Closed Bug 308678 Opened 19 years ago Closed 18 years ago

Trunk Crash in Browser and MailNews [@ js_NewGCThing]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: tobias, Unassigned)

References

Details

(Keywords: crash, regression, topcrash)

Crash Data

Using todays SeaMonkey Trunk-Nightly 
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050915
SeaMonkey/1.1a Mnenhy/0.7.2.10005 {Build ID: 2005091504}

I got several Crashes from different actions in js_NewGCThing.

Talkback IDs: TB9376983M, TB9376915W, TB9376562W

First one is from closing Tab with middleclick, second from submitting Password
for Default POP3-Account, third from reading News using "Space" to move. 

I see this kind of Stack the first time, so I think this was an regression
between 2005091422 and 2005091504.

Add Stack from third TB-ID:

js_NewGCThing 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 586]
js_NewFunction 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsfun.c, line
1954]
JS_CompileUCFunctionForPrincipals 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line
3734]
nsJSContext::CompileEventHandler 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1336]
nsXBLPrototypeHandler::ExecuteHandler 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp,
line 486]
nsXBLEventHandler::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLEventHandler.cpp,
line 86]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1685]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1786]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2097]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2118]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2118]
nsTreeBodyFrame::CheckOverflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp,
line 866]
nsTreeBodyFrame::ReflowFinished 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp,
line 521]
PresShell::HandlePostedReflowCallbacks 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5069]
PresShell::DidDoReflow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 6590]
PresShell::WillPaint 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 6319]
0x778b0c24
0x00720066
0x029a0292
0x0006021c
Keywords: regression
Sorry for the Spam, but the Regression-Window is probably a little greater. Now
I have also several Crashes from same actions with the CREATURE-Tinderbox
2005091422-Build, of course without any Stack. But 2005091406 was o.k.
Summary: Trunk Crash in Browser and MailNews [js_NewGCThing] → Trunk Crash in Browser and MailNews [@ js_NewGCThing]
This must be one of my checkins from yesterday (for bug 307317 at 22:35 UTC and
bug 308111 at 01:48 UTC), but I'm not sure which one.  Timing may tell; my money
is on bug 307317.

/be
Assignee: general → brendan
Keywords: crash
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050915
Firefox/1.6a1 ID:2005091504

I get reproducible crashes when I visit http://www.nu.nl with the Menu Editor
extension installed and the filter http://as.nu.nl/dat/ in Adblock.
There were atleast three js_NewGCThing's amongst them.

TB9402156Q
TB9401946E
TB9401921K
TB9401806W
TB9401757G
TB9401535G
TB9401525H
TB9401507E
I am seeing the same thing in Firefox.  No issues with 2005091407 build. 
Crashes in 2005091517 and later builds.  In all cases where it has crashed I
have had the chatzilla extension running and connected to moznet and also been
viewing a browser page with a page loaded from my local disk that refreshes
periodically and has 4 frames displaying various tinderbox status panel pages. 
That part may be coindicence, but I mention it here becuase it is the only
constant in what I was doing.  It has crashed when I clicked on a link in the
sidebar page, while scrolling the main browser window and also when just
switching focus from the chatzilla window to the browser window.

TB9442724H

I have also had a seemingly related crash in  MarkGCThing 4a1be5a6

TB9427492Q
Flags: blocking1.9a1?
2 GC related checkins during the regression window kind of jump out.  bug 307317
and bug 308111.
The patch for bug 308111 would tend to mark objects more, keeping things fully
alive.  I think the one of the patches for bug 307317 is more likely the
culprit. But which one?

/be
Status: NEW → ASSIGNED
There might be multiple issues involved here.  I find Firefox tends to crash
much more often if I am using the chatzilla extension.  In fact some of my
crashes like this one

TB9460174X

occur when I launch chatzilla.

However, other crashes like this one:

TB9554038G

have occured without chatzilla running and appear to be related to scrolling a
page using the scrollbars.
Incident ID: 9460174
Stack Signature	MarkGCThing 63ee9e83
Product ID	FirefoxTrunk
Build ID	2005091616
Trigger Time	2005-09-17 19:21:56.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (0001cdf2)
URL visited	
User Comments	launching chatzilla
Since Last Crash	74531 sec
Total Uptime	74531 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1146
Stack Trace 	
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1146]
js_MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1446]
js_Mark  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c,
line 4119]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1146]
js_MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1446]
XPC_WN_Helper_Mark 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 989]
js_Mark  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c,
line 4119]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1146]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1233]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1233]
js_MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1446]
XPC_WN_Shared_Proto_Mark 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1501]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1146]
js_MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1446]
XPC_WN_Helper_Mark 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 989]
js_Mark  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c,
line 4119]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1146]
js_MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1446]
nsNodeSH::Mark 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp,
line 6250]
XPC_WN_Helper_Mark 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 989]
js_Mark  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c,
line 4119]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1146]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1233]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1233]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1233]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1233]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1233]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1233]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1233]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1233]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1233]
js_MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1446]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1146]
js_MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1446]
XPC_WN_Helper_Mark 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 989]
js_Mark  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c,
line 4119]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1146]
js_MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1446]
nsNodeSH::Mark 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp,
line 6250]
XPC_WN_Helper_Mark 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 989]
js_Mark  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c,
line 4119]
MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1146]
js_MarkGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1446]
js_GC  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c,
line 1702]
js_NewGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 636]
AllocSlots 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 1811]
js_AllocSlot 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2119]
js_SetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 3000]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3305]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1183]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3468]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1183]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3468]
js_Execute 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1394]
JS_EvaluateUCScriptForPrincipals 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 3951]
nsJSContext::EvaluateString 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1060]
nsGlobalWindow::RunTimeout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 6189]

Incident ID: 9554038
Stack Signature	js_NewGCThing e9872882
Product ID	FirefoxTrunk
Build ID	2005092006
Trigger Time	2005-09-20 12:47:49.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (0001ca38)
URL visited	Http://www.csico.com/
User Comments	horixzontally scrolling the window
Since Last Crash	13146 sec
Total Uptime	13146 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 586
Stack Trace 	
js_NewGCThing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 586]
js_NewFunction 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsfun.c, line 1954]
JS_NewFunction 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 3242]
XPCNativeMember::Resolve 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativeinfo.cpp,
line 181]
XPC_NW_NewResolve 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/XPCNativeWrapper.cpp,
line 813]
js_LookupPropertyWithFlags 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2606]
js_LookupProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2511]
js_GetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2796]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3294]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1183]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1260]
JS_CallFunctionValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4016]
nsJSContext::CallEventHandler 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1410]
nsJSEventListener::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/events/nsJSEventListener.cpp,
line 195]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1685]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1786]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2097]
PresShell::HandleDOMEventWithTarget 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6267]
nsPopupSetFrame::OnCreate 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsPopupSetFrame.cpp,
line 598]

*** Bug 309954 has been marked as a duplicate of this bug. ***
JS last-ditch GCs are happening more often now.  We should probably increase the
4MB of nominal GC-thing space configured by XPConnect as the threshold
triggering last-ditch GCs when it creates the JSRuntime.

Note the crufty gcMallocBytes heuristic seems to be involved, especially in the
chatzilla connection.

Independent of this threshold being too small, something in the three patches
for Bug 307317 seems to have introduced a bug, or exposed a latent bug that used
to bite only very rarely.  I suggest backing out those patches one by one over
several days, and checking talkback.  Start with the xpconnect/src one, then the
jsobj.c one, and the jsapi.c one last.

I'm out of town, so someone else will have to do this.  mrbkap?

/be
Keywords: topcrash
OS: Windows XP → All
Blocks: 307317
Hoping mrbkap can do something here, at least back out selectively and everyone
watch talkback.

/be
Assignee: brendan → mrbkap
Status: ASSIGNED → NEW
I just backed the first patch from bug 307317 out.
Assignee: mrbkap → general
Assignee: general → mrbkap
These are from core dumps I got, all the same build.  I think they're related,
since this only happened with this build and ones close to it.  Note the three
dumps where rt->gcFreeList[3] == 0x2.

#4  js_NewGCThing (cx=0xde8a5b0, flags=4, nbytes=32) at jsgc.c:586
586             *flp = thing->next;
(gdb) print rt->gcFreeList
$1 = {0xb65d1f8, 0x9c17820, 0xbe9cc40, 0x2, 0xd90a670, 0xa2dc9f0, 0xa8988b8,
  0xc1a51c0, 0xd5c4058, 0xb6633b0}

#4  0x001f80c0 in MarkGCThing (cx=0xb2765b8, thing=0xb3d3aa0,
    flagp=0xb3d49d4 "0") at jsgc.c:1144
1144            end = vp + ((obj->map->ops->mark)
(gdb) print obj->map
$1 = (JSObjectMap *) 0x1
(gdb) print cx->runtime->gcFreeList
$2 = {0x93cf438, 0x828c420, 0x93e8fb8, 0xb1004e0, 0x8660040, 0x95bba20,
  0x8286928, 0xb3b9600, 0x0, 0x8ece980}

#4  js_GetSlotThreadSafe (cx=0x9385068, obj=0xcf070e8, slot=2) at jslock.c:592
592             return OBJ_GET_REQUIRED_SLOT(cx, obj, slot);
(gdb) print obj->map->ops
$1 = (JSObjectOps *) 0x0
(gdb) print cx->runtime->gcFreeList
$2 = {0xa6ba648, 0x9204420, 0xac5cd78, 0x2, 0x9e190e0, 0x97a8220, 0x9a28448,
  0xb6b33c0, 0x0, 0xadb5840}

#4  js_NewGCThing (cx=0xdbae048, flags=4, nbytes=32) at jsgc.c:586
586             *flp = thing->next;
(gdb) print thing
$1 = (JSGCThing *) 0x2
(gdb) print rt->gcFreeList
$2 = {0xc5daa58, 0x98ad420, 0xb41cf70, 0x2, 0xd6cb580, 0x9e4c620, 0xa40f0b8,
  0xbd8a1c0, 0xd3a1458, 0xb243d30}

#4  js_MarkScript (cx=0x9ea52f8, script=0x0, arg=0x0) at jsscript.c:1342
1342        length = map->length;

I don't know how it would have made it to this line though, since the previous
line should dereference the null script pointer, although it's probably due to
compiler optimization.
This looks like an early topcrasher in the 1.5beta2 release. 
Comment 13 seems to suggest that bug 307317 is exposing (or at least making more
apparent) the bug where one of the freelist entries becomes a small number.

Asa, from my understanding of things, this bug itself cannot be a 1.5b2
topcrasher, since the cause of it (bug 307317) has not landed on the branch.
I'll back out another one of the patches from bug 307317 today and see how that
helps.
Priority: -- → P1
Target Milestone: --- → mozilla1.9alpha
I have not had this happen once since that last backout.
Just to clarify, I mean the backed out patch mentioned in comment 12.  The
stacks I listed in comment 13 we from before that.
Flags: testcase-
for me, this is caused by or at least made worse with chatzilla 0.9.68.5 and 
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051011
SeaMonkey/1.1a

TB10858691
TB10826287
TB10773710
TB10725461

from TB10858691

Stack Signature	 js_NewGCThing b3983d46
Product ID	MozillaTrunk
Build ID	2005101105
Trigger Time	2005-10-19 11:03:37.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (0001cc93)
URL visited	
User Comments	same as before s/vseerror
Since Last Crash	69264 sec
Total Uptime	402916 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 586
Stack Trace 	
js_NewGCThing 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 586]
AllocSlots 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
1850]
js_SetRequiredSlot 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
4238]
JS_SetReservedSlot 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line
3354]
xpc_CloneJSFunction 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativeinfo.cpp,
line 78]
DefinePropertyIfFound 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 453]
XPC_WN_Helper_NewResolve 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1114]
js_LookupPropertyWithFlags 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
2633]
js_LookupProperty 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
2538]
js_GetProperty 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
2823]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3313]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1183]
js_InternalInvoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1260]
js_InternalGetOrSet 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1303]
js_GetProperty 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
2896]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3313]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1183]
js_InternalInvoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1260]
js_InternalGetOrSet 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1303]
js_GetProperty 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
2896]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3313]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1183]
js_InternalInvoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1260]
js_InternalGetOrSet 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1303]
js_GetProperty 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
2896]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 5212]
js_Execute 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1394]
JS_EvaluateUCScriptForPrincipals 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line
4118]
nsJSContext::EvaluateString 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1067]
nsGlobalWindow::RunTimeout 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 6204]
nsGlobalWindow::TimerCallback 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 6575]
nsAppStartup::Run 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp,
line 208]
main 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1735]
WinMain 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1759]
kernel32.dll + 0x16d4f (0x7c816d4f)
(stack sig different but symptoms otherwise exactly the same, so fwiw)
From TB10555471  

Stack Signature	 js_Interpret d31b9a6e
Product ID	MozillaTrunk
Build ID	2005101105
Trigger Time	2005-10-12 06:10:04.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (0001f48f)
URL visited	
User Comments	unattended and idle, except for chatzilla channels, several of
which were up and running. I've been running for months without problem with
multiple builds of seamonkey - until this build. s/vseerror
Since Last Crash	37433 sec
Total Uptime	37433 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1885
Stack Trace 	
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1885]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1183]
js_InternalInvoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1260]
js_InternalGetOrSet 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1303]
js_GetProperty 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
2896]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3313]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1183]
js_InternalInvoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1260]
js_InternalGetOrSet 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1303]
js_GetProperty 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
2896]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3313]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1183]
js_InternalInvoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1260]
js_InternalGetOrSet 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1303]
js_GetProperty 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
2896]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3313]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1183]
js_InternalInvoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1260]
JS_CallFunctionValue 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line
4183]
nsJSContext::CallEventHandler 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1417]
nsGlobalWindow::RunTimeout 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 6217]
nsGlobalWindow::TimerCallback 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 6575]
nsAppStartup::Run 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp,
line 208]
main 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1735]
WinMain 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1759]
kernel32.dll + 0x16d4f (0x7c816d4f)
another example - this one is 1013 build instead of 1011

TB10941059  	

Stack Signature	 js_NewGCThing 7f8515d0
Product ID	MozillaTrunk
Build ID	2005101305
Trigger Time	2005-10-21 12:04:48.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (0001cc6a)
URL visited	
User Comments	chatzilla channels active, PC unattended and otherwise system idle s/vseerror
Since Last Crash	79663 sec
Total Uptime	79663 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 586
Stack Trace 	
js_NewGCThing  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 586]
AllocSlots  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 1850]
js_SetRequiredSlot  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 4238]
JS_SetReservedSlot  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line 3354]
xpc_CloneJSFunction  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativeinfo.cpp, line 78]
DefinePropertyIfFound  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 453]
XPC_WN_NoMods_Proto_Resolve  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1656]
js_LookupPropertyWithFlags  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 2680]
js_LookupProperty  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 2538]
js_GetProperty  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 2823]
js_Interpret  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 5212]
js_Invoke  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1183]
nsXPCWrappedJSClass::CallMethod  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1339]
nsXPCWrappedJS::CallMethod  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 462]
SharedStub  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp, line 147]
nsIOService::NewURI  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsIOService.cpp, line 423]
NS_NewURI  [../../dist/include/necko/nsNetUtil.h, line 122]
nsContentUtils::NewURIWithDocumentCharset  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsContentUtils.cpp, line 1535]
nsGenericHTMLElement::GetHrefURIForAnchors  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp, line 1654]
nsHTMLAreaElement::GetHrefURI  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLAreaElement.cpp, line 505]
RuleProcessorData::RuleProcessorData  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/style/nsCSSStyleSheet.cpp, line 2717]
nsCSSFrameConstructor::ResolveStyleContext  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7004]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7750]
nsCSSFrameConstructor::ProcessChildren  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 11740]
nsCSSFrameConstructor::ConstructTableCellFrame  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4003]
nsCSSFrameConstructor::TableProcessChild  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4263]
nsCSSFrameConstructor::TableProcessChildren  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4151]
nsCSSFrameConstructor::ConstructTableRowFrame  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3851]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6904]
nsCSSFrameConstructor::ConstructFrameInternal  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7934]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7759]
nsCSSFrameConstructor::ContentAppended  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 8849]
PresShell::ContentAppended  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5128]
nsHTMLDocument::ContentAppended  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLDocument.cpp, line 1100]
doInsertChildAt  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp, line 2746]
nsGenericElement::InsertChildAt  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp, line 2693]
nsGenericElement::doInsertBefore  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp, line 3384]
nsGenericElement::InsertBefore  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp, line 3001]
XPCWrappedNative::CallMethod  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2139]
XPC_WN_CallMethod  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1444]
js_Invoke  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1163]
js_Interpret  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 3487]
js_Execute  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1394]
JS_EvaluateUCScriptForPrincipals  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line 4118]
nsJSContext::EvaluateString  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1072]
nsGlobalWindow::RunTimeout  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6206]
nsGlobalWindow::TimerCallback  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6577]
nsAppStartup::Run  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp, line 208]
main  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1735]
WinMain  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1759]
kernel32.dll + 0x16d4f (0x7c816d4f)
That last stack trace seems like it might be related to bug 314989 (and fixed by the bug it's duped to). I'm tempted to mark this bug as FIXED based on comment 16 (fixed by the backout). There might be other causes of crashes in js_NewGCThing, but we can tackle them in other bugs.
(In reply to comment #21)
> That last stack trace seems like it might be related to bug 314989 (and fixed
> by the bug it's duped to). 

perhaps, but I had crashes with that applied (it's on trunk since early sept per Kaplan bug 307317 comment 32) so I don't think bug 307317 addresses my problem.


> I'm tempted to mark this bug as FIXED based on
> comment 16 (fixed by the backout). There might be other causes of crashes in
> js_NewGCThing, but we can tackle them in other bugs.

I can report when I get tomorrow's build whether this still happens for me.
(In reply to comment #22)
> perhaps, but I had crashes with that applied (it's on trunk since early sept
> per Kaplan bug 307317 comment 32) so I don't think bug 307317 addresses my
> problem.
> 

The patch was actually applied to the trunk on September 29th and has been in trunk nightlies beginning with the September 30th build.

> > That last stack trace seems like it might be related to bug 314989 (and fixed
> > by the bug it's duped to). 
> 
> perhaps, but I had crashes with that applied (it's on trunk since early sept
> per Kaplan bug 307317 comment 32) so I don't think bug 307317 addresses my
> problem.
> 
> > I'm tempted to mark this bug as FIXED based on
> > comment 16 (fixed by the backout). There might be other causes of crashes in
> > js_NewGCThing, but we can tackle them in other bugs.
> 
> I can report when I get tomorrow's build whether this still happens for me.

Still crashes for Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051109 SeaMonkey/1.5a


(In reply to Blake's comment #21)
> That last stack trace seems like it might be related to bug 314989 (and fixed
> by the bug it's duped to). I'm tempted to mark this bug as FIXED based on
> comment 16 (fixed by the backout). There might be other causes of crashes in
> js_NewGCThing, but we can tackle them in other bugs.

Blake, do you suggest bug 307317 likely relevant to my issue. Or is another bug more is applicable? Or do I open a new bug?

Last crash is TB11687635 
Stack Signature	 js_NewGCThing c8e84d50
Product ID	MozillaTrunk
Build ID	2005110908
...
Source File, Line No.	c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 586
(In reply to comment #10)
> JS last-ditch GCs are happening more often now.  We should probably increase
> the
> 4MB of nominal GC-thing space configured by XPConnect as the threshold
> triggering last-ditch GCs when it creates the JSRuntime.

does this still need to be increased?


> Note the crufty gcMallocBytes heuristic seems to be involved, especially in the
> chatzilla connection.

my chatzilla crashes are pervasive.


TB ids (others have expired):
12175700	12129474	12102535	12029723	11999175	11955413	11870960	11494455

2 of the 3 most recent are

Incident ID: 12175700
Stack Signature	js3250.dll + 0x483c4 (0x60e383c4) 52fa8be6
Product ID	MozillaTrunk
Build ID	2005111809
Trigger Time	2005-11-23 08:44:18.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (000483c4)
URL visited	
User Comments	clicked ctrl-m to create a new mail message s/vseerror
Since Last Crash	102584 sec
Total Uptime	329032 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
js3250.dll + 0x483c4 (0x60e383c4)


Incident ID: 12129474
Stack Signature	MarkGCThing 737bc37e
Product ID	MozillaTrunk
Build ID	2005111809
Trigger Time	2005-11-22 03:09:06.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (0001d3ce)
URL visited	
User Comments	clicked in chat s/vseerror
Since Last Crash	60845 sec
Total Uptime	226448 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 1146
Stack Trace 	
MarkGCThing  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 1146]
js_MarkGCThing  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 1446]
js_Mark  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 4199]
MarkGCThing  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 1146]
js_MarkGCThing  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 1446]
nsNodeSH::Mark  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 6448]
XPC_WN_Helper_Mark  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1030]
js_Mark  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 4199]
MarkGCThing  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 1146]
js_MarkGCThing  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 1446]
js_GC  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 1702]
js_NewGCThing  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 636]
js_NewString  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsstr.c, line 2525]
JS_NewUCString  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line 4286]
XPCConvert::NativeData2JS  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcconvert.cpp, line 341]
XPCWrappedNative::CallMethod  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2228]
XPC_WN_CallMethod  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1444]
js_Invoke  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1177]
js_Interpret  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 3523]
js_Invoke  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1197]
js_InternalInvoke  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1274]
JS_CallFunctionValue  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line 4157]
nsJSContext::CallEventHandler  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1422]
nsJSEventListener::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp, line 195]
nsEventListenerManager::HandleEventSubType  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 1687]
nsEventListenerManager::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp, line 1788]
nsGlobalWindow::HandleDOMEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp, line 1551]
nsDocument::HandleDOMEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsDocument.cpp, line 4214]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp, line 1952]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp, line 1948]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp, line 1948]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp, line 1948]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp, line 1948]
nsGenericElement::HandleDOMEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp, line 2184]
nsHTMLInputElement::HandleDOMEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLInputElement.cpp, line 1362]
nsGenericElement::HandleDOMEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp, line 2184]
nsEventStateManager::DispatchMouseEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 2568]
nsEventStateManager::NotifyMouseOver  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 2694]
nsEventStateManager::GenerateMouseEnterExit  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 2726]
nsEventStateManager::PreHandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp, line 512]
PresShell::HandleEventInternal  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 6015]
PresShell::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 5857]
nsViewManager::HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 2545]
nsViewManager::DispatchEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp, line 2237]
HandleEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line 176]
nsWindow::DispatchEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1141]
nsWindow::DispatchMouseEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 5961]
ChildWindow::DispatchMouseEvent  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 6209]
nsWindow::WindowProc  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp, line 1330]
USER32.dll + 0x8734 (0x77d48734)
USER32.dll + 0x8816 (0x77d48816)
USER32.dll + 0x89cd (0x77d489cd)
USER32.dll + 0x8a10 (0x77d48a10)
nsAppShell::Run  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsAppShell.cpp, line 159]
nsAppStartup::Run  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp, line 208]
main  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1737]
WinMain  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1761]
kernel32.dll + 0x16d4f (0x7c816d4f)

Today's TB12207358Y hasn't been processed on the backed up talkback server.
(In reply to comment #25)
> Today's TB12207358Y hasn't been processed on the backed up talkback server.

Incident ID: 12207358
Stack Signature	js3250.dll + 0x47d9 (0x60df47d9) c9054144
Product ID	MozillaTrunk
Build ID	2005111809
Trigger Time	2005-11-24 06:28:52.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (000047d9)
URL visited	
User Comments	chatzilla this time, with hyperthreading disabled in bios s/vseerror
Since Last Crash	70239 sec
Total Uptime	399271 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
js3250.dll + 0x47d9 (0x60df47d9)
xpc3250.dll + 0x17007 (0x60d27007)
xpc3250.dll + 0x16b2f (0x60d26b2f)
js3250.dll + 0x2dcfb (0x60e1dcfb)
js3250.dll + 0x2d9b9 (0x60e1d9b9)
js3250.dll + 0x2e1c6 (0x60e1e1c6)
js3250.dll + 0x2737d (0x60e1737d)
js3250.dll + 0x1eeda (0x60e0eeda)
js3250.dll + 0x1f05a (0x60e0f05a)
js3250.dll + 0x551f (0x60df551f)
gklayout.dll + 0x17c604 (0x603dc604)
gklayout.dll + 0x19ecd6 (0x603fecd6)
gklayout.dll + 0x10dd61 (0x6036dd61)
gklayout.dll + 0x10dfe8 (0x6036dfe8)
gklayout.dll + 0x165872 (0x603c5872)
gklayout.dll + 0x172033 (0x603d2033)
gklayout.dll + 0x1920b1 (0x603f20b1)
gklayout.dll + 0x19e03b (0x603fe03b)

By everybody's best guess, this bug itself is an old bug that was tickled by the checkin from bug 307317. Comment 13 seems to support this (the bug is that one of the freelist entries randomly turns into a small integer). I'm assigning this to the default owner, but will see if I can dig something out of this at some point.
Assignee: mrbkap → general
Priority: P1 → --
Target Milestone: mozilla1.9alpha → ---
*** Bug 319686 has been marked as a duplicate of this bug. ***
*** Bug 319686 has been marked as a duplicate of this bug. ***
(In reply to comment #15)
> Comment 13 seems to suggest that bug 307317 is exposing (or at least making
> more
> apparent) the bug where one of the freelist entries becomes a small number.
> 
> Asa, from my understanding of things, this bug itself cannot be a 1.5b2
> topcrasher, since the cause of it (bug 307317) has not landed on the branch.
> I'll back out another one of the patches from bug 307317 today and see how that
> helps.

Still a topcrasher for the 1.5 release.  
(and there are 19 other GCThing bugs open)

I can easily reproduce a crash ala bug 319219.
At least some GCThing crashes are due to 
 Bug 313184
 Bug 291386
(and I'm sure others)

What's next?
Didn't see this one for a while, is it fixed?
(In reply to comment #31)
> Didn't see this one for a while, is it fixed?

Which browser do you use, IE? And if so, which version? IE.5.5 or 6.0? 

http://talkback-public.mozilla.org/search/start.jsp?search=1&searchby=stacksig&match=contains&searchfor=+js_NewGCThing&vendor=MozillaOrg&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=build
Firefox2: Incident ID: 16983324, Incident ID: 16678856, Incident ID: 16678853
Firefox15: Incident ID: 16975661

Only the 4 TBIds above are from current versions, the other 889 Talkbacks are 2006011112 or older, so it seems to be fixed.
Flags: blocking1.9a1?
> 
> Which browser do you use, IE? And if so, which version? IE.5.5 or 6.0? 
> 

I don't get the IE question, isn't this about Tb and/or Fx?
Currently I have ie6 installed on my Windows machine, but never use it.

I used to get this crash when visiting www.nu.nl.
Currently I don't see any crashes anymore on my current Trunk builds.
( Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9a1) Gecko/20060904 Minefield/3.0a1 ) or on my Windows trunks builds.
fixed by backout of bug 307317. ref blake's bug 307317 comment 15 and 21.
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
Crash Signature: [@ js_NewGCThing]
You need to log in before you can comment on or make changes to this bug.