353046 - intermittent crash on OSX [@ _longjmp]

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[Bill Lipa]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7

Firefox is crashing every couple of days on OSX.  It's definitely more crashy than on Windows.

I'll attach the full crash log, but the thread that crashed looked like this.

Thread 0 Crashed:
0   libSystem.B.dylib              	0x9002a3f2 _longjmp + 42
1   <<00000000>> 	0xc001018e 0 + -1073675890

Thread 0 crashed with i386 Thread State:
eax: 0x00000001    ebx: 0x00000000 ecx:0x17ef8bf8 edx: 0x9002a3c8
edi: 0x00000000    esi: 0x00000001 ebp:0x18b6a170 esp: 0x00000001
 ss: 0x0000002f    efl: 0x00010202 eip:0x9002a3f2  cs: 0x00000027
 ds: 0x0000002f     es: 0x0000002f  fs:0x00000000  gs: 0x00000037



Reproducible: Couldn't Reproduce

Steps to Reproduce:
unknown

Comment 1

[Bill Lipa]

Attachment: osx trace

Comment 2

[Adam Guthrie]

That's a very weird stack. Do you have any other stacks for these crashes?

Comment 3

[Bill Lipa]

Attachment: additional crash logs

Here are the other firefox crashes from my log.  There are several that look like they are the same longjmp crash.

Comment 4

[Adam Guthrie]

One of the crashes was in Quicktime, the others were the same "long jump" crash. Maybe Mark knows what a "long jump" is.

Comment 5

[Bill Lipa]

Somebody posted the same type of crash log in a Slashdot comment, so it's not restricted to my machine:

http://yro.slashdot.org/comments.pl?sid=193876&threshold=-1&commentsort=0&mode=nested&cid=15895645

Comment 6

[Mark Mentovai]

longjmp (and setjmp) are used to unwind the stack without having to return from everything in the call chain between the point setjmp and longjmp were called.  It's used to implement things like exception handling.

I experienced a longjmp crash in Camino for the first time about ten minutes after I first saw this bug report.  Based on the crash logs here, and on my crash, longjmp is trying to restore an entirely bogus context.

One thing I noticed in these crash logs is that QuickTime seems to be a factor in all of them.  Perhaps the recent QuickTime 7.1.3 update has something to do with this?

Comment 7

[Bill Lipa]

Flash 9.0.0 may be another common element.

Comment 8

[Bill Lipa]

Attachment: several more crashes

I'm still getting this crash.  Two more examples attached, along with another crash from inside the flash player, which I'm including in case it's related somehow.  That thread looks like this:

Thread 5 Crashed:
0   ...romedia.Flash Player.plugin 	0x17909908 native_ShockwaveFlash_TCallFrame + 79772
1   ...romedia.Flash Player.plugin 	0x17648def 0x1756b000 + 908783
2   ...romedia.Flash Player.plugin 	0x176e2725 0x1756b000 + 1537829
3   ...romedia.Flash Player.plugin 	0x176e53dc 0x1756b000 + 1549276
4   ...romedia.Flash Player.plugin 	0x178ddc6a 0x1756b000 + 3615850
5   ...pple.audio.units.Components 	0x70009479 DefaultOutputAUEntry + 31577
6   ...pple.audio.units.Components 	0x700dee3f 0x70000000 + 912959
7   ...pple.audio.units.Components 	0x700de27b 0x70000000 + 909947
8   ....audio.toolbox.AudioToolbox 	0x93e82989 AudioConverterChain::CallInputProc(unsigned long) + 189
9   ....audio.toolbox.AudioToolbox 	0x93e82626 AudioConverterChain::FillBufferFromInputProc(unsigned long*, unsigned long*, CABufferList*) + 84
10  ....audio.toolbox.AudioToolbox 	0x93e81e7e BufferedAudioConverter::GetInputBytes(unsigned long, unsigned long&, CABufferList const*&) + 234
11  ....audio.toolbox.AudioToolbox 	0x93e81d0f CBRConverter::RenderOutput(CABufferList*, unsigned long, unsigned long&, AudioStreamPacketDescription*) + 119
12  ....audio.toolbox.AudioToolbox 	0x93e81a73 BufferedAudioConverter::FillBuffer(unsigned long&, AudioBufferList&, AudioStreamPacketDescription*) + 211
13  ....audio.toolbox.AudioToolbox 	0x93e81e32 BufferedAudioConverter::GetInputBytes(unsigned long, unsigned long&, CABufferList const*&) + 158
14  ....audio.toolbox.AudioToolbox 	0x93e81d0f CBRConverter::RenderOutput(CABufferList*, unsigned long, unsigned long&, AudioStreamPacketDescription*) + 119
15  ....audio.toolbox.AudioToolbox 	0x93e81a73 BufferedAudioConverter::FillBuffer(unsigned long&, AudioBufferList&, AudioStreamPacketDescription*) + 211
16  ....audio.toolbox.AudioToolbox 	0x93e81c01 AudioConverterChain::RenderOutput(CABufferList*, unsigned long, unsigned long&, AudioStreamPacketDescription*) + 93
17  ....audio.toolbox.AudioToolbox 	0x93e81a73 BufferedAudioConverter::FillBuffer(unsigned long&, AudioBufferList&, AudioStreamPacketDescription*) + 211
18  ....audio.toolbox.AudioToolbox 	0x93e81900 AudioConverterFillComplexBuffer + 190
19  ...pple.audio.units.Components 	0x70009075 DefaultOutputAUEntry + 30549
20  ...pple.audio.units.Components 	0x70008c44 DefaultOutputAUEntry + 29476
21  ...pple.audio.units.Components 	0x7001010c AUHighShelfFilterEntry + 5266
22  ...pple.audio.units.Components 	0x700094dd DefaultOutputAUEntry + 31677
23  ...pple.audio.units.Components 	0x700dee3f 0x70000000 + 912959
24  ...pple.audio.units.Components 	0x700de27b 0x70000000 + 909947
25  ....audio.toolbox.AudioToolbox 	0x93e82989 AudioConverterChain::CallInputProc(unsigned long) + 189
26  ....audio.toolbox.AudioToolbox 	0x93e82626 AudioConverterChain::FillBufferFromInputProc(unsigned long*, unsigned long*, CABufferList*) + 84
27  ....audio.toolbox.AudioToolbox 	0x93e81e7e BufferedAudioConverter::GetInputBytes(unsigned long, unsigned long&, CABufferList const*&) + 234
28  ....audio.toolbox.AudioToolbox 	0x93e81d0f CBRConverter::RenderOutput(CABufferList*, unsigned long, unsigned long&, AudioStreamPacketDescription*) + 119
29  ....audio.toolbox.AudioToolbox 	0x93e81a73 BufferedAudioConverter::FillBuffer(unsigned long&, AudioBufferList&, AudioStreamPacketDescription*) + 211
30  ....audio.toolbox.AudioToolbox 	0x93e81c01 AudioConverterChain::RenderOutput(CABufferList*, unsigned long, unsigned long&, AudioStreamPacketDescription*) + 93
31  ....audio.toolbox.AudioToolbox 	0x93e81a73 BufferedAudioConverter::FillBuffer(unsigned long&, AudioBufferList&, AudioStreamPacketDescription*) + 211
32  ....audio.toolbox.AudioToolbox 	0x93e81900 AudioConverterFillComplexBuffer + 190
33  ...pple.audio.units.Components 	0x70009075 DefaultOutputAUEntry + 30549
34  ...pple.audio.units.Components 	0x70008c44 DefaultOutputAUEntry + 29476
35  ...pple.audio.units.Components 	0x700080e9 DefaultOutputAUEntry + 26569
36  com.apple.audio.CoreAudio      	0x91466b8e HP_IOProc::Call(AudioTimeStamp const&, AudioTimeStamp const&, AudioBufferList const*, AudioTimeStamp const&, AudioBufferList*) + 240
37  com.apple.audio.CoreAudio      	0x914661b6 IOA_Device::CallIOProcs(AudioTimeStamp const&, AudioTimeStamp const&, AudioTimeStamp const&) + 274
38  com.apple.audio.CoreAudio      	0x91465f41 HP_IOThread::PerformIO(AudioTimeStamp const&) + 1221
39  com.apple.audio.CoreAudio      	0x91464493 HP_IOThread::WorkLoop() + 931
40  com.apple.audio.CoreAudio      	0x914640e9 HP_IOThread::ThreadEntry(HP_IOThread*) + 17
41  com.apple.audio.CoreAudio      	0x914586f5 CAPThread::Entry(CAPThread*) + 93
42  libSystem.B.dylib              	0x90024b07 _pthread_body + 84

Thread 5 crashed with i386 Thread State:
eax: 0x00000000    ebx: 0x1764852f ecx:0x00000073 edx: 0x1c78702c
edi: 0x1c787000    esi: 0x00000000 ebp:0xb0487c48 esp: 0xb0487c30
 ss: 0x0000002f    efl: 0x00010286 eip:0x17909908  cs: 0x00000027
 ds: 0x0000002f     es: 0x0000002f  fs:0x00000000  gs: 0x00000037

Comment 9

[Bill Lipa]

By the way, the Slashdot crash log in comment 5 is from August 12.  Quicktime 7.1.3 was released on September 12, so that seems unlikely to be the culprit.

Comment 10

[Bill Lipa]

Attachment: crash log w/firefox 2.0

Crash still exists on Firefox 2.0.

Comment 11

[Bill Lipa]

Crash still exists on Firefox 2.0.0.1.

Comment 12

[Carsten Book [:Tomcat]]

marking as works for me for now, the url from this bug does not crash on Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090714 Minefield/3.6a1pre.