This bug was filed from the Socorro interface and is report bp-2d52bcd0-13cd-4d01-994f-15d322110905 . ============================================================= Frame Module Signature [Expand] Source 0 libc.so libc.so@0x15dd8 1 libc.so libc.so@0x12bce 2 libc.so libc.so@0x13748 3 libc.so libc.so@0x1460c 4 libstdc++.so libstdc++.so@0x9c6 5 libxul.so TOutputESSL::writeVariablePrecision _new.h:135 6 libxul.so TOutputGLSLBase::writeVariableType gfx/angle/src/compiler/OutputGLSLBase.cpp:123 7 libxul.so TOutputGLSLBase::visitAggregate gfx/angle/src/compiler/OutputGLSLBase.cpp:539 8 libxul.so TIntermAggregate::traverse gfx/angle/src/compiler/IntermTraverse.cpp:135 9 libxul.so TOutputGLSLBase::visitAggregate gfx/angle/src/compiler/OutputGLSLBase.cpp:454 10 libxul.so TIntermAggregate::traverse gfx/angle/src/compiler/IntermTraverse.cpp:135 11 libxul.so TOutputGLSLBase::visitCodeBlock gfx/angle/src/compiler/OutputGLSLBase.cpp:707 12 libxul.so TOutputGLSLBase::visitAggregate gfx/angle/src/compiler/intermediate.h:537 13 libxul.so TIntermAggregate::traverse gfx/angle/src/compiler/IntermTraverse.cpp:135 14 libxul.so TOutputGLSLBase::visitAggregate gfx/angle/src/compiler/OutputGLSLBase.cpp:454 15 libxul.so TIntermAggregate::traverse gfx/angle/src/compiler/IntermTraverse.cpp:135 16 libxul.so TranslatorESSL::translate gfx/angle/src/compiler/OutputGLSLBase.h:17 17 libxul.so TCompiler::compile gfx/angle/src/compiler/Compiler.cpp:181 18 libxul.so ShCompile gfx/angle/src/compiler/ShaderLang.cpp:169 19 libxul.so mozilla::WebGLContext::CompileShader content/canvas/src/WebGLContextGL.cpp:3982 20 libxul.so nsIDOMWebGLRenderingContext_CompileShader obj-firefox/js/src/xpconnect/src/dom_quickstubs.cpp:29783 21 libxul.so js::Interpret js/src/jscntxtinlines.h:305 22 libxul.so js::RunScript js/src/jsinterp.cpp:614 23 libxul.so js::Invoke js/src/vm/Stack.h:985 24 libxul.so JS_CallFunctionValue js/src/jscntxt.h:1310 25 libxul.so nsJSContext::CallEventHandler dom/base/nsJSEnvironment.cpp:1917 26 libxul.so nsJSEventListener::HandleEvent dom/src/events/nsJSEventListener.cpp:213 27 libxul.so nsEventListenerManager::HandleEventSubType content/events/src/nsEventListenerManager.cpp:727 28 libxul.so nsEventListenerManager::HandleEventInternal content/events/src/nsEventListenerManager.cpp:777 29 libxul.so nsEventTargetChainItem::HandleEvent content/events/src/nsEventListenerManager.h:160 30 libxul.so nsEventTargetChainItem::HandleEventTargetChain content/events/src/nsEventDispatcher.cpp:346 31 libxul.so nsEventDispatcher::Dispatch content/events/src/nsEventDispatcher.cpp:674 32 libxul.so DocumentViewerImpl::LoadComplete layout/base/nsDocumentViewer.cpp:1068 33 libxul.so nsDocShell::EndPageLoad docshell/base/nsDocShell.cpp:6162 34 libxul.so nsDocShell::OnStateChange nsCOMPtr.h:482 35 libxul.so nsDocLoader::FireOnStateChange uriloader/base/nsDocLoader.cpp:1323 36 libxul.so nsDocLoader::doStopDocumentLoad uriloader/base/nsDocLoader.cpp:958 37 libxul.so nsDocLoader::DocLoaderIsEmpty uriloader/base/nsDocLoader.cpp:825 38 libxul.so nsDocLoader::OnStopRequest uriloader/base/nsDocLoader.cpp:711 39 libxul.so nsLoadGroup::RemoveRequest netwerk/base/src/nsLoadGroup.cpp:734 40 libxul.so nsDocument::DoUnblockOnload nsCOMPtr.h:482 41 libxul.so nsDocument::UnblockOnload content/base/src/nsDocument.cpp:7173 42 libxul.so nsDocument::DispatchContentLoadedEvents nsCOMPtr.h:482 43 libxul.so nsRunnableMethodImpl<void , true>::Run nsThreadUtils.h:347 44 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:631 45 libxul.so NS_ProcessNextEvent_P obj-firefox/xpcom/build/nsThreadUtils.cpp:245 46 libxul.so mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:111 47 libxul.so mozilla::ipc::MessagePumpForChildProcess::Run ipc/glue/MessagePump.cpp:230 48 libxul.so MessageLoop::RunInternal ipc/chromium/src/base/message_loop.cc:209 49 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:487 50 libxul.so nsBaseAppShell::Run widget/src/xpwidgets/nsBaseAppShell.cpp:191 51 libxul.so XRE_RunAppShell toolkit/xre/nsEmbedFunctions.cpp:673 52 libxul.so mozilla::ipc::MessagePumpForChildProcess::Run ipc/glue/MessagePump.cpp:222 53 libxul.so MessageLoop::RunInternal ipc/chromium/src/base/message_loop.cc:209 54 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:487 55 libxul.so XRE_InitChildProcess nsAutoPtr.h:155 56 libmozutils.so ChildProcessInit other-licenses/android/APKOpen.cpp:799 57 plugin-container main ipc/app/MozillaRuntimeMainAndroid.cpp:69 58 libc.so libc.so@0x14c84

new bug since the labor day weekend; 6th on the top 10 crashes in trunk.

Steps to repro on HoneyComb: 1. http://code.google.com/p/webglsamples/ 2. open Aquarium link in a new tab Expected: no content crash Actual: content crash Note: 1. content crash does not occur on Android 2.3 Mozilla/5.0 (Android; Linux armv7I; rv10.0a1) Gecko/20110928 Firefox/10.0a1 Fennec/10.0a1 Device: Toshiba Thrive OS Android 3.1

Filed http://code.google.com/p/angleproject/issues/detail?id=219

Pinging the ANGLE devs (http://code.google.com/p/angleproject/issues/detail?id=219 ), this is very concerning.

I'm testing a patch that makes us revert to using the GLSL backend instead of the ESSL backend in the ANGLE compiler. Shouldn't make a behavior difference anyway, as on ES we're just passing the original shader source to the driver, but should fix this crash, as we won't be using the ESSL backend at all anymore, and it's clearly what's crashing here. https://tbpl.mozilla.org/?tree=Try&rev=72ded8c7f176 Builds and logs will be available at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/bjacob@mozilla.com-72ded8c7f176

Fixed by 709947

I add missing crash signatures.

The fix has been backported to Gecko 9+