reftest-d2d crash during or after aja-linear-3-ref.html or 518172-a-ref.html [@ arena_run_tree_remove]

RESOLVED WORKSFORME

Status

()

RESOLVED WORKSFORME
9 years ago
6 years ago

People

(Reporter: philor, Unassigned)

Tracking

({crash, intermittent-failure})

Trunk
x86
Windows 7
crash, intermittent-failure
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

9 years ago
Created attachment 454310 [details]
Full crashdump

(As always, I'm just guessing about components and who's a victim and who's to blame.)

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1277595612.1277596350.25429.gz
Rev3 WINNT 6.1 mozilla-central opt test reftest-d2d on 2010/06/26 16:40:12
s: talos-r3-w7-039

REFTEST TEST-START | file:///c:/talos-slave/mozilla-central-win7-opt-u-reftest-d2d/build/reftest/tests/layout/reftests/css-gradients/aja-linear-3a.html
REFTEST TEST-START | file:///c:/talos-slave/mozilla-central-win7-opt-u-reftest-d2d/build/reftest/tests/layout/reftests/css-gradients/aja-linear-3-ref.html
REFTEST TEST-PASS | file:///c:/talos-slave/mozilla-central-win7-opt-u-reftest-d2d/build/reftest/tests/layout/reftests/css-gradients/aja-linear-3a.html |
REFTEST INFO | Loading a blank page
TEST-UNEXPECTED-FAIL | file:///c:/talos-slave/mozilla-central-win7-opt-u-reftest-d2d/build/reftest/tests/layout/reftests/css-gradients/aja-linear-3-ref.html | Exited with code -1073741819 during test run
INFO | automation.py | Application ran for: 0:03:16.907000
INFO | automation.py | Reading PID log: c:\users\cltbld\appdata\local\temp\tmpjqtvlppidlog
==> process 3676 launched child process 1052
INFO | automation.py | Checking for orphan process with PID: 1052
TEST-UNEXPECTED-FAIL | automation.py | child process 1052 still alive after shutdown
PROCESS-CRASH | file:///c:/talos-slave/mozilla-central-win7-opt-u-reftest-d2d/build/reftest/tests/layout/reftests/css-gradients/aja-linear-3-ref.html | application crashed (minidump found)
Operating system: Windows NT
                  6.1.7600 
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXCEPTION_ACCESS_VIOLATION
Crash address: 0xb4

Thread 0 (crashed)
 0  mozcrt19.dll!arena_run_tree_remove [jemalloc.c:0030881d9ad1 : 2741 + 0x13b]
    eip = 0x735c605b   esp = 0x0025c7fc   ebp = 0x04000514   ebx = 0x00000001
    esi = 0x040004fc   edi = 0xffffffff   eax = 0x040004b4   ecx = 0x040004fd
    edx = 0x000000b0   efl = 0x00210206
    Found by: given as instruction pointer in context
 1  mozcrt19.dll!arena_bin_nonfull_run_get [jemalloc.c:0030881d9ad1 : 3457 + 0x6]
    eip = 0x735c8ed7   esp = 0x0025c824   ebp = 0x003d0040   ebx = 0x003d02a8
    Found by: call frame info
 2  mozcrt19.dll!arena_malloc_small [jemalloc.c:0030881d9ad1 : 3722 + 0x7]
    eip = 0x735c9082   esp = 0x0025c834   ebp = 0x003d0040
    Found by: call frame info
 3  mozcrt19.dll!malloc [jemalloc.c:0030881d9ad1 : 5811 + 0x2e]
    eip = 0x735c9a1d   esp = 0x0025c84c   ebp = 0x0060e340   ebx = 0x069dbb00
    Found by: call frame info
 4  mozjs.dll!js::NewObjectWithGivenProto [jsobjinlines.h:0030881d9ad1 : 655 + 0x7c]
    eip = 0x72eb9a49   esp = 0x0025c85c   ebp = 0x0060e340
    Found by: call frame info
 5  mozjs.dll!js_InitClass [jsobj.cpp:0030881d9ad1 : 3495 + 0x1e]
    eip = 0x72eaaf94   esp = 0x0025c88c   ebp = 0x0025c9cc
    Found by: call frame info
 6  mozjs.dll!js_InitTypedArrayClasses [jstypedarray.cpp:0030881d9ad1 : 1408 + 0x22]
    eip = 0x72ec18e1   esp = 0x0025c9d4   ebp = 0x0025ca00
    Found by: previous frame's frame pointer
 7  mozjs.dll!JS_ResolveStandardClass [jsapi.cpp:0030881d9ad1 : 1451 + 0x5]
    eip = 0x72ecc01b   esp = 0x0025ca08   ebp = 0x00629e00
    Found by: previous frame's frame pointer
 8  xul.dll!nsWindowSH::NewResolve(nsIXPConnectWrappedNative *,JSContext *,JSObject *,int,unsigned int,JSObject * *,int *) [nsDOMClassInfo.cpp:0030881d9ad1 : 6573 + 0x1b]
    eip = 0x69dc3e0c   esp = 0x0025ca28   ebp = 0x0025ca90
    Found by: call frame info with scanning
 9  xul.dll!XPC_WN_Helper_NewResolve [xpcwrappednativejsops.cpp:0030881d9ad1 : 1221 + 0x1f]
    eip = 0x69dd7877   esp = 0x0025ca98   ebp = 0x0025cb8c
    Found by: previous frame's frame pointer
10  mozjs.dll!CallResolveOp [jsobj.cpp:0030881d9ad1 : 4421 + 0x18]
    eip = 0x72ea8ed0   esp = 0x0025cb94   ebp = 0x0025cbe8
    Found by: previous frame's frame pointer
11  mozjs.dll!js_GetPropertyHelper [jsobj.cpp:0030881d9ad1 : 4854 + 0xca]
    eip = 0x72e96b97   esp = 0x0025cbf0   ebp = 0x0025cc70
    Found by: previous frame's frame pointer
12  mozjs.dll!js_GetProperty [jsobj.cpp:0030881d9ad1 : 4938 + 0x19]
    eip = 0x72e968eb   esp = 0x0025cc78   ebp = 0x0025cd18
    Found by: previous frame's frame pointer
13  mozjs.dll!JS_GetProperty [jsapi.cpp:0030881d9ad1 : 3485 + 0x2c]
    eip = 0x72e7ba63   esp = 0x0025cc90   ebp = 0x0025cd18
    Found by: call frame info
14  xul.dll!InitWebGLTypes [nsXPConnect.cpp:0030881d9ad1 : 1023 + 0x11]
    eip = 0x69e9810c   esp = 0x0025cd20   ebp = 0x0025cf1c
    Found by: previous frame's frame pointer
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1277985987.1277987162.21606.gz
Rev3 WINNT 6.1 mozilla-central opt test reftest-d2d on 2010/07/01 05:06:27  
s: talos-r3-w7-037
TEST-UNEXPECTED-FAIL | http://localhost:4444/1277986810109/21/bugs/518172-a-ref.html | Exited with code -1073741819 during test run
PROCESS-CRASH | http://localhost:4444/1277986810109/21/bugs/518172-a-ref.html | application crashed (minidump found)
Thread 6 (crashed)

Crash reason:  EXCEPTION_ACCESS_VIOLATION
Crash address: 0x20

Thread 6 (crashed)
 0  mozcrt19.dll!arena_run_tree_remove [jemalloc.c:82edf5bd1abe : 2741 + 0x3cb]
    eip = 0x733262eb   esp = 0x0291f64c   ebp = 0x041001f0   ebx = 0x00000001
    esi = 0x003b0220   edi = 0xffffffff   eax = 0x040004b4   ecx = 0x00000020
    edx = 0x00000021   efl = 0x00010202
    Found by: given as instruction pointer in context
 1  mozcrt19.dll!arena_bin_nonfull_run_get [jemalloc.c:82edf5bd1abe : 3457 + 0x6]
    eip = 0x73328ed7   esp = 0x0291f674   ebp = 0x003b0040   ebx = 0x003b0218
    Found by: call frame info
 2  mozcrt19.dll!arena_malloc_small [jemalloc.c:82edf5bd1abe : 3722 + 0x7]
    eip = 0x73329082   esp = 0x0291f684   ebp = 0x003b0040
    Found by: call frame info
 3  mozcrt19.dll!malloc [jemalloc.c:82edf5bd1abe : 5811 + 0x2e]
    eip = 0x73329a1d   esp = 0x0291f69c   ebp = 0x0291f6d4   ebx = 0x00000002
    Found by: call frame info
 4  xul.dll!nsProxyEventObject::convertMiniVariantToVariant(XPTMethodDescriptor const *,nsXPTCMiniVariant *,nsXPTCVariant * *,unsigned char *) [nsProxyEventObject.cpp:82edf5bd1abe : 149 + 0xe]
    eip = 0x6a51eac4   esp = 0x0291f6ac   ebp = 0x0291f6d4
    Found by: call frame info
 5  xul.dll!nsProxyEventObject::CallMethod(unsigned short,XPTMethodDescriptor const *,nsXPTCMiniVariant *) [nsProxyEventObject.cpp:82edf5bd1abe : 212 + 0x19]
    eip = 0x6a52407a   esp = 0x0291f6dc   ebp = 0x038fce40
    Found by: previous frame's frame pointer
 6  xul.dll!PrepareAndDispatch [xptcstubs.cpp:82edf5bd1abe : 114 + 0x14]
    eip = 0x6a73ede2   esp = 0x0291f6fc   ebp = 0x0291f718
    Found by: call frame info with scanning
 7  xul.dll!nsSocketTransport::InitWithConnectedSocket(PRFileDesc *,PRNetAddr const *) [nsSocketTransport2.cpp:82edf5bd1abe : 876 + 0xb]
    eip = 0x6ab6ede3   esp = 0x0291f720   ebp = 0x038a1e7c   ebx = 0x003b0040
    Found by: call frame info
 8  xul.dll!nsSocketTransport::InitWithConnectedSocket(PRFileDesc *,PRNetAddr const *) [nsSocketTransport2.cpp:82edf5bd1abe : 877 + 0xc]
    eip = 0x6ab6edf0   esp = 0x0291f738   ebp = 0x038a1e7c
    Found by: stack scanning
 9  ws2_32.dll + 0x305b
    eip = 0x77c1305c   esp = 0x0291f740   ebp = 0x038a1e7c
    Found by: stack scanning
10  ws2_32.dll + 0x42ca
    eip = 0x77c142cb   esp = 0x0291f74c   ebp = 0x038a1e7c
    Found by: stack scanning
11  ntdll.dll + 0x57d96
    eip = 0x77d97d97   esp = 0x0291f768   ebp = 0x038a1e7c
    Found by: stack scanning
12  ntdll.dll + 0xd7117
    eip = 0x77e17118   esp = 0x0291f76c   ebp = 0x038a1e7c
    Found by: stack scanning
13  mozcrt19.dll!arena_malloc_small [jemalloc.c:82edf5bd1abe : 3745 + 0x8]
    eip = 0x733290d9   esp = 0x0291f780   ebp = 0x038a1e7c
    Found by: stack scanning
14  xul.dll!SharedStub [xptcstubs.cpp:82edf5bd1abe : 141 + 0x4]
    eip = 0x6a73ee4c   esp = 0x0291f7b0   ebp = 0x0291f7c4   ebx = 0x00000084
    Found by: call frame info with scanning
15  xul.dll!nsServerSocket::OnSocketReady(PRFileDesc *,short) [nsServerSocket.cpp:82edf5bd1abe : 217 + 0x10]
    eip = 0x6ab6eeb7   esp = 0x0291f7cc   ebp = 0x0291f7c4
    Found by: call frame info with scanning


These three incidents all point to heap corruption during the d2d reftests.  It would be awesome if a win32 hacker could run these tests through Purify or a similar tool.
Summary: reftest-d2d crash during or after aja-linear-3-ref.html [@ arena_run_tree_remove] victimized by [@ InitWebGLTypes] → reftest-d2d crash during or after aja-linear-3-ref.html or 518172-a-ref.html [@ arena_run_tree_remove] (victimized by [@ InitWebGLTypes]?)
(Reporter)

Comment 3

9 years ago
philringnalda%gmail.com
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1278050992.1278051753.14081.gz
Rev3 WINNT 6.1 mozilla-central opt test reftest on 2010/07/01 23:09:52

s: talos-r3-w7-050
TEST-UNEXPECTED-FAIL | http://localhost:4444/1278051509906/21/bugs/518172-a-ref.html | Exited with code -1073741819 during test run
PROCESS-CRASH | http://localhost:4444/1278051509906/21/bugs/518172-a-ref.html | application crashed (minidump found)
Thread 0 (crashed)
Looks like there are two d2d and two non-d2d?
Component: Canvas: WebGL → General
QA Contact: canvas.webgl → general
Summary: reftest-d2d crash during or after aja-linear-3-ref.html or 518172-a-ref.html [@ arena_run_tree_remove] (victimized by [@ InitWebGLTypes]?) → reftest-d2d crash during or after aja-linear-3-ref.html or 518172-a-ref.html [@ arena_run_tree_remove]

Updated

6 years ago
Depends on: 778404
Keywords: intermittent-failure
Whiteboard: [orange]

Updated

6 years ago
Crash Signature: [@ arena_run_tree_remove | arena_bin_nonfull_run_get | arena_malloc_small | malloc | js::NewObjectWithGivenProto]
Resolving WFM keyword:intermittent-failure bugs last modified >3 months ago, whose whiteboard contains none of:
{random,disabled,marked,fuzzy,todo,fails,failing,annotated,time-bomb,leave open}

There will inevitably be some false positives; for that (and the bugspam) I apologise. Filter on orangewfm.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.