354912 - crash [@ _PR_MD_ATOMIC_DECREMENT]

Status: RESOLVED INCOMPLETE

(Core :: DOM: Core & HTML, defect)

Description

[chris hofmann]

looks like forms of this stack signature might have been around for a while in, firefox 1.5, thunderbird, trunk and other crash data, but it has move to #18 on the Firefox RC1 top crash list, where it does not appear at all on the beta2 top crash list...
http://talkback-public.mozilla.org/reports/firefox/FF2rc1/FF2rc1-topcrashers.html

Could it be moving up on the list as the result of removal of other crashes, or could it be a new regression?  did we take a new nspr update between beta2 and RC1 or could other changes triggered a regression?

full list of RC1 reports at 
http://talkback-public.mozilla.org/search/start.jsp?search=1&searchby=stacksig&match=contains&searchfor=_PR_MD_ATOMIC_DECREMENT&vendor=MozillaOrg&product=All&platform=All&buildid=091818&sdate=&stime=&edate=&etime=&sortby=bbid&rlimit=500

wider list of all _PR_MD_ATOMIC_DECREMENT at
http://talkback-public.mozilla.org/search/start.jsp?search=1&searchby=stacksig&match=contains&searchfor=_PR_MD_ATOMIC_DECREMENT&vendor=MozillaOrg&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid&rlimit=1000

RC1 reports look like

Stack Signature	 _PR_MD_ATOMIC_DECREMENT 6bcfabf0
Product ID	Firefox2
Build ID	2006091818
Trigger Time	2006-09-27 12:31:53.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	nspr4.dll + (00016ca9)
URL visited	
User Comments	Restarting to add extentions.
Since Last Crash	7572 sec
Total Uptime	7572 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/nsprpub/pr/src/md/windows/ntmisc.c, line 733
Stack Trace 	
_PR_MD_ATOMIC_DECREMENT  [mozilla/nsprpub/pr/src/md/windows/ntmisc.c, line 733]
nsSubstring::Assign  [mozilla/xpcom/string/src/nsTSubstring.cpp, line 306]
nsSubstring::Assign  [mozilla/xpcom/string/src/nsTSubstring.cpp, line 367]
ClearStorageItem  [mozilla/dom/src/storage/nsDOMStorage.cpp, line 694]
nsDOMStorage::ClearAll  [mozilla/dom/src/storage/nsDOMStorage.cpp, line 700]
ClearStorage  [mozilla/dom/src/storage/nsDOMStorage.cpp, line 152]
nsDOMStorageManager::Observe  [mozilla/dom/src/storage/nsDOMStorage.cpp, line 161]
nsObserverService::NotifyObservers  [mozilla/xpcom/ds/nsObserverService.cpp, line 235]
nsCookieService::NotifyChanged  [mozilla/netwerk/cookie/src/nsCookieService.cpp, line 763]
nsCookieService::RemoveAll  [mozilla/netwerk/cookie/src/nsCookieService.cpp, line 811]
XPTC_InvokeByIndex  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1449]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1373]
js_Interpret  [mozilla/js/src/jsinterp.c, line 4110]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1392]
nsXPCWrappedJSClass::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1415]
nsXPCWrappedJS::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 468]
SharedStub  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp, line 147]
nsEventListenerManager::HandleEventSubType  [mozilla/content/events/src/nsEventListenerManager.cpp, line 1655]
nsEventListenerManager::HandleEvent  [mozilla/content/events/src/nsEventListenerManager.cpp, line 1762]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2229]
PresShell::HandleDOMEventWithTarget  [mozilla/layout/base/nsPresShell.cpp, line 6524]
nsButtonBoxFrame::DoMouseClick  [mozilla/layout/xul/base/src/nsButtonBoxFrame.cpp, line 182]
nsButtonBoxFrame::MouseClicked  [mozilla/layout/xul/base/src/nsButtonBoxFrame.h, line 61]
PresShell::HandleEventInternal  [mozilla/layout/base/nsPresShell.cpp, line 6466]
PresShell::HandleEventWithTarget  [mozilla/layout/base/nsPresShell.cpp, line 6323]
nsEventStateManager::CheckForAndDispatchClick  [mozilla/content/events/src/nsEventStateManager.cpp, line 3207]
nsEventStateManager::PostHandleEvent  [mozilla/content/events/src/nsEventStateManager.cpp, line 2170]
PresShell::HandleEventInternal  [mozilla/layout/base/nsPresShell.cpp, line 6497]
PresShell::HandleEvent  [mozilla/layout/base/nsPresShell.cpp, line 6261]
nsViewManager::HandleEvent  [mozilla/view/src/nsViewManager.cpp, line 2559]
nsViewManager::DispatchEvent  [mozilla/view/src/nsViewManager.cpp, line 2246]
HandleEvent  [mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [mozilla/widget/src/windows/nsWindow.cpp, line 1377]
nsWindow::DispatchMouseEvent  [mozilla/widget/src/windows/nsWindow.cpp, line 6336]
ChildWindow::DispatchMouseEvent  [mozilla/widget/src/windows/nsWindow.cpp, line 6583]
nsWindow::WindowProc  [mozilla/widget/src/windows/nsWindow.cpp, line 1565]
USER32.dll + 0x8734 (0x77d48734)
USER32.dll + 0x8816 (0x77d48816)
USER32.dll + 0x89cd (0x77d489cd)
USER32.dll + 0x8a10 (0x77d48a10)
nsAppShell::DispatchNativeEvent  [mozilla/widget/src/windows/nsAppShell.cpp, line 221]
nsContentTreeOwner::ShowAsModal  [mozilla/xpfe/appshell/src/nsContentTreeOwner.cpp, line 478]
nsWindowWatcher::OpenWindow  [mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp, line 479]
XPTC_InvokeByIndex  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1449]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1373]
js_Interpret  [mozilla/js/src/jsinterp.c, line 4110]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1392]
nsXPCWrappedJSClass::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1415]
nsXPCWrappedJS::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 468]
SharedStub  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp, line 147]
nsObserverService::NotifyObservers  [mozilla/xpcom/ds/nsObserverService.cpp, line 235]
nsXREDirProvider::DoShutdown  [mozilla/toolkit/xre/nsXREDirProvider.cpp, line 646]
ScopedXPCOMStartup::~ScopedXPCOMStartup  [mozilla/toolkit/xre/nsAppRunner.cpp, line 551]
main  [mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x16fd7 (0x7c816fd7)

Comment 1

[Adam Guthrie]

I skimmed through some of the reports for this crash in FF2.0 and they all seem to be related to the DOM Storage topcrash that was addressed in bug 353227. So hopefully this was fixed by the patch there.

Comment 2

[Wayne Mery (:wsmwk)]

It does seem like stacks of comment 0 and bug 353227 were fixed with the checkin around 2006-09-25. So I suspect this can be closed or duped.

TB29373883 is FF2, which might be the yahoo problem
_PR_MD_ATOMIC_DECREMENT  [mozilla/nsprpub/pr/src/md/windows/ntmisc.c, line 733]
nsTextNode::`scalar deleting destructor'

Others may be covered by bug 354380, almost all are FF trunk, and little to no variation of this stack TB29582787
_PR_MD_ATOMIC_DECREMENT  [mozilla/nsprpub/pr/src/md/windows/ntmisc.c, line 733]
JS_GC  [mozilla/js/src/jsapi.c, line 1889]

Comment 3

[Andreas Morawietz]

I just closed a firefox window (I had youtube.com opened) and then firefox crashed with that atomic_decrement error.

see here:  TB39533096H

Comment 4

[Brian Carpenter [:geeknik]]

I had 5 or 6 tabs open in Minefield Build 20090810050215 today and it crashed @_PR_MD_ATOMIC_DECREMENT. I don't know which URL caused it.

http://crash-stats.mozilla.com/report/index/81cd0ced-5d2f-4ddf-8a74-aa2472090811?p=1

Comment 5

[Jesse Ruderman on Windows]

About 400 of these in the last week, enough to make it topcrash #150 or so.  But the stacks are all over the place, and for such a low-level function, I bet it's each caller's fault.