126836 - Trunk crash downloading file [@ js_Mark | js_MarkScript | js_MarkGCThing | call_enumerate]

Status: VERIFIED WORKSFORME

(Core :: Networking, defect)

Description

[Jay Patel [:jay]]

There were quite a few of these crashes with recent MozillaTrunk builds...so I
tried to reproduce it and succeeded on WinNT with build 2002021803.  Here are a
couple of my recent crashes:

Incident ID 3166751   
Stack Signature  js_Mark 9111a4f2
Trigger Time 2002-02-20 15:33:55
Email Address [e-mail]
URL visited ftp://alpha.gnu.org/gnu/tar
Build ID 2002021809
Product ID MozillaTrunk
Platform
Operating System Win32
Module
Trigger Reason Access violation
User Comments downloaded first file...opened up with winzip. refreshed browser
window...and clicked on firsf file again...and boom!
Stack Trace
js_Mark [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 3480]
js_MarkGCThing [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 830]
JS_MarkGCThing [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 1622]
XPCWrappedNativeProto::MarkBeforeJSFinalize
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcprivate.h, line 1567]
XPCWrappedNative::MarkBeforeJSFinalize
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcprivate.h, line 3075]
MarkForValidWrapper
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 659]
XPC_WN_Shared_Mark
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp,
line 676]
js_Mark [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 3523]
js_MarkGCThing [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 830]
gc_root_marker [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 939]
JS_DHashTableEnumerate [d:\builds\seamonkey\mozilla\js\src\jsdhash.c, line 601]
js_GC [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 1132]
js_ForceGC [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 962]
js_DestroyContext [d:\builds\seamonkey\mozilla\js\src\jscntxt.c, line 228]
JS_DestroyContext [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 883]
nsXPConnect::ReleaseJSContext
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\nsXPConnect.cpp, line 1018]
nsJSContext::`scalar deleting destructor'
nsJSEventListener::~nsJSEventListener
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 71]
0x03e14010
nsJSContext::`scalar deleting destructor'
nsJSContext::Release
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 474]
nsCOMPtr_base::~nsCOMPtr_base
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 65]
nsJSEventListener::~nsJSEventListener
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 71]
nsJSEventListener::`scalar deleting destructor'
nsJSEventListener::Release
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 84]
nsEventListenerManager::ReleaseListeners
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
368]
nsEventListenerManager::RemoveAllListeners
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
150]
nsEventListenerManager::~nsEventListenerManager
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
141]
nsEventListenerManager::`scalar deleting destructor'
nsEventListenerManager::Release
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
192]
nsCOMPtr_base::~nsCOMPtr_base
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 65]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
2332]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3383]
PresShell::HandleDOMEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6053]
nsButtonBoxFrame::MouseClicked
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsButtonBoxFrame.cpp, line 195]
nsButtonBoxFrame::HandleEvent
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsButtonBoxFrame.cpp, line 142]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6022]
PresShell::HandleEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5973]
nsEventStateManager::CheckForAndDispatchClick
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2465]
nsEventStateManager::PostHandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 1547]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6026]
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5928]
nsViewManager::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2010]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 301]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1849]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 83]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 858]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 875]
nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4579]
ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4829]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3504]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1120]
USER32.dll + 0x1820 (0x77e71820) 
------------------------------------------
 Incident ID 3166177   
Stack Signature  0x458910c4 62329fa2
Trigger Time 2002-02-20 15:18:16
Email Address [e-mail]
URL visited ftp://alpha.gnu.org/gnu/tar/
Build ID 2002021809
Product ID MozillaTrunk
Platform
Operating System Win32
Module
Trigger Reason Access violation
User Comments tried downloading one thing...cancelled out of first dialog...and
then clicked on another file...and this time clicked ok in dialog. chose to let
winamp open it and it crashed.
Stack Trace
0x458910c4
js_Mark [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 3523]
js_MarkGCThing [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 830]
js_MarkGCThing [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 830]
js_MarkGCThing [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 830]
js_MarkGCThing [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 830]
gc_root_marker [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 939]
JS_DHashTableEnumerate [d:\builds\seamonkey\mozilla\js\src\jsdhash.c, line 601]
js_GC [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 1132]
js_ForceGC [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 962]
js_DestroyContext [d:\builds\seamonkey\mozilla\js\src\jscntxt.c, line 228]
JS_DestroyContext [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 883]
nsXPConnect::ReleaseJSContext
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\nsXPConnect.cpp, line 1018]
nsJSContext::`scalar deleting destructor'
nsJSEventListener::~nsJSEventListener
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 71]
nsJSEventListener::Release
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 84]
nsEventListenerManager::ReleaseListeners
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
368]
nsJSContext::`scalar deleting destructor'
nsJSContext::Release
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 474]
nsCOMPtr_base::~nsCOMPtr_base
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 65]
nsJSEventListener::~nsJSEventListener
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 71]
nsJSEventListener::`scalar deleting destructor'
nsJSEventListener::Release
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 84]
nsEventListenerManager::ReleaseListeners
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
368]
nsEventListenerManager::RemoveAllListeners
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
150]
nsEventListenerManager::~nsEventListenerManager
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
141]
nsEventListenerManager::`scalar deleting destructor'
nsEventListenerManager::Release
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
192]
nsCOMPtr_base::~nsCOMPtr_base
[d:\builds\seamonkey\mozilla\xpcom\glue\nsCOMPtr.cpp, line 65]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
2332]
nsXULElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3383]
PresShell::HandleDOMEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6053]
nsButtonBoxFrame::MouseClicked
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsButtonBoxFrame.cpp, line 195]
nsButtonBoxFrame::HandleEvent
[d:\builds\seamonkey\mozilla\layout\xul\base\src\nsButtonBoxFrame.cpp, line 142]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6022]
PresShell::HandleEventWithTarget
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5973]
nsEventStateManager::CheckForAndDispatchClick
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2465]
nsEventStateManager::PostHandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 1547]
PresShell::HandleEventInternal
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6026]
PresShell::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5928]
nsViewManager::HandleEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2010]
nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 301]
nsViewManager::DispatchEvent
[d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 1849]
HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 83]
nsWindow::DispatchEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 858]
nsWindow::DispatchWindowEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 875]
nsWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4579]
ChildWindow::DispatchMouseEvent
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4829]
nsWindow::ProcessMessage
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3504]
nsWindow::WindowProc
[d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 1120]
USER32.dll + 0x1820 (0x77e71820) 

And some user comments for others crashing with this stack signature/trace:
3126300)
URL: ftp://mirror.cs.wisc.edu/pub/mirrors/ghost/AFPL/gs704/gs704w32.exe
     (3125474)	Comments: Loading real audio plugin
     (3123388)	Comments: Starting a 2nd download.
     (3122736)	Comments: opened a word doc
     (3120660)	URL: www.phpgroupware.org
     (3120660)	Comments: Start downloading a file to my hdd.  I've just selected the folder
and click on save and Mozilla crashed.  the quicklaunch fonction was enable and
I've just visited some sites after starting it from quicklaunch (wich took a
long time as it was launching
     (3120660)	Comments:  from scratch ..)
     (3117500)	URL: http://xanim.va.pubnix.com/dlls/vid_h261_1.0_linuxELFx86g21.tgz
     (3117500)	Comments: Clicked on this link and them BOOM.  Was able to ftp down a link
just before this.
     (3115737)	Comments: went www.mozilla.orgdownloaded lastest buildclosed mozillacrash
     (3115210)	Comments: crash when installing AIM from the fr site
     (3115201)	URL: boeing.com
     (3115201)	Comments: loading a quicktime movie
     (3114680)	Comments: clicked back on an inline pdf
     (3114144)	Comments: Tried to download the mozilla nightly.
     (3109614)	URL: champollion.net
     (3109614)	Comments: Downloading a file
     (3109117)	Comments: I canceled a save-to-disk
     (3108025)	Comments: Clicked on the link http://download.divx.com/divx/DivX412Codec.exe
on the page http://www.divx.com/download/downloadlist.php?typeid=1
     (3107369)	URL: http://kmeleon.sourceforge.net/resources/graphics.php
     (3105154)	URL: www.google.com
     (3105154)	Comments: Going back to page before PDF
     (3104988)	URL: www.mcafee.com superdat download
     (3104988)	Comments: I'd just clicked to cancel the download
     (3102583)	URL: http://www.mozilla.org/projects/mathml/start.xml
     (3102583)	Comments: crashed spontaniously
     (3096576)	URL: http://www.liberation/afp/index_dos1.html
     (3090494)	URL: www.luukku.com/liittyma
     (3090494)	Comments: registring a new e-mail and saving ie ins file
     (3089365)	URL: www.bepress.com/bejet/topics/
     (3089365)	Comments: read an attachment (.zip)
     (3087266)	URL:
http://www.hotdispatch.com/cisco-ip-telephony-dev/officefront-software-2?ID=15100214
     (3087266)	Comments: Clicking on file to download it
     (3086042)	URL: http://slashdot.org
     (3078769)	URL: ftp://alpha.gnu.org/gnu/tar/
     (3078769)	Comments: downloading tar-1.13.25.tar.gz
     (3075866)	Comments: ftp session ... 
     (3075594)	Comments: viewed mailclosed mailcrash
     (3075291)	Comments: quit *after* downloading
     (3073884)	Comments: clicking http link
     (3066518)	Comments: AarghI'll kill it!try to download a fileboom
     (3065739)	URL: shockwave.com
     (3065739)	Comments: trying to download shockwave plugin
     (3054955)	Comments: crash after  downloading fonts

I tried a few cases from user comments, but ftp://alpha.gnu.org/gnu/tar was the
only one I was able to consistantly crash at.  According to Talkback data, this
is happening on Windows and Linux...and under different stack signatures
including js_Mark, js_MarkScript, and js_MarkGCThing.

Comment 1

[Jay Patel [:jay]]

Adding crash, topcrash and testcase keywords.  This is a topcrasher with recent
builds and I have included reproducible steps in my incidents above.

Also, what's up with the [e-mail] assigned to?

Comment 2

[Jay Patel [:jay]]

cc'ing dbradley...david, might this be related to bug 120629 in anyway?

Comment 3

[David Bradley]

Yes, it does sound the same or at least related. I'll try your ftp site under
Purify and see if I can get any info. I've been trying to reproduce this for a
while and haven't been able to do it. I keep running into timer related crashes
first, which this could be a symptom of as well.

Comment 4

[Shiva Thirumazhusai]

nominating topcrash bugs for nsbeta1. 

Comment 5

[greer]

Attachment: Stack and comments for call_emumerate

Based on dbaron's comment #11 in bug 126279, the crashes under the
call_enumerate signature belong with this bug.

Comment 6

[David Bradley]

call_enumerate may be something different. For the 2/18 - 2/19 incidents they're
all null pointers. The js_Markxxx crashes deal mostly with accessing deleted
memory or stack corruption.

I've managed to reproduce one crash in js_MarkGCThing. This occured while using
the JS debugger. Unfortunately like the other crashes I couldn't reproduce, and
it really didn't provide me with much additional data.

Most of these seem to revolve around something that was rooted or referenced by
a root but had been freed without unrooting or dereferenced.

The only time I've seen this type of behavior out of XPConnect is when it was
hit by multiple threads. I haven't seen any evidence of multiple threads being
executed at this point, other than possibly related to some pluggins.

Comment 7

[Jay Patel [:jay]]

The number of these crashes all dropped significantly after 2/19...do we know of
any checkins that would have helped get rid of this problem?  There are still a
few crashes here and there with these stack signatures, but it looks like the
"real" topcrasher is no longer around.

Comment 8

[Jay Patel [:jay]]

There seem to be many bugs open for specific js_MarkXXXX crashes...but I tried
to reproduce the crash that I originally reported and it seems to have gone
away.  I'm going to mark this bug worksforme...since downloading from an ftp
site is no longer an issue for me.  If anyone can reproduce this crash with a
recent build with the steps that I followed...please reopen.

Comment 9

[Jay Patel [:jay]]

v.wfm - Win2k 2002030403

Comment 10

[Greg K.]

Is bug 179125 a dup of this one??

Comment 11

[benc]

is this bug in the right component?