Created attachment 266221 [details] testcase (causes shutdown crash) Steps to reproduce: 1. Load the testcase. 2. Cmd+Q. Result: Firefox crashes during shutdown. Sometimes it's EXC_BAD_INSTRUCTION but usually it looks exactly like this: Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_INVALID_ADDRESS (0x0001) at 0x80000001 Thread 0 Crashed: 0 <<00000000>> 0x80000001 0 + -2147483647 1 nsXPConnect::Unlink(void*) + 55 (nsXPConnect.cpp:619) 2 nsCycleCollector::CollectWhite(GCGraph&) + 518 (nsCycleCollector.cpp:1360) 3 nsCycleCollector::Collect(unsigned) + 392 (nsCycleCollector.cpp:2005) 4 nsCycleCollector::Shutdown() + 49 (nsCycleCollector.cpp:2051) 5 nsCycleCollector_shutdown() + 40 (nsCycleCollector.cpp:2207) 6 NS_ShutdownXPCOM_P + 857 (nsXPComInit.cpp:780) 7 ScopedXPCOMStartup::~ScopedXPCOMStartup [in-charge]() + 57 (nsAppRunner.cpp:794) 8 XRE_main + 5992 (nsAppRunner.cpp:2856) 9 main + 40 (nsBrowserApp.cpp:70) 10 _start + 216 11 start + 41
Steps to reproduce: 1. Download the testcase. 2. Launch a debug build of Firefox (from the command line). 3. Drag the testcase into it from Finder or the Desktop. 4. Cmd+Q Firefox. Result: crash. I swear it wasn't so fragile before I made the reduced testcase ;)
Created attachment 266447 [details] [diff] [review] v1 Haven't been able to reproduce this yet. Any chance you could try this patch?
Comment on attachment 266447 [details] [diff] [review] v1 Any reason to move GCTypeToTraceKindMap up? /be
Yep, that fixes the crash :)
Created attachment 266873 [details] [diff] [review] v1.1
Status: NEW → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
Whiteboard: [sg:critical] → [sg:critical] post 1.8-branch
Testcase checked in as a crashtest.
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.