Closed Bug 319529 Opened 19 years ago Closed 16 years ago

crash [@ JS_ObjectIsFunction 63402210] access violation (jsapi.c line 3434) clicking image link

Categories

(Core :: DOM: Events, defect)

Product:
Core
Component:
DOM: Events
Version:
1.8 Branch
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: tonymec, Unassigned)

References

(
URL
)

Details

(Keywords: crash)

Crash Data

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051207 Firefox/1.5
Build Identifier: "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051207 Firefox/1.5", build ID:2005120703

TB12729301X



Reproducible: Didn't try

Steps to Reproduce:

Actual Results:  
crash

Expected Results:  
no crash

Stack Signature	 JS_ObjectIsFunction 63402210
Product ID	Firefox15
Build ID	2005120703
Trigger Time	2005-12-07 22:47:13.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (00004865)
URL visited	http://www.deviantart.com/deviation/25982813/
User Comments	I had just clicked the main image, which is also a link
Since Last Crash	5357 sec
Total Uptime	48993 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 3434
Stack Trace 	
JS_ObjectIsFunction  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 3434]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1177]
js_Interpret  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3523]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1197]
nsXPCWrappedJSClass::CallMethod  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1369]
nsXPCWrappedJS::CallMethod  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 462]
SharedStub  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp, line 147]
nsEventListenerManager::HandleEventSubType  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1685]
nsEventListenerManager::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1786]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2153]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2174]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2174]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2174]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2174]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2174]
nsXULElement::HandleChromeEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2833]
nsGlobalWindow::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 1574]
nsDocument::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsDocument.cpp, line 4013]
nsEventStateManager::DispatchNewEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventStateManager.cpp, line 4554]
nsDocument::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsDocument.cpp, line 4097]
nsDocument::DispatchContentLoadedEvents  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsDocument.cpp, line 2213]
nsHTMLDocument::EndLoad  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/html/document/src/nsHTMLDocument.cpp, line 983]
HTMLContentSink::DidBuildModel  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 2203]
CNavDTD::DidBuildModel  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 604]
Keywords: crash
Version: unspecified → 1.5 Branch
sounds like a dead object. i really wish i understood what magical incantation you used to get all of these.
Assignee: nobody → events
Component: General → DOM: Events
Product: Firefox → Core
QA Contact: general → ian
Version: 1.5 Branch → 1.8 Branch
(In reply to comment #1)
> sounds like a dead object. i really wish i understood what magical incantation
> you used to get all of these.
> 

Believe me, if I knew a magical incantation to _avoid_ crashes, I would use it. My guess is that Firefox growing to ten times more memory than the next biggest program (which is Thunderbird, with Windows Explorer not far behind), and the heavy swapping it causes in Windows, makes crashes more frequent. My estimate is that once Firefox is up to 200 MB there is a 50% chance of a crash and once it gets to 300 MB it will crash if it hasn't already. See also:
bug 130157
bug 174604
bug 249469
bug 268138
bug 276342
just to mention some open "memory" bugs of which I'm aware.

FWIW, my system has 447 MB of "live" RAM (or maybe 512 M including nonswappable kernel memory).
Crash TB12842005W submitting a form with "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051210 Firefox/1.5", build ID:2005121003

Stack Signature	 JS_ObjectIsFunction 63402210
Product ID	Firefox15
Build ID	2005121003
Trigger Time	2005-12-11 08:33:28.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (00004865)
URL visited	http://www.spamcop.net/
User Comments	submitting a form
Since Last Crash	87322 sec
Total Uptime	87322 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 3434
Stack Trace 	
JS_ObjectIsFunction  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 3434]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1177]
js_Interpret  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3523]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1197]
nsXPCWrappedJSClass::CallMethod  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1369]
nsXPCWrappedJS::CallMethod  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 462]
SharedStub  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp, line 147]
nsEventListenerManager::HandleEventSubType  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1685]
nsEventListenerManager::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1786]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2153]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2174]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2174]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2174]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2174]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2174]
nsXULElement::HandleChromeEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2833]
nsGlobalWindow::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 1574]
nsDocument::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsDocument.cpp, line 4013]
nsEventStateManager::DispatchNewEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventStateManager.cpp, line 4554]
nsDocument::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsDocument.cpp, line 4097]
nsDocument::DispatchContentLoadedEvents  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsDocument.cpp, line 2213]
nsHTMLDocument::EndLoad  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/html/document/src/nsHTMLDocument.cpp, line 983]
HTMLContentSink::DidBuildModel  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/html/document/src/nsHTMLContentSink.cpp, line 2203]
CNavDTD::DidBuildModel  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/CNavDTD.cpp, line 604]
Just had another crash with the same stack signature: bug 320607 -- I'm not enough of a guru to say if it's a true dupe of this one.
*** Bug 320607 has been marked as a duplicate of this bug. ***
These all look like an event hitting a JS implemented object and then failing in the execution of that JS script. The failure point in JS_ObjectIsFunction doesn't quite make sense. I'm not sure how it's getting from js_Invoke to there.
(In reply to comment #6)
> These all look like an event hitting a JS implemented object and then failing
> in the execution of that JS script. The failure point in JS_ObjectIsFunction
> doesn't quite make sense. I'm not sure how it's getting from js_Invoke to
> there.
> 

FYI, when I get the popup "Script seems not to be responding" I normally answer "Continue". But such popups are less frequent than crashes lately.
Flags: blocking1.9a1?
i think this just bit me.
talkback TB14803755Z
oh, the slow script dialog.

yeah when i would interact like that it felt like i was playing russian roulette
odds were somewhere between 1 in 6 and 5 in 6 of crashing if i got that dialog
kinda felt like there was a different number between clicking stop and continue.
iirc stop was the higher chance of crashing, but i can't remember, i had those
crashes a couple of years ago. these days we just reset the slow script counter
or simply disable the thing entirely at work...
(In reply to comment #9)
> oh, the slow script dialog.
> 
> yeah when i would interact like that it felt like i was playing russian
> roulette
> odds were somewhere between 1 in 6 and 5 in 6 of crashing if i got that dialog
> kinda felt like there was a different number between clicking stop and
> continue.
> iirc stop was the higher chance of crashing, but i can't remember, i had those
> crashes a couple of years ago. these days we just reset the slow script counter
> or simply disable the thing entirely at work...
> 

Huh-huh. At times it looks like Firefox is completely hung. Then the slow script dialog comes up, I click "Continue", and (usually) it immediately starts running like a charm again. (The rare exception is when a script is "really" hung, not just doing some long-winded processing.)
and now TB19299649M
Status: UNCONFIRMED → NEW
Ever confirmed: true
Flags: blocking1.9a1? → blocking1.9?
So is this a problem on trunk?  I don't see any trunk incidents of this bug in talkback....
Not blocking. If anyone still sees this feel free to renominate.
Flags: blocking1.9? → blocking1.9-
Tony, still seeing this?

bz, crash stats only has two crashes in 3 months, neither with same stack
bp-8a0fc18f-dcc4-11dc-89e3-001a4bd43ef6
bp-d8dda34c-cd21-11dc-a0f0-001a4bd43ed6
(In reply to comment #14)
> Tony, still seeing this?
> 
If it's me you're calling, I don't remember seeing it since the day I happily junked billgatesware and upgraded to Linux. ;-) One more unexplained case of "spontanous remission" maybe, as cancer therapists say? (considering there's been more than a year between comment #13 and comment #14)
closing WFM based on comment 12 and comment 14 and testing Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008052906 Firefox/3.0

TB46712140 is closest stack I see on talkback, but not a good match.

feel free to reopen if still occurs or matching stack found on crash-stats for a current trunk version
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ JS_ObjectIsFunction 63402210]
You need to log in before you can comment on or make changes to this bug.