752829 - crash in mozilla::WebGLContext::CompileShader

Status: RESOLVED DUPLICATE of bug 746794

(Core :: Graphics: CanvasWebGL, defect)

Description

[Scoobidiver (away)]

There are three crashes starting in 15.0a1/20120506.

Signature 	arena_dalloc | huge_dalloc More Reports Search
UUID	a0a0a3ef-3b50-4408-8eb3-083662120508
Date Processed	2012-05-08 06:09:55
Uptime	98
Install Age	3.0 hours since version was first installed.
Install Time	2012-05-08 03:07:53
Product	FennecAndroid
Version	15.0a1
Build ID	20120507030511
Release Channel	nightly
OS	Linux
OS Version	0.0.0 Linux 2.6.32.9-g1282440 #1 PREEMPT Wed Jan 11 12:19:23 CST 2012 armv7l
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGSEGV
Crash Address	0x0
App Notes 	
AdapterVendorID: mapphone_cdma, AdapterDeviceID: DROIDX.
AdapterDescription: 'Model: 'DROIDX', Product: 'shadow_vzw', Manufacturer: 'motorola', Hardware: 'mapphone_cdma''.
WebGL? GL Context? GL Context+ WebGL+ 
motorola DROIDX
verizon/shadow_vzw/cdma_shadow:2.3.4/4.5.1_57_DX8-51/120111:user/release-keys
EMCheckCompatibility	True

Frame 	Module 	Signature 	Source
0 	libmozglue.so 	arena_dalloc 	memory/jemalloc/jemalloc.c:4609
1 	libmozglue.so 	huge_dalloc 	memory/jemalloc/jemalloc.c:5302
2 	libxul.so 	mozilla::WebGLContext::CompileShader 	content/canvas/src/WebGLContextGL.cpp:5246
3 	libxul.so 	mozilla::WebGLContext::CompileShader 	content/canvas/src/WebGLContextGL.cpp:5072
4 	libxul.so 	nsIDOMWebGLRenderingContext_CompileShader 	obj-firefox/js/xpconnect/src/dom_quickstubs.cpp:23128
5 	libxul.so 	js::Interpret 	js/src/jscntxtinlines.h:426
6 	libxul.so 	js::RunScript 	js/src/jsinterp.cpp:480
7 	libxul.so 	js::Invoke 	js/src/jsinterp.cpp:540
8 	libxul.so 	JS_CallFunctionValue 	js/src/jsapi.cpp:5448
9 	libxul.so 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:1907
10 	libxul.so 	nsJSEventListener::HandleEvent 	dom/src/events/nsJSEventListener.cpp:223
11 	libxul.so 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:835
12 	libxul.so 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:892
13 	libxul.so 	nsEventTargetChainItem::HandleEvent 	content/events/src/nsEventListenerManager.h:169
14 	libxul.so 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:349
15 	libxul.so 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:684
16 	libxul.so 	DocumentViewerImpl::LoadComplete 	layout/base/nsDocumentViewer.cpp:1070
17 	libxul.so 	nsDocShell::EndPageLoad 	docshell/base/nsDocShell.cpp:6254
18 	libxul.so 	nsDocShell::OnStateChange 	docshell/base/nsDocShell.cpp:6085
19 	libxul.so 	nsDocLoader::DoFireOnStateChange 	uriloader/base/nsDocLoader.cpp:1383
20 	libxul.so 	nsDocLoader::doStopDocumentLoad 	uriloader/base/nsDocLoader.cpp:963
21 	libxul.so 	nsDocLoader::DocLoaderIsEmpty 	uriloader/base/nsDocLoader.cpp:852
22 	libxul.so 	nsDocLoader::OnStopRequest 	uriloader/base/nsDocLoader.cpp:736
23 	libxul.so 	nsLoadGroup::RemoveRequest 	netwerk/base/src/nsLoadGroup.cpp:731
24 	libxul.so 	nsDocument::DoUnblockOnload 	content/base/src/nsDocument.cpp:7283
25 	libxul.so 	nsDocument::UnblockOnload 	content/base/src/nsDocument.cpp:7225
26 	libxul.so 	nsDocument::DispatchContentLoadedEvents 	content/base/src/nsDocument.cpp:4275
27 	libxul.so 	nsRunnableMethodImpl<void , true>::Run 	nsThreadUtils.h:345
28 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:656
29 	libxul.so 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:245
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=arena_dalloc+|+huge_dalloc
https://crash-stats.mozilla.com/report/list?signature=pthread_mutex_lock+|+wrtmessage

Comment 1

[Benoit Jacob [:bjacob] (mostly away)]

This seems like another evolution of the "allocator mismatch in ANGLE on Android" bug we've been fighting different forms of for the past 6 months.

Very similar to bug 746794, but more explicitly pointing toward an allocator mismatch.