Status: New
Owner: ----
New issue 1203 by [email protected]: Fatal error in v8/src/objects.h,
line 615 # CHECK(!IsFailure()) failed on
fast/canvas/webgl/gl-get-calls.html layout test
http://code.google.com/p/v8/issues/detail?id=1203
The layout test
http://trac.webkit.org/browser/trunk/LayoutTests/fast/canvas/webgl/gl-get-calls.html
recently started crashing occasionally in debug Chromium builds:
http://test-results.appspot.com/dashboards/flakiness_dashboard.html#showExpectations=true&group=%40ToT%20-%20chromium.org&tests=fast%2Fcanvas%2Fwebgl%2Fgl-get-calls.html
here's the test:
http://trac.webkit.org/export/79617/trunk/LayoutTests/fast/canvas/webgl/gl-get-calls.html
here's the output:
#
# Fatal error in v8/src/objects.h, line 615
# CHECK(!IsFailure()) failed
#
==== Stack trace ============================================
Security context: 0x43d9fce9 <String[7]: file://>
1: /* anonymous */ [0x43d9204d <undefined>:1] (this=0x43d88b71 <JS
Global Object>#0#)
2: arguments adaptor frame: 1->0
3: shouldBe
[file:///mnt/data/b/build/slave/Webkit_Linux__dbg__1_/build/src/third_party/WebKit/LayoutTests/fast/js/resources/js-test-pre.js:104]
(this=0x43d88b71 <JS Global Object>#0#,_a=0x44942be9 <String[132]:
(context.getParameter(context.ALIASED_POINT_SIZE_RANGE)[0] == 1) ||
(context.getParameter(context.ALIASED_POINT_SIZE_RANGE)[1] ==
1)>,_b=0x43d920a5 <String[4]: true>)
4: /* anonymous */
[file:///mnt/data/b/build/slave/Webkit_Linux__dbg__1_/build/src/third_party/WebKit/LayoutTests/fast/canvas/webgl/gl-get-calls.html:32]
(this=0x43d88b71 <JS Global Object>#0#)
==== Details ================================================
[1]: /* anonymous */ [0x43d9204d <undefined>:1] (this=0x43d88b71 <JS Global
Object>#0#) {
// stack-allocated locals
var .result = 0x43d9204d <undefined>
// expression stack (top to bottom)
[02] : 0
[01] : 0x4287ff95 <a Float32Array>>#1#
--------- s o u r c e c o d e ---------
(context.getParameter(context.ALIASED_POINT_SIZE_RANGE)[0] == 1) ||
(context.getParameter(context.ALIASED_POINT_SIZE_RANGE)[1] == 1)
-----------------------------------------
}
[2]: arguments adaptor frame: 1->0 {
// actual arguments
[00] : 0x44942be9 <String[132]:
(context.getParameter(context.ALIASED_POINT_SIZE_RANGE)[0] == 1) ||
(context.getParameter(context.ALIASED_POINT_SIZE_RANGE)[1] == 1)> // not
passed to callee
}
[3]: shouldBe
[file:///mnt/data/b/build/slave/Webkit_Linux__dbg__1_/build/src/third_party/WebKit/LayoutTests/fast/js/resources/js-test-pre.js:104]
(this=0x43d88b71 <JS Global Object>#0#,_a=0x44942be9 <String[132]:
(context.getParameter(context.ALIASED_POINT_SIZE_RANGE)[0] == 1) ||
(context.getParameter(context.ALIASED_POINT_SIZE_RANGE)[1] ==
1)>,_b=0x43d920a5 <String[4]: true>) {
// stack-allocated locals
var .catch-var = 0x43d9204d <undefined>
// heap-allocated locals
var .arguments = 0x4287ff29 <an Arguments>>#2#
var _av = 0x43d9204d <undefined>
var exception = 0x43d9204d <undefined>
var arguments = 0x4287ff29 <an Arguments>>#2#
var _bv = 0x43d9204d <undefined>
// expression stack (top to bottom)
[05] : 0x4287ff71 <JS Function>#3#
--------- s o u r c e c o d e ---------
function shouldBe(_a, _b)?{? if (typeof _a != "string" || typeof
_b != "string")? debug("WARN: shouldBe() expects string arguments");?
var exception;? var _av;? try {? _av = eval(_a);? } catch (e) {?
exception = e;? }? var _bv = eval(_b);?? if (exception)?
testFailed(_a + " should be " + _bv + ...
-----------------------------------------
}
[4]: /* anonymous */
[file:///mnt/data/b/build/slave/Webkit_Linux__dbg__1_/build/src/third_party/WebKit/LayoutTests/fast/canvas/webgl/gl-get-calls.html:32]
(this=0x43d88b71 <JS Global Object>#0#) {
// stack-allocated locals
var .result = 0x43d9204d <undefined>
--------- s o u r c e c o d e ---------
??description("This test ensures basic functionality of the underlying
graphics library");??debug("");?debug("Canvas.getContext");??var context =
create3DContext(document.getElementById("canvas"));?if (!context)?
testFailed("context does not exist");?else {? testPassed("context
exists");?? ...
-----------------------------------------
}
==== Key ============================================
#0# 0x43d88b71: 0x43d88b71 <JS Global Object>
#1# 0x4287ff95: 0x4287ff95 <a Float32Array>>
#2# 0x4287ff29: 0x4287ff29 <an Arguments>>
callee: 0x46bbd761 <JS Function shouldBe>#4#
length: 2
#3# 0x4287ff71: 0x4287ff71 <JS Function>
#4# 0x46bbd761: 0x46bbd761 <JS Function shouldBe>
=====================
[12220:12220:3098934255259:ERROR:process_util_posix.cc(107)] Received
signal 6
base::debug::StackTrace::StackTrace() [0x84aa4f8]
base::(anonymous namespace)::StackDumpSignalHandler() [0x8479342]
0x4001c420
0x40c88a01
v8::internal::OS::Abort() [0x88361ab]
V8_Fatal [0x858fbf6]
CheckHelper() [0x855c82e]
v8::internal::MaybeObject::ToObjectUnchecked() [0x85747f3]
v8::internal::JSObject::GetElementWithReceiver() [0x8678f26]
v8::internal::Object::GetElementWithReceiver() [0x8679066]
v8::internal::Object::GetElement() [0x858fa45]
v8::internal::Runtime::GetElement() [0x86fe0ca]
v8::internal::Runtime::GetElementOrCharAt() [0x870d9b4]
v8::internal::Runtime::GetObjectProperty() [0x870e0ec]
v8::internal::KeyedLoadIC::Load() [0x8628d20]
v8::internal::KeyedLoadIC_Miss() [0x8628e1f]
0x43db22ae
0x4754ac21
0x43db3c9f
0x47548faa
0x47547008
0x43dc19b9
0x43db5f22
v8::internal::Invoke() [0x85af6b4]
v8::internal::Execution::Call() [0x85afcaf]
v8::Script::Run() [0x856f682]
WebCore::V8Proxy::runScript() [0x8a135d3]
WebCore::V8Proxy::evaluate() [0x8a13980]
WebCore::ScriptController::evaluate() [0x89ebf4e]
WebCore::ScriptElement::executeScript() [0x8b4e410]
WebCore::ScriptElement::prepareScript() [0x8b4f228]
WebCore::HTMLScriptRunner::runScript() [0x82470e6]
WebCore::HTMLScriptRunner::execute() [0x8247c7f]
WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder()
[0x824108f]
WebCore::HTMLDocumentParser::canTakeNextToken() [0x82410f9]
WebCore::HTMLDocumentParser::pumpTokenizer() [0x8241781]
WebCore::HTMLDocumentParser::pumpTokenizerIfPossible() [0x8241a51]
WebCore::HTMLDocumentParser::append() [0x8241f62]
WebCore::DecodedDataDocumentParser::appendBytes() [0x8accc91]
WebCore::DocumentWriter::addData() [0x8c76ebd]
WebCore::DocumentLoader::commitData() [0x8c6fc3b]
WebKit::WebFrameImpl::commitDocumentData() [0x80ae3da]
WebKit::FrameLoaderClientImpl::committedLoad() [0x80ed89f]
WebCore::DocumentLoader::commitLoad() [0x8c6fcf5]
WebCore::DocumentLoader::receivedData() [0x8c6fd4e]
WebCore::MainResourceLoader::addData() [0x8c91812]
WebCore::ResourceLoader::didReceiveData() [0x8c9b9ff]
WebCore::MainResourceLoader::didReceiveData() [0x8c90cd8]
WebCore::ResourceLoader::didReceiveData() [0x8c9b208]
WebCore::ResourceHandleInternal::didReceiveData() [0x91670bd]
webkit_glue::WebURLLoaderImpl::Context::OnReceivedData() [0x91100db]
(anonymous namespace)::RequestProxy::NotifyReceivedData() [0x9157f15]
DispatchToMethod<>() [0x91541b0]
RunnableMethod<>::Run() [0x91541e6]
MessageLoop::RunTask() [0x8459a41]
MessageLoop::DeferOrRunPendingTask() [0x8459bc9]
MessageLoop::DoWork() [0x845a433]
base::MessagePumpForUI::HandleDispatch() [0x84a168c]
(anonymous namespace)::WorkSourceDispatch() [0x84a16e4]
0x40673cf6
0x406770b3
0x4067766e
This also seems to have popped up around the same time as issue 1202, but
has a much lower crashrate.
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
