318633 - crash [@ js_LinkFunctionObject 8d10c2b3] while scrolling (jsfun.c line 2028)

Status: RESOLVED DUPLICATE of bug 318969

(Core :: JavaScript Engine, defect)

Description

[Tony Mechelynck [:tonymec]]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051130 Firefox/1.5
Build Identifier: "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051130 Firefox/1.5" build ID:2005113003

see TB12453181Q

Reproducible: Didn't try

Steps to Reproduce:

Actual Results:  
crash (access violation)

Expected Results:  
no crash

The fact that 48 tabs were open at fail time may or may not be relevant.

This crash happens while scrollig with Grab&Drag extension but another crash (TB12457934) which I'll report next (and dunno yet if at the same point in the code) happend while scrolling by clicking the scrollbar arrow.

Source tree puts the finger on [e-mail] so I'm dutifully CC'ing him/her.

Comment 1

[Tony Mechelynck [:tonymec]]

Oops... [e-mail] unknown to Bugzilla. CC'ing ltabb and brendan.

Oops again: [e-mail] is also unknown to Bugzilla.

Comment 2

[timeless]

please don't try to use cvsblame for spidermonkey crashes, it isn't worth it.

wah, this isn't bug 301491. hopefully XBL or DOM Events?

Incident ID: 12457934
Stack Signature	js_NewGCThing eb0644e1
Product ID	Firefox15
Build ID	2005113003
Trigger Time	2005-12-01 01:37:17.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (0001ce11)
URL visited	http://news.deviantart.com/article/19807/
User Comments	I was scrolling the page using the scrollbar button [v] at bottom
Since Last Crash	12085 sec
Total Uptime	33082 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 586
Stack Trace 	
js_NewGCThing  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 586]
js_NewFunction  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsfun.c, line 1972]
JS_CompileUCFunctionForPrincipals  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 3892]
nsJSContext::CompileEventHandler  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1319]
nsXBLPrototypeHandler::ExecuteHandler  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp, line 486]
nsXBLEventHandler::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xbl/src/nsXBLEventHandler.cpp, line 86]
nsEventListenerManager::HandleEventSubType  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1685]
nsEventListenerManager::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1786]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2153]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2174]
PresShell::HandleEventInternal  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6367]
PresShell::HandleEventWithTarget  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6265]
nsEventStateManager::CheckForAndDispatchClick  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventStateManager.cpp, line 3039]
nsEventStateManager::PostHandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventStateManager.cpp, line 2016]
PresShell::HandleEventInternal  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6439]
PresShell::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6203]
nsViewManager::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2559]
nsViewManager::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2246]
HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1252]
nsWindow::DispatchMouseEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 5982]
ChildWindow::DispatchMouseEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 6233]
nsWindow::WindowProc  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1434]
USER32.dll + 0x8734 (0x77d18734)
USER32.dll + 0x8816 (0x77d18816)
USER32.dll + 0x89cd (0x77d189cd)
USER32.dll + 0x8a10 (0x77d18a10)
nsAppShell::Run  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/widget/src/windows/nsAppShell.cpp, line 159]
nsAppStartup::Run  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151]
main  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 3

[Tony Mechelynck [:tonymec]]

*** Bug 318969 has been marked as a duplicate of this bug. ***

Comment 4

[Wayne Mery (:wsmwk)]

(In reply to comment #0)
> see TB12453181Q

included below

 
> The fact that 48 tabs were open at fail time may or may not be relevant.
> 
> This crash happens while scrollig with Grab&Drag extension but another crash
> (TB12457934) which I'll report next (and dunno yet if at the same point in the
> code) happend while scrolling by clicking the scrollbar arrow.

which bug # is that?

Tony, do you still get this crash now that bug 318969 is fixed?  (note - it's talkback stack is not the same as below)  If it no longer crashes then perhaps this bug should be duped to it.


Incident ID: 12453181
Stack Signature	js_LinkFunctionObject 8d10c2b3
Product ID	Firefox15
Build ID	2005113003
Trigger Time	2005-11-30 21:31:34.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (0001c791)
URL visited	http://zilla774.deviantart.com/journal/7173734/
User Comments	I was scrolling the page by means of the Grab&Drag extension
Since Last Crash	5521 sec
Total Uptime	20997 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsfun.c, line 2028
Stack Trace 	
js_LinkFunctionObject  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsfun.c, line 2028]
XPC_NW_GetOrSetProperty  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/XPCNativeWrapper.cpp, line 556]
XPC_NW_GetProperty  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/XPCNativeWrapper.cpp, line 595]
js_Interpret  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 5249]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1197]
js_InternalInvoke  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1274]
JS_CallFunctionValue  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4158]
nsJSContext::CallEventHandler  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1411]
nsJSEventListener::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/dom/src/events/nsJSEventListener.cpp, line 195]
nsEventListenerManager::HandleEventSubType  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1685]
nsEventListenerManager::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1786]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2153]
PresShell::HandleDOMEventWithTarget  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6466]
nsPopupSetFrame::OnCreate  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsPopupSetFrame.cpp, line 600]
nsPopupSetFrame::ShowPopup  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsPopupSetFrame.cpp, line 346]
nsPopupBoxObject::ShowPopup  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsPopupBoxObject.cpp, line 188]
nsXULTooltipListener::LaunchTooltip  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsXULTooltipListener.cpp, line 518]
nsXULTooltipListener::ShowTooltip  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsXULTooltipListener.cpp, line 408]
nsTimerImpl::Fire  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/xpcom/threads/nsTimerImpl.cpp, line 394]
nsAppStartup::Run  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151]
main  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 5

[Tony Mechelynck [:tonymec]]

(In reply to comment #4)
> (In reply to comment #0)
> > see TB12453181Q
> 
> included below
> 
> 
> > The fact that 48 tabs were open at fail time may or may not be relevant.
> > 
> > This crash happens while scrollig with Grab&Drag extension but another crash
> > (TB12457934) which I'll report next (and dunno yet if at the same point in the
> > code) happend while scrolling by clicking the scrollbar arrow.
> 
> which bug # is that?

bug 318636 -- its stack trace is above under comment #2

> 
> Tony, do you still get this crash now that bug 318969 is fixed?  (note - it's
> talkback stack is not the same as below)  If it no longer crashes then perhaps
> this bug should be duped to it.
[...]

I can't be sure because I can't repeat my crashes at will. They just happen to me (and when Windows becomes sluggish I now close and reopen Firefox to reclaim "Swiss cheese" memory, which may help reduce crash frequency). In any case bug 318969 is AFAIK _not_ fixed on the build family that I use -- at the moment, "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051215 Firefox/1.5", build ID:2005121503 -- see bug 318969 comment #15 and bug 318969 comment #16

I report all my crashes as they happen. Once or maybe twice I have reported more than one crash under the same bug number when their stack traces were obviously identical (even obviously to me). Here's the list of my crash bugs: those "resolved" will, as you know, be shown overstriked; use mouseover to see the resolution and summary.

Currently under Core:
bug 317283
bug 318121
bug 318627
bug 318633 (this one)
bug 318636
bug 318969
bug 319019
bug 319376
bug 319413
bug 319529
bug 319533
bug 320256

Currently under Firefox:
bug 310280
bug 314347
bug 314473
bug 318630
bug 319015
bug 319121
bug 319423
bug 319525

Currently under Thunderbird: none. (I do use T-bird mail but it only rarely crashes on me :-) ).

Comment 6

[timeless]

bz: there's a patch in place specifically to protect against this. perhaps the guard's too late?

Comment 7

[Boris Zbarsky [:bzbarsky]]

Which code does comment 6 refer to?

Comment 8

[timeless]

stack from comment 4, specifically this higlighted codepath (note your checking of the marker):
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/js/src/xpconnect/src/XPCNativeWrapper.cpp&mark=516,620,532,541,544-545&rev=MOZILLA_1_8_BRANCH#505

Comment 9

[Boris Zbarsky [:bzbarsky]]

I really don't see how that guard could be late...

Comment 10

[timeless]

i couldn't think of a way either, but... that seems to be the implication...

Comment 11

[David :Bienvenu]

running today's bon echo build, I just got a similar looking crash: TB21504097K

I think Firefox was in the background at the time though, perhaps, I might have moused over it.

Comment 12

[timeless]

bienvenu, um, your crash is heap corruption, the crash we're looking at in this bug is gc rooting. while the root cause may be the same, i think you should go fishing for the popup/tooltip/timeout bugs instead of this one.

Incident ID: 21504097
Stack Signature	ntdll.dll + 0x106c3 (0x7c9106c3) 52d052e1
Product ID	Firefox2
Build ID	2006072704
Trigger Time	2006-07-27 14:43:04.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	ntdll.dll + (000106c3)
URL visited	
User Comments	FF was idle, with several tabs open, includuing pandora
Since Last Crash	13029 sec
Total Uptime	13029 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
ntdll.dll + 0x106c3 (0x7c9106c3)
msvcrt.dll + 0x1c3c9 (0x77c2c3c9)
msvcrt.dll + 0x1c3e7 (0x77c2c3e7)
msvcrt.dll + 0x1c42e (0x77c2c42e)
JS_malloc  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 1649]
js_Interpret  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3380]
js_Invoke  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1369]
js_InternalInvoke  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1448]
JS_CallFunctionValue  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4385]
nsJSContext::CallEventHandler  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1474]
nsJSEventListener::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/dom/src/events/nsJSEventListener.cpp, line 195]
nsEventListenerManager::HandleEventSubType  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1655]
nsEventListenerManager::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1762]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2219]
PresShell::HandleDOMEventWithTarget  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6481]
nsPopupSetFrame::OnCreate  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsPopupSetFrame.cpp, line 600]
nsPopupSetFrame::ShowPopup  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsPopupSetFrame.cpp, line 346]
nsPopupBoxObject::ShowPopup  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsPopupBoxObject.cpp, line 198]
nsXULTooltipListener::LaunchTooltip  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsXULTooltipListener.cpp, line 518]
nsXULTooltipListener::ShowTooltip  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsXULTooltipListener.cpp, line 408]
nsTimerImpl::Fire  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/xpcom/threads/nsTimerImpl.cpp, line 394]
nsAppStartup::Run  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152]
main  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 13

[Wayne Mery (:wsmwk)]

Please reopen if you don't see it's fixed per bug 318969 in the versions specified

*** This bug has been marked as a duplicate of 318969 ***

Comment 14

[Tony Mechelynck [:tonymec]]

(In reply to comment #13)
> Please reopen if you don't see it's fixed per bug 318969 in the versions
> specified
> 
> *** This bug has been marked as a duplicate of 318969 ***
> 

It's hard to make sure that an erratic crash has been cured; and on top of that, I got both of these bugs on Windows (and they are still titled: "OS: Windows XP") but I'm on Linux now. FWIW I haven't seen them in quite some time AFAICT.