1b] eip = 0x69dc3e0c esp = 0x0025ca28 ebp = 0x0025ca90 Found by: call frame info with scanning 9 xul.dll!XPC_WN_Helper_NewResolve [xpcwrappednativejsops.cpp:0030881d9ad1 : 1221 + 0x1f] eip = 0x69dd7877 esp = 0x0025ca98 ebp = 0x0025cb8c Found by: previous frame's frame pointer 10 mozjs.dll!CallResolveOp [jsobj.cpp:0030881d9ad1 : 4421 + 0x18] eip = 0x72ea8ed0 esp = 0x0025cb94 ebp = 0x0025cbe8 Found by: previous frame's frame pointer 11 mozjs.dll!js_GetPropertyHelper [jsobj.cpp:0030881d9ad1 : 4854 + 0xca] eip = 0x72e96b97 esp = 0x0025cbf0 ebp = 0x0025cc70 Found by: previous frame's frame pointer 12 mozjs.dll!js_GetProperty [jsobj.cpp:0030881d9ad1 : 4938 + 0x19] eip = 0x72e968eb esp = 0x0025cc78 ebp = 0x0025cd18 Found by: previous frame's frame pointer 13 mozjs.dll!JS_GetProperty [jsapi.cpp:0030881d9ad1 : 3485 + 0x2c] eip = 0x72e7ba63 esp = 0x0025cc90 ebp = 0x0025cd18 Found by: call frame info 14 xul.dll!InitWebGLTypes [nsXPConnect.cpp:0030881d9ad1 : 1023 + 0x11] eip = 0x69e9810c esp = 0x0025cd20 ebp = 0x0025cf1c Found by: previous frame's frame pointer
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1277985987.1277987162.21606.gz Rev3 WINNT 6.1 mozilla-central opt test reftest-d2d on 2010/07/01 05:06:27 s: talos-r3-w7-037 TEST-UNEXPECTED-FAIL | http://localhost:4444/1277986810109/21/bugs/518172-a-ref.html | Exited with code -1073741819 during test run PROCESS-CRASH | http://localhost:4444/1277986810109/21/bugs/518172-a-ref.html | application crashed (minidump found) Thread 6 (crashed) Crash reason: EXCEPTION_ACCESS_VIOLATION Crash address: 0x20 Thread 6 (crashed) 0 mozcrt19.dll!arena_run_tree_remove [jemalloc.c:82edf5bd1abe : 2741 + 0x3cb] eip = 0x733262eb esp = 0x0291f64c ebp = 0x041001f0 ebx = 0x00000001 esi = 0x003b0220 edi = 0xffffffff eax = 0x040004b4 ecx = 0x00000020 edx = 0x00000021 efl = 0x00010202 Found by: given as instruction pointer in context 1 mozcrt19.dll!arena_bin_nonfull_run_get [jemalloc.c:82edf5bd1abe : 3457 + 0x6] eip = 0x73328ed7 esp = 0x0291f674 ebp = 0x003b0040 ebx = 0x003b0218 Found by: call frame info 2 mozcrt19.dll!arena_malloc_small [jemalloc.c:82edf5bd1abe : 3722 + 0x7] eip = 0x73329082 esp = 0x0291f684 ebp = 0x003b0040 Found by: call frame info 3 mozcrt19.dll!malloc [jemalloc.c:82edf5bd1abe : 5811 + 0x2e] eip = 0x73329a1d esp = 0x0291f69c ebp = 0x0291f6d4 ebx = 0x00000002 Found by: call frame info 4 xul.dll!nsProxyEventObject::convertMiniVariantToVariant(XPTMethodDescriptor const *,nsXPTCMiniVariant *,nsXPTCVariant * *,unsigned char *) [nsProxyEventObject.cpp:82edf5bd1abe : 149 + 0xe] eip = 0x6a51eac4 esp = 0x0291f6ac ebp = 0x0291f6d4 Found by: call frame info 5 xul.dll!nsProxyEventObject::CallMethod(unsigned short,XPTMethodDescriptor const *,nsXPTCMiniVariant *) [nsProxyEventObject.cpp:82edf5bd1abe : 212 + 0x19] eip = 0x6a52407a esp = 0x0291f6dc ebp = 0x038fce40 Found by: previous frame's frame pointer 6 xul.dll!PrepareAndDispatch [xptcstubs.cpp:82edf5bd1abe : 114 + 0x14] eip = 0x6a73ede2 esp = 0x0291f6fc ebp = 0x0291f718 Found by: call frame info with scanning 7 xul.dll!nsSocketTransport::InitWithConnectedSocket(PRFileDesc *,PRNetAddr const *) [nsSocketTransport2.cpp:82edf5bd1abe : 876 + 0xb] eip = 0x6ab6ede3 esp = 0x0291f720 ebp = 0x038a1e7c ebx = 0x003b0040 Found by: call frame info 8 xul.dll!nsSocketTransport::InitWithConnectedSocket(PRFileDesc *,PRNetAddr const *) [nsSocketTransport2.cpp:82edf5bd1abe : 877 + 0xc] eip = 0x6ab6edf0 esp = 0x0291f738 ebp = 0x038a1e7c Found by: stack scanning 9 ws2_32.dll + 0x305b eip = 0x77c1305c esp = 0x0291f740 ebp = 0x038a1e7c Found by: stack scanning 10 ws2_32.dll + 0x42ca eip = 0x77c142cb esp = 0x0291f74c ebp = 0x038a1e7c Found by: stack scanning 11 ntdll.dll + 0x57d96 eip = 0x77d97d97 esp = 0x0291f768 ebp = 0x038a1e7c Found by: stack scanning 12 ntdll.dll + 0xd7117 eip = 0x77e17118 esp = 0x0291f76c ebp = 0x038a1e7c Found by: stack scanning 13 mozcrt19.dll!arena_malloc_small [jemalloc.c:82edf5bd1abe : 3745 + 0x8] eip = 0x733290d9 esp = 0x0291f780 ebp = 0x038a1e7c Found by: stack scanning 14 xul.dll!SharedStub [xptcstubs.cpp:82edf5bd1abe : 141 + 0x4] eip = 0x6a73ee4c esp = 0x0291f7b0 ebp = 0x0291f7c4 ebx = 0x00000084 Found by: call frame info with scanning 15 xul.dll!nsServerSocket::OnSocketReady(PRFileDesc *,short) [nsServerSocket.cpp:82edf5bd1abe : 217 + 0x10] eip = 0x6ab6eeb7 esp = 0x0291f7cc ebp = 0x0291f7c4 Found by: call frame info with scanning These three incidents all point to heap corruption during the d2d reftests. It would be awesome if a win32 hacker could run these tests through Purify or a similar tool.
Summary: reftest-d2d crash during or after aja-linear-3-ref.html [@ arena_run_tree_remove] victimized by [@ InitWebGLTypes] → reftest-d2d crash during or after aja-linear-3-ref.html or 518172-a-ref.html [@ arena_run_tree_remove] (victimized by [@ InitWebGLTypes]?)
philringnalda%gmail.com http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1278050992.1278051753.14081.gz Rev3 WINNT 6.1 mozilla-central opt test reftest on 2010/07/01 23:09:52 s: talos-r3-w7-050 TEST-UNEXPECTED-FAIL | http://localhost:4444/1278051509906/21/bugs/518172-a-ref.html | Exited with code -1073741819 during test run PROCESS-CRASH | http://localhost:4444/1278051509906/21/bugs/518172-a-ref.html | application crashed (minidump found) Thread 0 (crashed)
Looks like there are two d2d and two non-d2d?
Component: Canvas: WebGL → General
QA Contact: canvas.webgl → general
Summary: reftest-d2d crash during or after aja-linear-3-ref.html or 518172-a-ref.html [@ arena_run_tree_remove] (victimized by [@ InitWebGLTypes]?) → reftest-d2d crash during or after aja-linear-3-ref.html or 518172-a-ref.html [@ arena_run_tree_remove]
Depends on: 778404
Whiteboard: [orange]
Keywords: crash
Crash Signature: [@ arena_run_tree_remove | arena_bin_nonfull_run_get | arena_malloc_small | malloc | js::NewObjectWithGivenProto]
Resolving WFM keyword:intermittent-failure bugs last modified >3 months ago, whose whiteboard contains none of: {random,disabled,marked,fuzzy,todo,fails,failing,annotated,time-bomb,leave open} There will inevitably be some false positives; for that (and the bugspam) I apologise. Filter on orangewfm.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: