901333 - crash in js::types::TypeSet::hasType(js::types::Type)

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Bill Gianopoulos [:WG9s]]

This bug was filed from the Socorro interface and is 
report bp-50c16486-c8a3-4549-b498-86b392130804 .
 =============================================================

Comment 1

[Bill Gianopoulos [:WG9s]]

I submitted this as a graphics bug rather than a javascript bug because it occurred in the WebGL conformance test.  It also does NOT occur on another system I have also running Windows 7 64-bit that has NVIDIA graphics.

graphics section of about:support is as follows:

Graphics
Adapter Description	AMD Radeon(TM) HD 6520G
Adapter Drivers	aticfx64 aticfx64 aticfx64 aticfx32 aticfx32 aticfx32 atiumd64 atidxx64 atidxx64 atiumdag atidxx32 atidxx32 atiumdva atiumd6a atitmm64
Adapter RAM	512
Device ID	0x9647
Direct2D Enabled	true
DirectWrite Enabled	true (6.2.9200.16571)
Driver Date	10-13-2011
Driver Version	8.910.0.0
GPU #2 Active	false
GPU Accelerated Windows	1/1 Direct3D 10
Vendor ID	0x1002
WebGL Renderer	Google Inc. -- ANGLE (AMD Radeon(TM) HD 6520G Direct3D9Ex vs_3_0 ps_3_0)
windowLayerManagerRemote	false
AzureCanvasBackend	direct2d
AzureContentBackend	direct2d
AzureFallbackCanvasBackend	cairo
AzureSkiaAccelerated	0

Comment 2

[Bill Gianopoulos [:WG9s]]

Changing the following preferences in about:config results in the following stack trace which might be more helpful:

javascript.options.baselinejit.chrome;false
javascript.options.baselinejit.content;false
javascript.options.ion.content;false
javascript.options.ion.parallel_compilation;false
javascript.options.jit_hardening;false

bp-c5ee72d1-40a2-41d3-9e03-c38e52130804

Comment 3

[Scoobidiver (away)]

Crash for me on an Intel GPU so not a graphics bug: bp-fcfd7eb7-f7d4-4493-a214-5072a2130805 in the trunk, bp-d95f54a3-2875-446f-91ca-fd18b2130805 in 23.0 Beta, bp-c11a57b1-b0be-4b9b-b13f-759662130805 in 22.0 (same signature as in bug 799118).

Using mozregression, the regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b672877ed046&tochange=0f7261e288f2

Comment 4

[Bill Gianopoulos [:WG9s]]

(In reply to Bill Gianopoulos [:WG9s] from comment #1)

> occurred in the WebGL conformance test.  It also does NOT occur on another
> system I have also running Windows 7 64-bit that has NVIDIA graphics.

It turns out this is NOT the case.  It does crash on both configurations.  It turns out that it does not crash on my own builds.  As soon as a figure out the difference between my builds and the official builds I will try to bisect within the identified the regression range.

Comment 5

[Bill Gianopoulos [:WG9s]]

Redoing this build with the same .mozconfig options as the official build did not help.  I wonder if doing the build on a system with AMD64 makes a difference here.

Comment 6

[Bill Gianopoulos [:WG9s]]

All that said I suspect this is a regression from bug 850548.  I would like to either try backing it out of the official builds or changing it to make the fallback alignment be 8 rather than 4.

Comment 7

[Bill Gianopoulos [:WG9s]]

(In reply to Bill Gianopoulos [:WG9s] from comment #6)
> All that said I suspect this is a regression from bug 850548.  I would like
> to either try backing it out of the official builds or changing it to make
> the fallback alignment be 8 rather than 4.

Especially since the documentation on MSVC seems to say the alignment should be 8.

Comment 8

[Bill Gianopoulos [:WG9s]]

My issue in duplicating this seems to be that it only fails on PGO builds.

Comment 9

[Bill Gianopoulos [:WG9s]]

I will be unable to bisect withing the regression window as I had promised in comment 4, since this is only reproducible in PGO builds which require Visual C++ professional edition.  I only have the Express version.

Comment 10

[Jasper St. Pierre]

Seems this is also crashing http://magcius.github.io/bmdview.js/bmdview.html

With similar crash reports like https://crash-stats.mozilla.com/report/index/86546717-daf8-4f51-bb52-ce7782130930

Comment 11

[Till Schneidereit [:till]]

I think we need a tighter regression window to make meaningful progress. The alignment issue mentioned in comment 6 and 7 seems unlikely, given that it crashes with all JITs disabled. (Which it also does for Jasper, from an IRC conversation.)

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Does this still reproduce for you, Bill?

Comment 13

[Bill Gianopoulos [:WG9s]]

I am unable to reproduce this crah with a current nightly build.