320942 - AdBlock/XPCNativeWrapper-related crash

Status: RESOLVED DUPLICATE of bug 317815

(Firefox :: General, defect)

Description

[Adam Sampson]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8) Gecko/20051219 Firefox/1.5
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8) Gecko/20051219 Firefox/1.5

I've had this crash several times now -- sometimes while I'm interacting with
it, sometimes while it's just sitting there (presumably with a page loading
slowly in the background). I haven't found a way of provoking it, but it
usually happens within a couple of hours of Firefox being started.


Reproducible: Sometimes

Steps to Reproduce:
1. Be me.
2. Start Firefox; wait for a couple of hours.



Actual Results:  
Firefox crashes.

Expected Results:  
Firefox should not crash -- presumably it should just print the error it's trying to print.

I'm running a self-compiled Firefox 1.5 on Linux, built with:
- GCC 3.4.4
- GTK+ 2.8.9
- libIDL 0.8.6
- libXft 2.1.8.1

The source tarball was:
fa915ddcadecda30ed3e13694f26a779  download/firefox-1.5-source.tar.bz2

My .mozconfig contains:
. $topsrcdir/browser/config/mozconfig
ac_add_options --enable-debug
ac_add_options --disable-optimize
ac_add_options --enable-default-toolkit=gtk2
ac_add_options --enable-xft
ac_add_options --disable-freetype2
ac_add_options --disable-tests

I had the following tabs open in a single window this time; there's been no
obvious pattern to which pages I have to have open to make it crash:
- an output page from rawdog (rather plain HTML with CSS and images)
- http://www.gnu.org/software/auctex/
- MythWeb's "scheduled recordings" page
- http://www.cs.kent.ac.uk/projects/ofa/kroc/cttd.html
- http://www.onlamp.com/lpt/a/6376
- http://www.google.com/musica?aid=h6-xU2nyDAO&oi=musicr

I've got these extensions loaded:
- DOM Inspector 1.8
- Adblock 0.5.2.039
- Greasemonkey 0.6.4
- SessionSaver .2 d1 nightly 30

My prefs.js and a tarball of the extensions I'm using are here:
  http://offog.org/stuff/firefox-crash-20051220/

I see the "TypeError: window._AdblockObjects has no properties" warning quite
frequently in the JavaScript console; it doesn't always cause a crash like
this.

The gdb backtrace, and some poking around:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1222338192 (LWP 22818)]
js_NewGCThing (cx=0x8ee74c8, flags=4, nbytes=28) at jsgc.c:586
586	        *flp = thing->next;
Current language:  auto; currently c
(gdb) bt
#0  js_NewGCThing (cx=0x8ee74c8, flags=4, nbytes=28) at jsgc.c:586
#1  0xb7efc33d in AllocSlots (cx=0x8ee74c8, slots=0xf4e423c, nslots=6)
    at jsobj.c:1891
#2  0xb7f03963 in js_SetRequiredSlot (cx=0x8ee74c8, obj=0xd8c2268, slot=5, 
    v=135418424) at jsobj.c:4291
#3  0xb7eacf6f in JS_SetReservedSlot (cx=0x8ee74c8, obj=0xd8c2268, index=1, 
    v=135418424) at jsapi.c:3336
#4  0xb701c028 in XPCNativeMember::Resolve (this=0x8e577c8, ccx=@0xbfe6529c, 
    iface=0x8e577b1) at xpcwrappednativeinfo.cpp:189
#5  0xb6feaba6 in XPCNativeMember::GetValue (this=0x8e577c8, ccx=@0x8125238, 
    iface=0x8125238, pval=0x8125238) at xpcprivate.h:1115
#6  0xb7021b1a in DefinePropertyIfFound (ccx=@0xbfe6529c, obj=0xe5e7430, 
    idval=135725708, set=0x8e57938, iface=0x8e577b0, member=0x8e577c8, 
    scope=0x88ee990, reflectToStringAndToSource=1, 
    wrapperToReflectInterfaceNames=0xf536c18, 
    wrapperToReflectDoubleWrap=0xf536c18, scriptableInfo=0x0, propFlags=7, 
    resolved=0x0) at xpcwrappednativejsops.cpp:448
#7  0xb7022301 in XPC_WN_NoHelper_Resolve (cx=0x8ee74c8, obj=0xe5e7430, 
    idval=135725708) at xpcwrappednativejsops.cpp:731
#8  0xb7efd18f in js_LookupPropertyWithFlags (cx=0x8ee74c8, obj=0xe5e7430, 
    id=135996192, flags=0, objp=0xbfe65420, propp=0xbfe65424) at jsobj.c:2722
#9  0xb7efd57f in js_LookupProperty (cx=0x8125238, obj=0x8125238, 
    id=135418424, objp=0x8125238, propp=0x8125238) at jsobj.c:2580
#10 0xb7f00937 in js_GetProperty (cx=0x8ee74c8, obj=0xe5e7430, id=135996192, 
    vp=0xbfe65670) at jsobj.c:2865
#11 0xb7ee34e6 in js_Interpret (cx=0x8ee74c8, pc=0x8f46f8f "5", 
    result=0xbfe65748) at jsinterp.c:3349
#12 0xb7ef19aa in js_Invoke (cx=0x8ee74c8, argc=6, flags=2) at jsinterp.c:1197
#13 0xb7010f1e in nsXPCWrappedJSClass::CallMethod (this=0x8d0b128, 
    wrapper=0x8125238, methodIndex=3, info=0x888e938, nativeParams=0xbfe65b4c)
    at xpcwrappedjsclass.cpp:1369
#14 0xb700a918 in nsXPCWrappedJS::CallMethod (this=0x8f40750, methodIndex=3, 
    info=0x8125238, params=0x8125238) at xpcwrappedjs.cpp:461
#15 0xb7e6033b in PrepareAndDispatch (methodIndex=3219544964, self=0x8f40750, 
    args=0xbfe65c0c) at xptcstubs_gcc_x86_unix.cpp:100
#16 0xb4c38deb in NS_CheckContentLoadPolicy (contentType=135418424, 
    contentLocation=0x8125238, requestOrigin=0x8125238, context=0x8125238, 
    mimeType=@0x8125238, extra=0x8125238, decision=0x8125238)
    at nsContentPolicyUtils.h:165
#17 0xb4d595b0 in nsContentUtils::CanLoadImage (aURI=0xf54b0e0, 
    aContext=0x8125238, aLoadingDocument=0x91bfc08, 
    aImageBlockingStatus=0xbfe65d8a) at nsContentUtils.cpp:1842
---Type <return> to continue, or q <return> to quit---
#18 0xb4daa6d0 in nsImageLoadingContent::ImageURIChanged (this=0x9580d3c, 
    aNewURI=@0x8125238, aForce=1) at nsImageLoadingContent.cpp:449
#19 0xb4e3658b in nsHTMLImageElement::SetAttr (this=0x9580d20, aNameSpaceID=0, 
    aName=0x80a2b48, aPrefix=0x8125238, aValue=@0xf54a750, aNotify=1)
    at nsHTMLImageElement.cpp:567
#20 0xb4e066c3 in nsGenericHTMLElement::SetAttr (this=0x8125238, 
    aNameSpaceID=135418424, aName=0x8125238, aValue=@0x8125238, 
    aNotify=135418424) at nsGenericHTMLElement.h:191
#21 0xb4dfcfba in nsGenericHTMLElement::SetAttrHelper (this=0x8125238, 
    aAttr=0x8125238, aValue=@0x8125238) at nsGenericHTMLElement.cpp:3037
#22 0xb4e35790 in nsHTMLImageElement::SetSrc (this=0x8125238, 
    aValue=@0x8125238) at nsHTMLImageElement.cpp:214
#23 0xb7e5f749 in XPTC_InvokeByIndex () at xptcstubs_gcc_x86_unix.cpp:49
#24 0xb70162cc in XPCWrappedNative::CallMethod (ccx=@0xbfe661e0, 
    mode=XPCWrappedNative::CALL_SETTER) at xpcwrappednative.cpp:2138
#25 0xb7023766 in XPCWrappedNative::SetAttribute (ccx=@0x8125238)
    at xpcprivate.h:1928
#26 0xb701fee3 in XPC_WN_GetterSetter (cx=0x8ee74c8, obj=0x8125238, argc=1, 
    argv=0x96500c0, vp=0xbfe66320) at xpcwrappednativejsops.cpp:1468
#27 0xb7ef184c in js_Invoke (cx=0x8ee74c8, argc=1, flags=2) at jsinterp.c:1177
#28 0xb7ef1e20 in js_InternalInvoke (cx=0x8ee74c8, obj=0x8125238, 
    fval=135418424, flags=2, argc=1, argv=0xbfe666f4, rval=0x8125238)
    at jsinterp.c:1274
#29 0xb7ef1fe1 in js_InternalGetOrSet (cx=0x8ee74c8, obj=0x8ebcf90, 
    id=144521560, fval=150428600, mode=JSACC_WRITE, argc=135418424, 
    argv=0x8125238, rval=0x8125238) at jsinterp.c:1333
#30 0xb7f00512 in js_SetProperty (cx=0x8ee74c8, obj=0x8ebcf90, id=144521560, 
    vp=0xbfe666f4) at jsobj.c:3024
#31 0xb7ee33a9 in js_Interpret (cx=0x8ee74c8, pc=0x9070f2f "6", 
    result=0xbfe667cc) at jsinterp.c:3360
#32 0xb7ef19aa in js_Invoke (cx=0x8ee74c8, argc=1, flags=2) at jsinterp.c:1197
#33 0xb7010f1e in nsXPCWrappedJSClass::CallMethod (this=0x8b52db8, 
    wrapper=0x8125238, methodIndex=3, info=0x887a1d0, nativeParams=0xbfe66bd0)
    at xpcwrappedjsclass.cpp:1369
#34 0xb700a918 in nsXPCWrappedJS::CallMethod (this=0x9067f70, methodIndex=3, 
    info=0x8125238, params=0x8125238) at xpcwrappedjs.cpp:461
#35 0xb7e6033b in PrepareAndDispatch (methodIndex=3219549144, self=0x9067f70, 
    args=0xbfe66c78) at xptcstubs_gcc_x86_unix.cpp:100
#36 0xb4dd62ea in nsEventListenerManager::HandleEventSubType (this=0x8125238, 
    aListenerStruct=0x94ded70, aDOMEvent=0xf547030, aCurrentTarget=0x8ee73c4, 
    aSubType=8, aPhaseFlags=135418424) at nsEventListenerManager.cpp:1685
#37 0xb4dd8257 in nsEventListenerManager::HandleEvent (this=0x906ad48, 
---Type <return> to continue, or q <return> to quit---
    aPresContext=0x92bbd28, aEvent=0xbfe67230, aDOMEvent=0xbfe66f10, 
    aCurrentTarget=0x8ee73c4, aFlags=7, aEventStatus=0xbfe6718c)
    at nsEventListenerManager.cpp:1784
#38 0xb4f3e5ae in nsGlobalWindow::HandleDOMEvent (this=0x9087f08, 
    aPresContext=0x92bbd28, aEvent=0xbfe67230, aDOMEvent=0xbfe66f10, aFlags=7, 
    aEventStatus=0xbfe6718c) at nsGlobalWindow.cpp:1544
#39 0xb4f3e3b5 in nsGlobalWindow::HandleDOMEvent (this=0x8ee7390, 
    aPresContext=0x92bbd28, aEvent=0xbfe67230, aDOMEvent=0x0, aFlags=1, 
    aEventStatus=0xbfe6718c) at nsGlobalWindow.cpp:1434
#40 0xb4f2df01 in NS_ScriptErrorReporter (cx=0x8ee74c8, 
    message=0x908d248 "TypeError: window._AdblockObjects has no properties", 
    report=0xf544160) at nsJSEnvironment.cpp:218
#41 0xb7eb85b9 in js_ReportErrorAgain (cx=0x8ee74c8, 
    message=0xb4f2d7f0 "U\211åWVS\201ìŒ\002", reportp=0xf544160)
    at jscntxt.c:1034
#42 0xb7ed3711 in js_ReportUncaughtException (cx=0x8ee74c8) at jsexn.c:1162
#43 0xb7eac138 in JS_EvaluateUCScriptForPrincipals (cx=0x8ee74c8, 
    obj=0x8e3f080, principals=0x8125238, chars=0x8125238, length=135418424, 
    filename=0x8125238 "\003", lineno=135418424, rval=0x8125238)
    at jsapi.c:4104
#44 0xb4f2cdd9 in nsJSContext::EvaluateString (this=0x8ee7488, 
    aScript=@0xbfe67630, aScopeObject=0x8e3f080, aPrincipal=0x8184160, 
    aURL=0x8125238 "\003", aLineNo=135418424, aVersion=0xb7f48d66 "default", 
    aRetValue=0x0, aIsUndefined=0xbfe6762c) at nsJSEnvironment.cpp:1054
#45 0xb4f4d829 in nsGlobalWindow::RunTimeout (this=0x9087f08, 
    aTimeout=0x9087f08) at nsGlobalWindow.cpp:6282
#46 0xb4f4dc70 in nsGlobalWindow::TimerCallback (aTimer=0xa1ceb98, 
    aClosure=0xf53f6a8) at nsGlobalWindow.cpp:6653
#47 0xb7e3b89a in nsTimerImpl::Fire (this=0xa1ceb98) at nsTimerImpl.cpp:394
#48 0xb7e3ba78 in handleTimerEvent (event=0xb2000588) at nsTimerImpl.cpp:459
#49 0xb7e3320c in PL_HandleEvent (self=0xb2000588) at plevent.c:688
#50 0xb7e33cec in PL_ProcessPendingEvents (self=0x80c8880) at plevent.c:623
#51 0xb7e366fd in nsEventQueueImpl::ProcessPendingEvents (this=0x80e0870)
    at nsEventQueue.cpp:417
#52 0xb63f0a25 in event_processor_callback (source=0x81d3400, 
    condition=G_IO_IN, data=0x8125238) at nsAppShell.cpp:67
#53 0xb78224bf in g_io_unix_dispatch () from /opt/lib/libglib-2.0.so.0
#54 0xb77fab07 in g_main_context_dispatch () from /opt/lib/libglib-2.0.so.0
#55 0xb77fc495 in g_main_context_iterate () from /opt/lib/libglib-2.0.so.0
#56 0xb77fc7ba in g_main_loop_run () from /opt/lib/libglib-2.0.so.0
#57 0xb7afea13 in gtk_main () from /opt/lib/libgtk-x11-2.0.so.0
#58 0xb63f1412 in nsAppShell::Run (this=0x816c4d0) at nsAppShell.cpp:139
---Type <return> to continue, or q <return> to quit---
#59 0xb62877d7 in nsAppStartup::Run (this=0x816c488) at nsAppStartup.cpp:150
#60 0x0805790b in XRE_main (argc=-1075414464, argv=0x0, aAppData=0x8071420)
    at nsAppRunner.cpp:2313
#61 0x08050e34 in main (argc=135418424, argv=0x8125238) at nsBrowserApp.cpp:61
(gdb) frame 0
#0  js_NewGCThing (cx=0x8ee74c8, flags=4, nbytes=28) at jsgc.c:586
586	        *flp = thing->next;
(gdb) print thing
$1 = (JSGCThing *) 0x3
(gdb) print flp
$2 = (JSGCThing **) 0x8125238
(gdb) print *flp
$3 = (JSGCThing *) 0x3
(gdb) x/64c ((char *)flp)-32
0x8125218:	-128 '\200'	82 'R'	18 '\022'	8 '\b'	-128 '\200'	82 'R'	18 '\022'	8 '\b'
0x8125220:	-16 'ð'	-17 'ï'	5 '\005'	9 '\t'	0 '\0'	36 '$'	0 '\0'	0 '\0'
0x8125228:	127 '\177'	0 '\0'	0 '\0'	0 '\0'	40 '('	-13 'ó'	-96 ' '13 '\r'
0x8125230:	0 '\0'	0 '\0'	0 '\0'	0 '\0'	80 'P'	66 'B'	78 'N'	15 '\017'
0x8125238:	3 '\003'	0 '\0'	0 '\0'	0 '\0'	72 'H'	-90 'Š'	23 '\027'	8 '\b'
0x8125240:	0 '\0'	0 '\0'	0 '\0'	0 '\0'	16 '\020'	-24 'è'	23 '\027'	8 '\b'
0x8125248:	64 '@'	-52 'Ì'	23 '\027'	8 '\b'	0 '\0'	0 '\0'	0 '\0'	0 '\0'
0x8125250:	48 '0'	17 '\021'	24 '\030'	8 '\b'	0 '\0'	17 '\021'	-11 'õ'	-73 '·'
(gdb) print rt->gcFreeList
$4 = {0xda0f328, 0x0, 0xf4e4250, 0x3, 0x817a648, 0x0, 0x817e810, 0x817cc40, 
  0x0, 0x8181130}
(gdb) print nbytes
$5 = 28
(gdb) print i
$6 = 3
(gdb) print *rt
$8 = {state = JSRTS_UP, gcArenaPool = {{first = {next = 0x816e150, 
        base = 135418152, limit = 135418152, avail = 135418152}, 
      current = 0xee60c30, arenasize = 9216, mask = 7}, {first = {next = 0x0, 
        base = 135418176, limit = 135418176, avail = 135418176}, 
      current = 0x8125130, arenasize = 9216, mask = 15}, {first = {
        next = 0x81727a8, base = 135418208, limit = 135418208, 
        avail = 135418208}, current = 0xf4e2760, arenasize = 9216, mask = 31}, 
    {first = {next = 0x8175918, base = 135418240, limit = 135418240, 
        avail = 135418240}, current = 0xf5446e0, arenasize = 9216, mask = 31}, 
    {first = {next = 0x81799c8, base = 135418304, limit = 135418304, 
        avail = 135418304}, current = 0x8125184, arenasize = 9216, mask = 63}, 
    {first = {next = 0x8f62d00, base = 135418304, limit = 135418304, 
        avail = 135418304}, current = 0x8f62d00, arenasize = 9216, mask = 63}, 
    {first = {next = 0x817e738, base = 135418368, limit = 135418368, 
        avail = 135418368}, current = 0x81251bc, arenasize = 9216, mask = 63}, 
    {first = {next = 0x817be98, base = 135418368, limit = 135418368, 
        avail = 135418368}, current = 0x817be98, arenasize = 9216, mask = 63}, 
    {first = {next = 0x8f11bf0, base = 135418496, limit = 135418496, 
        avail = 135418496}, current = 0x8f11bf0, arenasize = 9216, 
      mask = 127}, {first = {next = 0x8180b90, base = 135418496, 
        limit = 135418496, avail = 135418496}, current = 0x905eff0, 
      arenasize = 9216, mask = 127}}, gcFreeList = {0xda0f328, 0x0, 0xf4e4250, 
    0x3, 0x817a648, 0x0, 0x817e810, 0x817cc40, 0x0, 0x8181130}, gcRootsHash = {
    ops = 0xb7f51100, data = 0x0, hashShift = 21, maxAlphaFrac = 192 'À', 
    minAlphaFrac = 64 '@', entrySize = 12, entryCount = 719, 
    removedCount = 401, generation = 7, entryStore = 0x98b4980 "\213h\b"}, 
  gcLocksHash = 0x88968e0, gcKeepAtoms = 0, gcBytes = 4194216, 
  gcLastBytes = 4194180, gcMaxBytes = 4194304, gcLevel = 0, gcNumber = 210, 
  gcPoke = 0 '\0', gcRunning = 0 '\0', 
  gcCallback = 0xb4f2bfa0 <DOMGCCallback>, gcMallocBytes = 0, 
  gcPrivateBytes = 12450546, gcDoomedNamespaces = 0x0, gcDoomedQNames = 0x0, 
  gcDoomedXML = 0x0, atomState = {runtime = 0x8125110, table = 0x816d108, 
    number = 112350, liveAtoms = 80525, emptyAtom = 0x8171d48, typeAtoms = {
      0x8170570, 0x81705a8, 0x81705e0, 0x8170618, 0x8170650, 0x8170688, 
      0x81706b8, 0x81706e8}, booleanAtoms = {0x8170718, 0x8170748}, 
    nullAtom = 0x81706b8, ArgumentsAtom = 0x8170780, ArrayAtom = 0x81707b0, 
    BooleanAtom = 0x81707e8, CallAtom = 0x8170818, DateAtom = 0x8170848, 
    ErrorAtom = 0x8170878, FunctionAtom = 0x81708b0, MathAtom = 0x81708e0, 
    NamespaceAtom = 0x8170918, NumberAtom = 0x8170950, ObjectAtom = 0x8170988, 
    QNameAtom = 0x81709b8, RegExpAtom = 0x81709f0, ScriptAtom = 0x8170a28, 
    StringAtom = 0x8170a60, XMLAtom = 0x8170a90, FileAtom = 0x8170ac0, 
    anonymousAtom = 0x8170af8, argumentsAtom = 0x8170b30, 
---Type <return> to continue, or q <return> to quit---
    arityAtom = 0x8170b60, calleeAtom = 0x8170b98, callerAtom = 0x8170bd0, 
    classPrototypeAtom = 0x8170c08, constructorAtom = 0x8170c48, 
    countAtom = 0x8170c80, eachAtom = 0x8170cb0, etagoAtom = 0x8171058, 
    evalAtom = 0x8170ce0, getAtom = 0x8170d10, getterAtom = 0x8170d48, 
    indexAtom = 0x8170d78, inputAtom = 0x8170da8, lengthAtom = 0x8170de0, 
    nameAtom = 0x8170e10, namespaceAtom = 0x8171090, 
    noSuchMethodAtom = 0x8170e58, parentAtom = 0x8170e98, 
    protoAtom = 0x8170ed0, ptagcAtom = 0x81710c0, qualifierAtom = 0x81710f0, 
    setAtom = 0x8170f00, setterAtom = 0x8170f38, spaceAtom = 0x8171120, 
    stagoAtom = 0x8171150, starAtom = 0x8171180, 
    starQualifierAtom = 0x81711b0, tagcAtom = 0x81711e0, 
    toLocaleStringAtom = 0x8170ff0, toSourceAtom = 0x8170f70, 
    toStringAtom = 0x8170fa8, valueOfAtom = 0x8171028, xmlAtom = 0x81706e8, 
    lazy = {AnyNameAtom = 0x8183190, AttributeNameAtom = 0x81831d0, 
      EvalErrorAtom = 0x817e698, InfinityAtom = 0x817e388, 
      InternalErrorAtom = 0x817e660, NaNAtom = 0x817e350, 
      RangeErrorAtom = 0x817e6d8, ReferenceErrorAtom = 0x81830c0, 
      SyntaxErrorAtom = 0x8183100, TypeErrorAtom = 0x8183120, 
      URIErrorAtom = 0x8183158, XMLListAtom = 0x8183208, 
      decodeURIAtom = 0x817e510, decodeURIComponentAtom = 0x817e598, 
      defineGetterAtom = 0x8175830, defineSetterAtom = 0x8175878, 
      encodeURIAtom = 0x817e548, encodeURIComponentAtom = 0x817e5e8, 
      escapeAtom = 0x817e4a0, functionNamespaceURIAtom = 0x0, 
      hasOwnPropertyAtom = 0x81756d0, isFiniteAtom = 0x817e3f0, 
      isNaNAtom = 0x817e3b8, isPrototypeOfAtom = 0x8175710, 
      isXMLNameAtom = 0x8183240, lookupGetterAtom = 0x81758c0, 
      lookupSetterAtom = 0x8183028, parseFloatAtom = 0x817e430, 
      parseIntAtom = 0x817e468, propertyIsEnumerableAtom = 0x81757e8, 
      unescapeAtom = 0x817e4d8, unevalAtom = 0x817e620, 
      unwatchAtom = 0x8175688, watchAtom = 0x8175650}, lock = {owner = 0, 
      fat = 0x0}, tablegen = 144175}, rngInitialized = 1, 
  rngMultiplier = 25214903917, rngAddend = 11, rngMask = 281474976710655, 
  rngSeed = 258497260561508, rngDscale = 9007199254740992, jsNaN = 0x816e7a0, 
  jsNegativeInfinity = 0x816e7b0, jsPositiveInfinity = 0x816e7a8, 
  emptyString = 0x816e7b8, contextList = {next = 0x816cf90, prev = 0xa424fb8}, 
  interruptHandler = 0, interruptHandlerData = 0x0, newScriptHook = 0, 
  newScriptHookData = 0x0, destroyScriptHook = 0, destroyScriptHookData = 0x0, 
  debuggerHandler = 0xb6ff8320 <xpc_DebuggerKeywordHandler(JSContext*, JSScript*, unsigned char*, long*, void*)>, debuggerHandlerData = 0x0, 
  sourceHandler = 0, sourceHandlerData = 0x0, executeHook = 0, 
  executeHookData = 0x0, callHook = 0, callHookData = 0x0, objectHook = 0, 
  objectHookData = 0x0, throwHook = 0, throwHookData = 0x0, 
---Type <return> to continue, or q <return> to quit---
  debugErrorHook = 0, debugErrorHookData = 0x0, trapList = {next = 0x81254e4, 
    prev = 0x81254e4}, watchPointList = {next = 0x81254ec, prev = 0x81254ec}, 
  propertyCache = {table = {{s = {object = 0x0, 
          property = 0x0}} <repeats 79 times>, {s = {object = 0x8ed6d38, 
          property = 0x8e48c34}}, {s = {object = 0x0, 
          property = 0x0}} <repeats 944 times>}, empty = 0, disabled = 0, 
    fills = 6432578, recycles = 2286933, tests = 9959123, misses = 5734970, 
    flushes = 195}, data = 0x0, gcLock = 0x80d17e0, gcDone = 0x80d1840, 
  requestDone = 0x80d1880, requestCount = 1, gcThread = 0, rtLock = 0x812d350, 
  rtLockOwner = 0, stateChange = 0x812d3b0, setSlotLock = 0x812d3f0, 
  setSlotDone = 0x812d450, setSlotBusy = 0, setSlotScope = 0x0, 
  scopeSharingDone = 0x812d490, scopeSharingTodo = 0xfeedbeef, 
  checkObjectAccess = 0xb61afee0 <nsScriptSecurityManager::CheckObjectAccess(JSContext*, JSObject*, long, JSAccessMode, long*)>, 
  principalsTranscoder = 0xb61a4a90 <nsTranscodeJSPrincipals>, 
  findObjectPrincipals = 0xb4f2eef0 <ObjectPrincipalFinder>, 
  propertyTreeHash = {ops = 0xb7f51d80, data = 0x0, hashShift = 15, 
    maxAlphaFrac = 192 'À', minAlphaFrac = 64 '@', entrySize = 8, 
    entryCount = 95572, removedCount = 2, generation = 13, 
    entryStore = 0xb1aef008 ""}, propertyFreeList = 0xf54867c, 
  propertyArenaPool = {first = {next = 0x8177db0, base = 135427468, 
      limit = 135427468, avail = 135427468}, current = 0xf547e70, 
    arenasize = 7168, mask = 3}, scriptFilenameTable = 0x812e380, 
  scriptFilenamePrefixes = {next = 0x812fbf0, prev = 0x812f1b8}, 
  scriptFilenameTableLock = 0x812e320, thousandsSeparator = 0x8171d08 ",", 
  decimalSeparator = 0x8171d18 ".", numGrouping = 0x8171d28 "\003\003", 
  anynameObject = 0x0, functionNamespaceObject = 0x0, inlineCalls = 479798, 
  nativeCalls = 3627772, nonInlineCalls = 1314943, constructs = 1997, 
  claimAttempts = 21556, claimedScopes = 21556, deadContexts = 542, 
  deadlocksAvoided = 0, liveScopes = 193701, sharedScopes = 0, 
  totalScopes = 588060, badUndependStrings = 0, liveScopeProps = 587802, 
  totalScopeProps = 1569026, livePropTreeNodes = 483398, 
  duplicatePropTreeNodes = 81, totalPropTreeNodes = 502513, 
  propTreeKidsChunks = 320, middleDeleteFixups = 101, liveStrings = 77107, 
  totalStrings = 3345744, liveDependentStrings = 106, 
  totalDependentStrings = 1136429, lengthSum = 181018716, 
  lengthSquaredSum = 20398758828, strdepLengthSum = 77858936, 
  strdepLengthSquaredSum = 6795682984}

Comment 1

[timeless]

we have lots of *flp small integer crashes...

Comment 2

[Jo Hermans]

Reporter: Adblock 0.5.11.1 is available ...

Comment 3

[Robin Monks]

Smells like bug 317815, debug data is similar.

May also be related to bug 308678.

Marking at bug 317815 as it is the closest.

Reporter, if you feel this was done in error, please REOPEN.

*** This bug has been marked as a duplicate of 317815 ***