695068 - crash [@ TOutputGLSLBase::writeVariableType]

Status: RESOLVED INCOMPLETE

(Core :: Graphics: CanvasWebGL, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-369df6da-06c1-4fbf-b17e-669862111014 .
============================================================= 
Frame 	Module 	Signature [Expand] 	Source
0 	libmozutils.so 	arena_dalloc 	memory/jemalloc/jemalloc.c:4306
1 	libmozutils.so 	__wrap_free 	memory/jemalloc/jemalloc.c:6260
2 	libmozalloc.so 	moz_free 	memory/mozalloc/mozalloc.cpp:98
3 	libxul.so 	std::__node_alloc::deallocate 	mozalloc.h:253
4 	libxul.so 	std::priv::_String_base<char, std::allocator<char> >::_M_deallocate_block 	_string_base.h:102
5 	libxul.so 	std::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_append 	_string_base.h:160
6 	libxul.so 	TInfoSinkBase::operator<< 	gfx/angle/src/compiler/InfoSink.h:66
7 	libxul.so 	TOutputGLSLBase::writeVariableType 	gfx/angle/src/compiler/OutputGLSLBase.cpp:125
8 	libxul.so 	TOutputGLSLBase::visitAggregate 	gfx/angle/src/compiler/OutputGLSLBase.cpp:539
9 	libxul.so 	TIntermAggregate::traverse 	gfx/angle/src/compiler/IntermTraverse.cpp:135
10 	libxul.so 	TOutputGLSLBase::visitAggregate 	gfx/angle/src/compiler/OutputGLSLBase.cpp:454
11 	libxul.so 	TIntermAggregate::traverse 	gfx/angle/src/compiler/IntermTraverse.cpp:135
12 	libxul.so 	TranslatorESSL::translate 	gfx/angle/src/compiler/OutputGLSLBase.h:17
13 	libxul.so 	TCompiler::compile 	gfx/angle/src/compiler/Compiler.cpp:181
14 	libxul.so 	ShCompile 	gfx/angle/src/compiler/ShaderLang.cpp:169
15 	libxul.so 	mozilla::WebGLContext::CompileShader 	content/canvas/src/WebGLContextGL.cpp:4063
16 	libxul.so 	nsIDOMWebGLRenderingContext_CompileShader 	obj-firefox/js/src/xpconnect/src/dom_quickstubs.cpp:29866
17 	libxul.so 	js::Interpret 	js/src/jscntxtinlines.h:301
18 	libxul.so 	js::RunScript 	js/src/jsinterp.cpp:614
19 	libxul.so 	js::Invoke 	js/src/vm/Stack.h:1000
20 	libxul.so 	JS_CallFunctionValue 	js/src/jscntxt.h:1306
21 	libxul.so 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:1930
22 	libxul.so 	nsJSEventListener::HandleEvent 	dom/src/events/nsJSEventListener.cpp:213
23 	libxul.so 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:740
24 	libxul.so 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:790
25 	libxul.so 	nsEventTargetChainItem::HandleEvent 	content/events/src/nsEventListenerManager.h:160
26 	libxul.so 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:346
27 	libxul.so 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:674
28 	libxul.so 	DocumentViewerImpl::LoadComplete 	layout/base/nsDocumentViewer.cpp:1068
29 	libxul.so 	nsDocShell::EndPageLoad 	docshell/base/nsDocShell.cpp:6162
30 	libxul.so 	nsDocShell::OnStateChange 	nsCOMPtr.h:515
31 	libxul.so 	nsDocLoader::DoFireOnStateChange 	uriloader/base/nsDocLoader.cpp:1367
32 	libxul.so 	nsDocLoader::doStopDocumentLoad 	uriloader/base/nsDocLoader.cpp:962
33 	libxul.so 	nsDocLoader::DocLoaderIsEmpty 	nsAutoPtr.h:1036
34 	libxul.so 	nsDocLoader::DocLoaderIsEmpty 	uriloader/base/nsDocLoader.cpp:857
35 	libxul.so 	nsDocLoader::OnStopRequest 	uriloader/base/nsDocLoader.cpp:740
36 	libxul.so 	nsLoadGroup::RemoveRequest 	netwerk/base/src/nsLoadGroup.cpp:734
37 	libxul.so 	nsDocument::DoUnblockOnload 	nsCOMPtr.h:515
38 	libxul.so 	nsDocument::UnblockOnload 	content/base/src/nsDocument.cpp:7165
39 	libxul.so 	nsLoadBlockingPLDOMEvent::~nsLoadBlockingPLDOMEvent 	nsCOMPtr.h:515
40 	libxul.so 	nsLoadBlockingPLDOMEvent::~nsLoadBlockingPLDOMEvent 	mozalloc.h:253
41 	libxul.so 	nsRunnable::Release 	obj-firefox/xpcom/build/nsThreadUtils.cpp:55
42 	libxul.so 	nsCOMPtr_base::~nsCOMPtr_base 	obj-firefox/xpcom/build/nsCOMPtr.cpp:82
43 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:639
44 	libxul.so 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:245
45 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:111
46 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	ipc/glue/MessagePump.cpp:230
47 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:209
48 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:487
49 	libxul.so 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:191
50 	libxul.so 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp:677
51 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	ipc/glue/MessagePump.cpp:222
52 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:209
53 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:487
54 	libxul.so 	XRE_InitChildProcess 	nsAutoPtr.h:155
55 	libmozutils.so 	ChildProcessInit 	other-licenses/android/APKOpen.cpp:787
56 	plugin-container 	main 	ipc/app/MozillaRuntimeMainAndroid.cpp:69
57 	libc.so 	libc.so@0x14a7a

related to Bug 684863?

Comment 1

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Also occurs in Native :
https://crash-stats.mozilla.com/report/index/6c869797-acfd-4634-98c6-fc1452111031

Comment 2

[Joe Drew (not getting mail)]

A crash in ANGLE I think?

Comment 3

[Dan Mosedale (:dmosedale, :dmose)]

I can see an almost identical stack on my Samsung Galaxy Tab 10.1 by going to <https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/demos/webkit/SpinningBox.html>.

Boy, I wish crash reports had tinyUrls.

Comment 4

[Dan Mosedale (:dmosedale, :dmose)]

Hmm, I may have miscorrelated the crash report and the URL and spoken too soon.  Investigating.

Comment 5

[Dan Mosedale (:dmosedale, :dmose)]

OK, I'm seeing this crash every time on my Motorola DroidX running a birch nightly on the spinning box demo.  Curiously, on the Galaxy Tab 10.1, it only hangs rather than crashing.

Comment 6

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

setting to P1 -> steps are reproducible (see comment 5)

Comment 7

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

smooney to talk to someone to have this bug assigned.

Comment 8

[Doug Sherk (:drs) (inactive)]

If this was a crash in ANGLE, it's possible that it's gone now as there's been an update a couple of days ago. Is it definitely reproducible right now with latest trunk?

Comment 9

[Dan Mosedale (:dmosedale, :dmose)]

It's reproducible right now with latest birch.  Is it actually possible to have both a birch nightly and a trunk nightly installed at the same time?  I've been assuming not.

Comment 10

[Doug Sherk (:drs) (inactive)]

Yeah it definitely makes sense that it should still be reproducible in birch. We can wait until tomorrow when birch gets merged into mozilla-central and then see if it's still happening then.

Comment 11

[Dan Mosedale (:dmosedale, :dmose)]

Still happens after having update to this morning's birch build.  :-(

Comment 12

[Dan Mosedale (:dmosedale, :dmose)]

Which, I assume, means that it should crash for you on trunk as well.

Comment 13

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

hasn't occurred in over 30 days.  closing as WFM.

Native:
https://crash-stats.mozilla.com/query/query?product=FennecAndroid&version=ALL%3AALL&range_value=30&range_unit=days&date=01%2F18%2F2012+16%3A00%3A24&query_search=signature&query_type=contains&query=TOutputGLSLBase%3A%3AwriteVariableType&reason=&build_id=&process_type=any&hang_type=any&do_query=1

XUL:
https://crash-stats.mozilla.com/query/query?product=Fennec&version=ALL%3AALL&range_value=30&range_unit=days&date=01%2F18%2F2012+16%3A00%3A24&query_search=signature&query_type=contains&query=TOutputGLSLBase%3A%3AwriteVariableType&reason=&build_id=&process_type=any&hang_type=any&do_query=1

Comment 14

[Scoobidiver (away)]

There have been crashes since the fix of bug 758010. It might be another form of bug 746794.

Comment 15

[u279076]

There are no reports of this crash with current Fennec builds. Please reopen this bug report if you can still reproduce the crash.