Crash @ TOutputESSL::writeVariablePrecision

RESOLVED FIXED in mozilla9

Status

()

Core
Graphics
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: nhirata, Unassigned)

Tracking

({crash, topcrash})

Trunk
mozilla9
ARM
Android
crash, topcrash
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [mobile-crash], [native-crash], crash signature)

This bug was filed from the Socorro interface and is 
report bp-2d52bcd0-13cd-4d01-994f-15d322110905 .
============================================================= 
Frame 	Module 	Signature [Expand] 	Source
0 	libc.so 	libc.so@0x15dd8 	
1 	libc.so 	libc.so@0x12bce 	
2 	libc.so 	libc.so@0x13748 	
3 	libc.so 	libc.so@0x1460c 	
4 	libstdc++.so 	libstdc++.so@0x9c6 	
5 	libxul.so 	TOutputESSL::writeVariablePrecision 	_new.h:135
6 	libxul.so 	TOutputGLSLBase::writeVariableType 	gfx/angle/src/compiler/OutputGLSLBase.cpp:123
7 	libxul.so 	TOutputGLSLBase::visitAggregate 	gfx/angle/src/compiler/OutputGLSLBase.cpp:539
8 	libxul.so 	TIntermAggregate::traverse 	gfx/angle/src/compiler/IntermTraverse.cpp:135
9 	libxul.so 	TOutputGLSLBase::visitAggregate 	gfx/angle/src/compiler/OutputGLSLBase.cpp:454
10 	libxul.so 	TIntermAggregate::traverse 	gfx/angle/src/compiler/IntermTraverse.cpp:135
11 	libxul.so 	TOutputGLSLBase::visitCodeBlock 	gfx/angle/src/compiler/OutputGLSLBase.cpp:707
12 	libxul.so 	TOutputGLSLBase::visitAggregate 	gfx/angle/src/compiler/intermediate.h:537
13 	libxul.so 	TIntermAggregate::traverse 	gfx/angle/src/compiler/IntermTraverse.cpp:135
14 	libxul.so 	TOutputGLSLBase::visitAggregate 	gfx/angle/src/compiler/OutputGLSLBase.cpp:454
15 	libxul.so 	TIntermAggregate::traverse 	gfx/angle/src/compiler/IntermTraverse.cpp:135
16 	libxul.so 	TranslatorESSL::translate 	gfx/angle/src/compiler/OutputGLSLBase.h:17
17 	libxul.so 	TCompiler::compile 	gfx/angle/src/compiler/Compiler.cpp:181
18 	libxul.so 	ShCompile 	gfx/angle/src/compiler/ShaderLang.cpp:169
19 	libxul.so 	mozilla::WebGLContext::CompileShader 	content/canvas/src/WebGLContextGL.cpp:3982
20 	libxul.so 	nsIDOMWebGLRenderingContext_CompileShader 	obj-firefox/js/src/xpconnect/src/dom_quickstubs.cpp:29783
21 	libxul.so 	js::Interpret 	js/src/jscntxtinlines.h:305
22 	libxul.so 	js::RunScript 	js/src/jsinterp.cpp:614
23 	libxul.so 	js::Invoke 	js/src/vm/Stack.h:985
24 	libxul.so 	JS_CallFunctionValue 	js/src/jscntxt.h:1310
25 	libxul.so 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:1917
26 	libxul.so 	nsJSEventListener::HandleEvent 	dom/src/events/nsJSEventListener.cpp:213
27 	libxul.so 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:727
28 	libxul.so 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:777
29 	libxul.so 	nsEventTargetChainItem::HandleEvent 	content/events/src/nsEventListenerManager.h:160
30 	libxul.so 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:346
31 	libxul.so 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:674
32 	libxul.so 	DocumentViewerImpl::LoadComplete 	layout/base/nsDocumentViewer.cpp:1068
33 	libxul.so 	nsDocShell::EndPageLoad 	docshell/base/nsDocShell.cpp:6162
34 	libxul.so 	nsDocShell::OnStateChange 	nsCOMPtr.h:482
35 	libxul.so 	nsDocLoader::FireOnStateChange 	uriloader/base/nsDocLoader.cpp:1323
36 	libxul.so 	nsDocLoader::doStopDocumentLoad 	uriloader/base/nsDocLoader.cpp:958
37 	libxul.so 	nsDocLoader::DocLoaderIsEmpty 	uriloader/base/nsDocLoader.cpp:825
38 	libxul.so 	nsDocLoader::OnStopRequest 	uriloader/base/nsDocLoader.cpp:711
39 	libxul.so 	nsLoadGroup::RemoveRequest 	netwerk/base/src/nsLoadGroup.cpp:734
40 	libxul.so 	nsDocument::DoUnblockOnload 	nsCOMPtr.h:482
41 	libxul.so 	nsDocument::UnblockOnload 	content/base/src/nsDocument.cpp:7173
42 	libxul.so 	nsDocument::DispatchContentLoadedEvents 	nsCOMPtr.h:482
43 	libxul.so 	nsRunnableMethodImpl<void , true>::Run 	nsThreadUtils.h:347
44 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
45 	libxul.so 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:245
46 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:111
47 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	ipc/glue/MessagePump.cpp:230
48 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:209
49 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:487
50 	libxul.so 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:191
51 	libxul.so 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp:673
52 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	ipc/glue/MessagePump.cpp:222
53 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:209
54 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:487
55 	libxul.so 	XRE_InitChildProcess 	nsAutoPtr.h:155
56 	libmozutils.so 	ChildProcessInit 	other-licenses/android/APKOpen.cpp:799
57 	plugin-container 	main 	ipc/app/MozillaRuntimeMainAndroid.cpp:69
58 	libc.so 	libc.so@0x14c84
new bug since the labor day weekend; 6th on the top 10 crashes in trunk.
Steps to repro on HoneyComb:
1. http://code.google.com/p/webglsamples/
2. open Aquarium link in a new tab

Expected: no content crash
Actual: content crash

Note:
1. content crash does not occur on Android 2.3

Mozilla/5.0 (Android; Linux armv7I; rv10.0a1) Gecko/20110928 Firefox/10.0a1 Fennec/10.0a1
Device: Toshiba Thrive
OS Android 3.1
Filed http://code.google.com/p/angleproject/issues/detail?id=219
Crash Signature: [@ libc.so@0x15dd8 ] [@ TOutputESSL::writeVariablePrecision ] → [@ libstdc++.so@0x9ae ] [@ libc.so@0x15dd8 ] [@ TOutputESSL::writeVariablePrecision ]
Duplicate of this bug: 701475
Crash Signature: [@ libstdc++.so@0x9ae ] [@ libc.so@0x15dd8 ] [@ TOutputESSL::writeVariablePrecision ] → [@ libstdc++.so@0x9ae ] [@ libc.so@0x15dd8 ] [@ TOutputESSL::writeVariablePrecision ] [@ __libc_android_abort | dlfree | free | _ZdlPv]
Keywords: topcrash
Whiteboard: [mobile-crash] → [mobile-crash], [native-crash]
Duplicate of this bug: 707619
Pinging the ANGLE devs (http://code.google.com/p/angleproject/issues/detail?id=219 ), this is very concerning.

Updated

6 years ago
Crash Signature: [@ libstdc++.so@0x9ae ] [@ libc.so@0x15dd8 ] [@ TOutputESSL::writeVariablePrecision ] [@ __libc_android_abort | dlfree | free | _ZdlPv] → [@ libstdc++.so@0x9ae ] [@ libc.so@0x15dd8 ] [@ TOutputESSL::writeVariablePrecision ] [@ __libc_android_abort | dlfree | free | _ZdlPv] [@ _ZdlPv]
I'm testing a patch that makes us revert to using the GLSL backend instead of the ESSL backend in the ANGLE compiler. Shouldn't make a behavior difference anyway, as on ES we're just passing the original shader source to the driver, but should fix this crash, as we won't be using the ESSL backend at all anymore, and it's clearly what's crashing here.

https://tbpl.mozilla.org/?tree=Try&rev=72ded8c7f176

Builds and logs will be available at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/bjacob@mozilla.com-72ded8c7f176
Depends on: 709947
Fixed by 709947
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED

Updated

6 years ago
Target Milestone: --- → mozilla11

Comment 9

6 years ago
I add missing crash signatures.
Crash Signature: [@ libstdc++.so@0x9ae ] [@ libc.so@0x15dd8 ] [@ TOutputESSL::writeVariablePrecision ] [@ __libc_android_abort | dlfree | free | _ZdlPv] [@ _ZdlPv] → [@ libstdc++.so@0x9c6] [@ libstdc++.so@0x9c5] [@ libstdc++.so@0x9ad] [@ libstdc++.so@0x9bd] [@ __libc_android_abort | dlfree | free | _ZdlPv] [@ dlfree | free | _ZdlPv] [@ dlfree | free | _ZdaPvRKSt9nothrow_t] [@ dlfree | calloc | _ZdlPv] [&hellip;
Summary: Crash Report [@ libc.so@0x15dd8 ] [@ TOutputESSL::writeVariablePrecision ] → Crash @ TOutputESSL::writeVariablePrecision
The fix has been backported to Gecko 9+
Target Milestone: mozilla11 → mozilla9

Updated

6 years ago
Depends on: 706006
You need to log in before you can comment on or make changes to this bug.