353555 - Crash when reloading [@ xpsp2res.dll + 0x202020] [@ js_SetProtoOrParent]

Status: RESOLVED DUPLICATE of bug 353704

(Core :: XPConnect, defect)

Description

[Ryuichi KUBUKI]

TB23536790G is the TB ID.
The correct build ID is Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060920 Minefield/3.0a1 ID:2006092010 [cairo]

Stack Trace

xpsp2res.dll + 0x202020 (0x20202020)
obj_isPrototypeOf  [mozilla\js\src\jsobj.c, line 1511]
JS_SetPrototype  [mozilla\js\src\jsapi.c, line 2399]
XPCNativeSet::GetNewOrUsed  [mozilla\js\src\xpconnect\src\xpcwrappednativeinfo.cpp, line 732]
XPC_WN_DoubleWrappedGetter  [mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, line 209]

Comment 1

[Brendan Eich [:brendan]]

Reproducible?  What extensions?

/be

Comment 2

[Ryuichi KUBUKI]

(In reply to comment #1)
> Reproducible?  What extensions?
> 
> /be

Not reproducible - extensions are Nightly Tester Tools and VideoDownloader

Comment 3

[Ryuichi KUBUKI]

Probably the same bug

TB23594023W
(the correct build ID is Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060921 Minefield/3.0a1 ID:2006092114 [cairo])

0x01202000
js_SetSlotThreadSafe  [mozilla\js\src\jslock.c, line 714]
obj_isPrototypeOf  [mozilla\js\src\jsobj.c, line 1511]
JS_SetPrototype  [mozilla\js\src\jsapi.c, line 2399]
XPCNativeSet::GetNewOrUsed  [mozilla\js\src\xpconnect\src\xpcwrappednativeinfo.cpp, line 628]
XPC_WN_Shared_Enumerate  [mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, line 610]

Comment 4

[Ryuichi KUBUKI]

Mmm, it might be JS_SetPrototype.

TB23595003X

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060921 Minefield/3.0a1 ID:2006092114 [cairo]

Though I can't reproduce it, I did

1. post in a forum
2. press the back button to go back to the threads view
3. reload

Comment 5

[Ryan Jones-Ward [:sciguyryan]]

*** Bug 353764 has been marked as a duplicate of this bug. ***

Comment 6

[Ryan Jones-Ward [:sciguyryan]]

Looks like I made a dupe of this bug: bug #353764

TB23572597Q, TB23572828M, TB23579002Z

TB23578427Z, TB23575105M, TB23537457W, TB23531616K

TB23553968G, TB23539202M

From the bug I filled, will post an extension list when I get home if needed.

Comment 7

[Peter van der Woude [:Peter6]]

Any chance this can be fixed before places is disabled on monday ?
I'd hate to see testers crashing all the time now that we get some major changes.

Comment 8

[Adam Guthrie]

This started showing up on Talkback in 2006-09-20-04 builds. Here's what got checked in during the regression range: http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-09-19+03&maxdate=2006-09-20+05&cvsroot=%2Fcvsroot

TB23619917 shows this crash except with a random memory address as the top frame:

0x4c2001cb
js_GetSlotThreadSafe
js_SetProtoOrParent
JS_SetPrototype 
xpc_CloneJSFunction

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

So I'd rather track the topcrash in bug 353704, because the original stack there is much more like all the crashes wee're getting, whereas nothing in this bug until comment 6 reflects the bulk of the crashes that people are seeing.

Comment 10

[Brian Polidoro]

Since these crashes have been gone from talkbacks for three days.

*** This bug has been marked as a duplicate of 353704 ***