Closed Bug 255498 Opened 21 years ago Closed 7 years ago

Crash [@ XPCNativeSet::Mark()]

Categories

(Core :: XPConnect, defect, P5)

Product:
Core
Component:
XPConnect
Platform:
x86
Windows XP
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: timeless, Assigned: timeless)

References

Details

(Keywords: crash)

Crash Data

notes: mozilla mail was using 700-800 mb of ram (managing my imap inbox, which is well,... not tiny). mozilla also had significant uptime (go mozilla). i see similar crashes frequently with the trees i have to play with, but this is trunk (sorta, it's kinda hard to be tip when it takes over eleven and a half days of heavy continuous use of a single instance before it crashes). Incident ID: 551574 Stack Signature XPCNativeSet::Mark c7d31457 Product ID MozillaTrunk Build ID 2004072808 Trigger Time 2004-08-13 03:46:24.0 Platform Win32 Operating System Windows NT 5.1 build 2600 Module xpc3250.dll + (00002845) URL visited User Comments Since Last Crash 1001069 sec Total Uptime 1001069 sec Trigger Reason Access violation Source File, Line No. c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/ xpcinlines.h, line 553 Stack Trace XPCNativeSet::Mark [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src /xpcinlines.h, line 553] XPCJSRuntime::GCCallback [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src /xpcjsruntime.cpp, line 367] jsds_GCCallbackProc [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/jsd/jsd_xpc.cpp, line 525] js_GC [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 1398] js_AllocGCThing [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 530] js_NewString [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsstr.c, line 2439] JS_NewString [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line 3754] ToStringGuts [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src /xpcwrappednativejsops.cpp, line 107] XPC_WN_Shared_ToString [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src /xpcwrappednativejsops.cpp, line 127] js_Invoke [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1283] js_Interpret [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 3377] js_Invoke [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1302] js_InternalInvoke [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1379] js_InternalGetOrSet [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1422] js_SetProperty [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 2848] js_Interpret [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 2527] js_Invoke [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1302] js_InternalInvoke [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1379] js_InternalGetOrSet [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1422] js_SetProperty [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 2848] js_Interpret [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 2527] js_Invoke [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1302] js_InternalInvoke [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1379] js_InternalGetOrSet [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1422] js_SetProperty [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 2848] js_Interpret [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 2527] js_Invoke [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1302] js_InternalInvoke [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1379] js_InternalGetOrSet [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1422] js_SetProperty [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 2848] js_Interpret [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 2527] js_Invoke [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1302] nsXPCWrappedJSClass::CallMethod [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src /xpcwrappedjsclass.cpp, line 1338] nsXPCWrappedJS::CallMethod [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src /xpcwrappedjs.cpp, line 450] PrepareAndDispatch [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcal l/src/md/win32/xptcstubs.cpp, line 119] SharedStub [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcal l/src/md/win32/xptcstubs.cpp, line 147] nsObserverService::NotifyObservers [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/ds/nsObserverS ervice.cpp, line 210] XPTC_InvokeByIndex [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcal l/src/md/win32/xptcinvoke.cpp, line 102] XPCWrappedNative::CallMethod [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src /xpcwrappednative.cpp, line 2030] XPC_WN_CallMethod [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src /xpcwrappednativejsops.cpp, line 1288] js_Invoke [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1283] js_Interpret [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 3377] js_Invoke [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1302] nsXPCWrappedJSClass::CallMethod [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src /xpcwrappedjsclass.cpp, line 1338] nsXPCWrappedJS::CallMethod [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src /xpcwrappedjs.cpp, line 450] PrepareAndDispatch [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcal l/src/md/win32/xptcstubs.cpp, line 119] SharedStub [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcal l/src/md/win32/xptcstubs.cpp, line 147] nsBrowserStatusFilter::OnStateChange [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/browser/src/nsB rowserStatusFilter.cpp, line 140] nsDocLoaderImpl::FireOnStateChange [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsDoc Loader.cpp, line 1232] nsDocLoaderImpl::doStopDocumentLoad [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsDoc Loader.cpp, line 868] nsDocLoaderImpl::DocLoaderIsEmpty [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsDoc Loader.cpp, line 765] nsDocLoaderImpl::OnStopRequest [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsDoc Loader.cpp, line 695] nsLoadGroup::RemoveRequest [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsL oadGroup.cpp, line 704] PresShell::RemoveDummyLayoutRequest [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src /nsPresShell.cpp, line 6512] PresShell::ProcessReflowCommands [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src /nsPresShell.cpp, line 6380] ReflowEvent::HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src /nsPresShell.cpp, line 6148] PL_HandleEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/threads/pleven t.c, line 693] PL_ProcessPendingEvents [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/threads/pleven t.c, line 631] _md_EventReceiverProc [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/threads/pleven t.c, line 1434] USER32.dll + 0x3d79 (0x77d43d79) USER32.dll + 0x3ddf (0x77d43ddf) nsAppShellService::Run [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/ns AppShellService.cpp, line 489] main1 [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsApp Runner.cpp, line 1331] main [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsApp Runner.cpp, line 1801]
Summary: [@ XPCNativeSet::Mark] → Crash [@ XPCNativeSet::Mark]
Looks like more marking of dead things. Could be a dead native, or a dead native set. Hard to tell. The operation on the wrapped native is fairly simple so might make it past to the native set even if it were dead and not decayed much. There's only two ways native sets die, one is via GC, the other is in GetNewOrUsed when a set was added between the find and the add. Well there's a third way if the add into the map fails. The native set cleanup looks pretty clean, so my money would be on a dead wrapped native. Going to be impossible to tell where that is, since so many things come into play there. Refcnt logging would probably turn up something if someone was able to do that. Any fix the stack dump issue on XP?
which stack dump issue?
The one where the stack walking code was broken under XP. I couldn't get the refcount balancer to work properly without it.
hrm, i'll have to check fwiw my debug builds are asserting a lot about 0xdddddddd objects in the xpconnect gc game.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Priority: -- → P5
QA Contact: pschwartau → xpconnect
#157 in topcrash for FF 2.0.0.14 eg TB46946515 Stack Trace XPCNativeSet::Mark [mozilla/js/src/xpconnect/src/xpcinlines.h, line 567] XPCWrappedNativeScope::MarkAllWrappedNativesAndProtos [mozilla/js/src/xpconnect/src/xpcwrappednativescope.cpp, line 351] DOMGCCallback [mozilla/dom/src/base/nsJSEnvironment.cpp, line 2269] JS_GC [mozilla/js/src/jsapi.c, line 1879] nsAppStartup::Run [mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152] main [mozilla/browser/app/nsBrowserApp.cpp, line 61] kernel32.dll + 0x16fd7 (0x7c816fd7) TB47035008 Stack Signature XPCNativeSet::Mark 08f64066 Product ID Firefox2 Build ID 2008040413 Trigger Time 2008-06-28 00:32:35.0 Platform Win32 Operating System Windows NT 5.1 build 2600 Module firefox.exe + (0000ddf3) URL visited http://www.google.lt User Comments I entered "tcpview" in a search bar (set to use Google), pressed Enter and then clicked first offered link (at microsoft.com). Firefox crashed. Since Last Crash 255979 sec Total Uptime 255979 sec Trigger Reason Access violation Source File, Line No. c:/builds/tinderbox/Fx-Mozilla1.8-Release/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcinlines.h, line 567 Stack Trace XPCNativeSet::Mark [mozilla/js/src/xpconnect/src/xpcinlines.h, line 567] XPCWrappedNativeScope::MarkAllWrappedNativesAndProtos [mozilla/js/src/xpconnect/src/xpcwrappednativescope.cpp, line 351] DOMGCCallback [mozilla/dom/src/base/nsJSEnvironment.cpp, line 2269] JS_GC [mozilla/js/src/jsapi.c, line 1879] nsAppStartup::Run [mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152] main [mozilla/browser/app/nsBrowserApp.cpp, line 61] kernel32.dll + 0x16fd7 (0x7c816fd7) sampled 5 of 30 crashes on crash-stats and they are all of the form bp-1a685485-41d9-11dd-b67b-0013211cbf8a Frame Module Signature [Expand] Source 0 xul.dll XPCNativeSet::Mark mozilla/js/src/xpconnect/src/xpcinlines.h:580 1 xul.dll XPCWrappedNativeProto::Mark mozilla/js/src/xpconnect/src/xpcprivate.h:1946 2 xul.dll WrappedNativeMarker mozilla/js/src/xpconnect/src/xpcwrappednativescope.cpp:511 3 js3250.dll JS_DHashTableEnumerate mozilla/js/src/jsdhash.c:716 4 js3250.dll js_Invoke
same as thunderbird 3.0b3 #9 topcrash? bp-d90ff28c-be3a-4fe8-a08a-0be2f2090828 XPCNativeSet::Mark js/src/xpconnect/src/xpcinlines.h:579 XPCJSRuntime::GCCallback js/src/xpconnect/src/xpcjsruntime.cpp:616 DOMGCCallback dom/src/base/nsJSEnvironment.cpp:3641 js_GC js/src/jsgc.cpp:3698 js_SetProtoOrParent js/src/jsobj.cpp:334 obj_setSlot js/src/jsobj.cpp:243 js_SetSprop js/src/jsscope.h:401 js_SetPropertyHelper js/src/jsobj.cpp:4512 js_Interpret js/src/jsinterp.cpp:6502 js_Invoke js/src/jsinterp.cpp:1394 nsXPCWrappedJSClass::CallMethod js/src/xpconnect/src/xpcwrappedjsclass.cpp:1697 nsXPCWrappedJS::CallMethod js/src/xpconnect/src/xpcwrappedjs.cpp:561 PrepareAndDispatch xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114 SharedStub xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141 NS_InvokeByIndex_P xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101 XPCWrappedNative::CallMethod js/src/xpconnect/src/xpcwrappednative.cpp:2454
Summary: Crash [@ XPCNativeSet::Mark] → Crash [@ XPCNativeSet::Mark()]
I just got this this but it was during a period where I hadn't touched the computer for a good 5 minutes. (If that's relevant) http://crash-stats.mozilla.com/report/index/bp-d76410b2-4b8f-4480-a1fd-35ad72101027
Crash Signature: [@ XPCNativeSet::Mark()]
Blocks: 830620
Crash Signature: [@ XPCNativeSet::Mark()] → [@ XPCNativeSet::Mark()] [@ XPCNativeSet::Mark]
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.