309176 - crash in [@ js_GetSlotThreadSafe] on hotmail.com

Status: RESOLVED WORKSFORME

(Core :: XPConnect, defect)

Description

[Darin Fisher]

I'm seeing this daily while checking hotmail.com... deleting or marking an email
as junk frequently results in this crash.  Here are some talkback reports:

  TB9361687Y
  TB9381775X
  TB9447481M

The build is Firefox 1.5b1 on WinXP.

In bug 211629, Brendan mentions that this crash may already be fixed, in which
case this bug should just be marked as a duplicate.  (I didn't see any obvious
patches that would correspond.)  I haven't had a chance to verify if the problem
still exists in more recent branch nightlies.

Stack trace:

0x20202020
js_GetSlotThreadSafe 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jslock.c,
line 554]
JS_GetClass 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line
2118]
XPCWrappedNativeScope::FindInJSObjectScope 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativescope.cpp,
line 584]
nsXPConnect::WrapNative 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/nsXPConnect.cpp,
line 582]
nsJSEventListener::HandleEvent 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/dom/src/events/nsJSEventListener.cpp,
line 125]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1685]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1786]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2129]
nsEventStateManager::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 2624]
nsEventStateManager::NotifyMouseOut 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 2693]
nsEventStateManager::NotifyMouseOver 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 2743]
nsEventStateManager::GenerateMouseEnterExit 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 2782]
nsEventStateManager::PreHandleEvent 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 522]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6376]
PresShell::HandleEvent 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6215]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp,
line 2559]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp,
line 2246]
HandleEvent 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp,
line 174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1252]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 5981]
ChildWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 6232]
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1434]
USER32.dll + 0x3a50 (0x77d43a50)
USER32.dll + 0x3b1f (0x77d43b1f)
USER32.dll + 0x3d79 (0x77d43d79)
USER32.dll + 0x3ddf (0x77d43ddf)
nsAppStartup::Run 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 146]
main 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 61]
kernel32.dll + 0x2141a (0x77e8141a)

Comment 1

[timeless]

your object was gc'd

Comment 2

[Frank Wein [:mcsmurf]]

Also see Bug 304430 maybe (yeah i know js_GetSlotThreadSafe is missing in the
summary there ;)? The fix was checked in today, so maybe you want to recheck
with a rebuild or tomorrow's build.

Comment 3

[Asa Dotzler [:asa]]

Jay, can you keep an eye on nightly talkback and see if this falls off?

Comment 4

[Marcia Knous [:marcia]]

I just tried this out with my Hotmail account using today's trunk build  -
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050930
Firefox/1.6a1 - not seeing any crashes.

Comment 5

[Asa Dotzler [:asa]]

I'm still seeing a couple of recent nightly incidents of this in the last few
days. I guess we're not fixed. It wasn't very high on the list for 1.5beta1 (#65) 

Comment 6

[Darin Fisher]

> It wasn't very high on the list for 1.5beta1 (#65) 

Given the number of hotmail users in the world, I would expect this to matter
more once most of our users are on 1.5.  Perhaps hotmail is not very popular
amongst our beta testers ;-)

Comment 7

[Asa Dotzler [:asa]]

brendan, can you look into this?

Comment 8

[Brendan Eich [:brendan]]

Per comment 2, I could mark this FIXED, or even DUP.  Or per comment 4 and any
update from jay on post-b1 talkback, I could mark this WFM.  I'm not like to
"look into this" otherwise.  I'm not sure about comment 2, though.  The fix for
bug 304430 might have fixed a crash dispatching an event handler, but would it
have fixed the crash with the stack given in comment 0?

There was another bug, I believe jst fixed it, to do with split window changes
and XPConnect scope.  Someone remind me?  I'm going to optimize with WFM here. 
Reopen if necessary, but give it to xpconnect's default owner, not to me.  I
didn't break it and I'm not likely to have time to fix it.

/be