37809 - Crash on exit on Windows 2000 (WAS: crashes at gc_root_marker [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 647])

Status: VERIFIED WORKSFORME

(Core :: JavaScript Engine, defect, P3)

Description

[Shiva Thirumazhusai]

User comments to Reproduce :-
Shut it down by hitting the "X" button on the window manager frame.


Incident ID 9009796 
gc_root_marker [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 647] 
JS_HashTableEnumerateEntries [d:\builds\seamonkey\mozilla\js\src\jshash.c, line 
364] 
js_GC [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 788] 
js_ForceGC [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 679] 
js_DestroyContext [d:\builds\seamonkey\mozilla\js\src\jscntxt.c, line 184] 
JS_DestroyContext [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 795] 
nsJSContext::~nsJSContext 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 190] 
nsJSContext::`scalar deleting destructor' 
nsJSContext::Release 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 195] 
nsCOMPtr_base::assign_with_AddRef 
[d:\builds\seamonkey\mozilla\xpcom\base\nsCOMPtr.cpp, line 59] 
nsXULPrototypeDocument::~nsXULPrototypeDocument 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULPrototypeDocument.cpp, line 
179] 
nsXULPrototypeDocument::`scalar deleting destructor' 
nsXULPrototypeDocument::Release 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULPrototypeDocument.cpp, line 
187] 
nsCOMPtr_base::~nsCOMPtr_base 
[d:\builds\seamonkey\mozilla\xpcom\base\nsCOMPtr.cpp, line 50] 
ntdll.dll + 0x49d8f (0x77fc9d8f) 
nsXULDocument::`scalar deleting destructor' 
nsXULDocument::Release 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 630] 
nsEventStateManager::~nsEventStateManager 
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line 
159] 
nsEventStateManager::`scalar deleting destructor' 
nsEventStateManager::Release 
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line 
229] 
nsSupportsArray::Clear 
[d:\builds\seamonkey\mozilla\xpcom\ds\nsSupportsArray.cpp, line 320] 
nsSupportsArray::DeleteArray 
[d:\builds\seamonkey\mozilla\xpcom\ds\nsSupportsArray.cpp, line 64] 
nsSupportsArray::`vector deleting destructor' 
nsObserverList::~nsObserverList 
[d:\builds\seamonkey\mozilla\xpcom\ds\nsObserverList.cpp, line 187] 
nsObserverList::`scalar deleting destructor' 
nsObserverList::Release 
[d:\builds\seamonkey\mozilla\xpcom\ds\nsObserverList.cpp, line 157] 
PurgeProxyClasses 
[d:\builds\seamonkey\mozilla\xpcom\proxy\src\nsProxyObjectManager.cpp, line 106] 
_hashEnumerateRemove [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp, line 
230] 
PL_HashTableEnumerateEntries [plhash.c, line 369] 
nsHashtable::Reset [d:\builds\seamonkey\mozilla\xpcom\ds\nsHashtable.cpp, line 
247] 


-------------------------------------------------------------------

CODE Around the crash Area


642              
643 fur     3.6  JS_STATIC_DLL_CALLBACK(intN)
644              gc_root_marker(JSHashEntry *he, intN i, void *arg)
645 ltabb   1.1  {
646 brendan 3.10     jsval *rp = (jsval *)he->key;
647 fur     3.8      jsval v = *rp;
648 ltabb   1.1  
649 fur     3.8      /* Ignore null object and scalar values. */
650 brendan 3.10     if (!JSVAL_IS_NULL(v) && JSVAL_IS_GCTHING(v)) {
651                      JSRuntime *rt = (JSRuntime *)arg;
652 fur     3.6  #ifdef DEBUG
653 fur     3.8          JSArena *a;
654                      JSBool root_points_to_gcArenaPool = JS_FALSE;
655 brendan 3.10        void *thing = JSVAL_TO_GCTHING(v);
656              
657 fur     3.6          for (a = rt->gcArenaPool.first.next; a; a = a->next) {
658 brendan 3.10            if (JS_UPTRDIFF(thing, a->base) < a->avail - 
a->base) {
659 fur     3.6                  root_points_to_gcArenaPool = JS_TRUE;
660                              break;
661                          }
662                      }
663                      JS_ASSERT(root_points_to_gcArenaPool);
664              #endif
665 fur     3.8  
666 brendan 3.10         GC_MARK(rt, JSVAL_TO_GCTHING(v), he->value ? he->value 
: "root", NULL);
667 fur     3.6      }
668 ltabb   1.1      return HT_ENUMERATE_NEXT;
669              }

Comment 1

[Shiva Thirumazhusai]

Adding topcrash keyword

Comment 2

[leger]

Adding crash to keywords

Comment 3

[Phil Schwartau]

Sorry for the delay - taking over QA for the JavaScript Engine group -

I have: Mozilla debug Linux and Windows builds made on 06/19/00, 06/20/00 resp.
OS: Linux Red Hat 2.2.12-20smp   
OS: WinNT 4.0 (SP5)

I do not get any crash at www.ibm.com. Mozilla quits the page successfully
whether I click the "x" in the window manager frame, or do File|Quit.
This works fine on WinNT and Linux debug builds.

However, on Windows 2000 (the OS of the original report), I do get 
a crash on exit from ANY Web page, whether via the "x" or File|Quit. 

Sample Stack Trace 

IMGlue.dll + 0x4668 (0x603f4668) 
IMGlue.dll + 0x4f35 (0x603f4f35) 
IMGlue.dll + 0xf4be (0x603ff4be) 
IMGlue.dll + 0xc5b5 (0x603fc5b5) 
IMGlue.dll + 0xf48e (0x603ff48e) 

Comment 4

[Phil Schwartau]

Mozilla crash-on-exit on Windows 2000 occurred on the 2000-06-19 commercial 
build. I am not seeing this problem today, on the 2000-06-20 commercial build.

Adding John Morrison to cc list. John, could you verify this if you get a 
chance? Thanks!

Comment 5

[John Morrison]

With 20000621nn builds on Win2k, both comm. and mozilla, I do not get this 
crash. (However, there have been a number of flakey crash on exit bugs in 
the code in the past few weeks (often with a similar stack to the one that
namachi originally filed)). 

namachi : is this still a 'topcrash' in talkback reports?


(p.s. I think the IMGlue.dll stack trace is bogus)

Comment 6

[Shiva Thirumazhusai]

It is not in there recent builds topcrash list.  It is one of the topcrashes in
nsbeta1. If needed we can later it to post-nsbeta2. 

Comment 7

[Phil Schwartau]

Resolving as WorksForMe 

Comment 8

[leger]

Yes, no longer crashing.  Marking Verified.

Comment 9

[Shiva Thirumazhusai]

Moving all the Works For Me bugs to talkback user account for future reference.

Comment 10

[Shiva Thirumazhusai]

We are gathering all the Resolved and WFM bugs which are happened to be topcrash 
bugs and assigning it to talkback. I am marking all of them as RESOLVED WFM.

Comment 11

[Phil Schwartau]

Marking Verified -