Random crashing @ _PR_MD_ATOMIC_DECREMENT

VERIFIED FIXED

Status

()

Core
General
--
critical
VERIFIED FIXED
11 years ago
11 years ago

People

(Reporter: stevee, Unassigned)

Tracking

({regression, topcrash})

Trunk
x86
Windows 2000
regression, topcrash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

11 years ago
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a6pre) Gecko/20070628 Minefield/3.0a6pre ID:2007062805

This is a recent regression, so I don't think it's anything to do with bug 354380 or bug 354912 (both filed about 9 months ago)

I can't reproduce it on demand. But doing general web-browsing (gmail, mozillazine forums, etc) firefox will close itself for no reason.

Peter reports seeing similar crashing with build Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a6pre) Gecko/20070627 Minefield/3.0a6pre ID:2007062721, so we have an upper limit on the checkin range.

I don't get the chance to send any crash data (neither talkback or breakpad appear for me) so I have no stack data.

Breakpad crash stats for the last 24 hours:
https://crash-reports.mozilla.com/reports/?do_query=1&product=Firefox&branch=1.9&signature_search=signature&signature_type=contains&signature=&date=&range_value=1&range_unit=days

People on the mozillazine build forum are reporting stacks:
405991ab-2593-11dc-b3d7-001a4bd43e5c
31ebbee1-2593-11dc-9ee3-001a4bd43ef6
3d856f94-25cc-11dc-b844-001a4bd43ef6
2a07f7ab-25d6-11dc-b42a-001a4bd46e84

All at _PR_MD_ATOMIC_DECREMENT and all Windows machines.

I will try and find: steps to reproduce, whether it can be reproduced on a clean profile or requires extension interaction, and a regression range.
(Reporter)

Updated

11 years ago
Component: General → General
Product: Firefox → Core
QA Contact: general → general
Flags: blocking1.9?
(Reporter)

Comment 1

11 years ago
Three popular stacks are

UUID	8fb2cb35-2653-11dc-9efa-001a4bd43ed6
Time	2007-06-29 08:15:24.930000-07:00
Build ID	2007062805
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 15 model 4 stepping 3
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x661e2f4
Stack of Crashing Thread
frame 	signature
0 	_PR_MD_ATOMIC_DECREMENT
1 	_releaseobject
2 	NPObjWrapper_Finalize
3 	js_FinalizeObject
4 	js_GC
5 	JS_GC
6 	nsXPConnect::BeginCycleCollection()
7 	nsXPConnect::GetContext(JSContext *,nsXPConnect *)
8 	nsCycleCollector::Collect(unsigned int)
9 	nsCycleCollector_collect()

UUID	7a2d114a-2653-11dc-a299-001a4bd43e5c
Time	2007-06-29 08:14:48.830000-07:00
Build ID	2007062805
OS	Windows NT
OS Version	6.0.6000
CPU	x86
CPU Info	AuthenticAMD family 15 model 35 stepping 2
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x5e9e204
Stack of Crashing Thread
frame 	signature
0 	_PR_MD_ATOMIC_DECREMENT
1 	_releaseobject
2 	NPObjWrapper_Finalize
3 	js_FinalizeObject
4 	js_GC
5 	js_DestroyContext
6 	JS_DestroyContext
7 	nsXPConnect::ReleaseJSContext(JSContext *,int)
8 	nsJSContext::~nsJSContext()
9 	nsJSContext::`vector deleting destructor'(unsigned int)

UUID	b715fd59-2651-11dc-b8d9-001a4bd46e84
Time	2007-06-29 08:02:12.020000-07:00
Build ID	2007062805
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 6 model 13 stepping 6
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x830eca4
Stack of Crashing Thread
frame 	signature
0 	_PR_MD_ATOMIC_DECREMENT
1 	_releaseobject
2 	NPObjWrapper_Finalize
3 	js_FinalizeObject
4 	js_GC
5 	JS_GC
6 	nsXREDirProvider::DoShutdown()
7 	ScopedXPCOMStartup::~ScopedXPCOMStartup()
8 	XRE_main
9 	main
I'm attempting a build with the patch from bug 347743 backed out now. We'll see how it goes.
(Reporter)

Comment 3

11 years ago
I've been able to crash:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a6pre) Gecko/2007062718 Minefield/3.0a6pre  (20070627_1759_firefox-3.0a6pre.en-US.win32.zip)

I've not yet been able to crash:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a6pre) Gecko/2007062716 Minefield/3.0a6pre  (20070627_1622_firefox-3.0a6pre.en-US.win32.zip)

Regression Range (from build IDs, plus/minus 1hr):
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-06-27+15&maxdate=2007-06-27+19&cvsroot=%2Fcvsroot

Regression Range (from cf's hourly build archive page at http://hourly-archive.localgho.st/ )
http://bonsai.mozilla.org/cvsquery.cgi?module=PhoenixTinderbox&date=explicit&mindate=1182986520&maxdate=1182992339 

Steps to reproduce (not 100%)
1. New profile, start firefox
2. In first tab, open http://espn.go.com/
3. In second tab, open your gmail account
4. In third tab, open http://nepwin.net
5. In first tab, start the video playing if it's not already (in right hand column)
6. Switch to neowin tab, middle click on Software, Gamers, Forum at top
7. Whilst neowin pages are loading, switch to ESPN tab and close it

Firefox usually crashes for me here. If it doesn't, close the three neowin tabs you opened and reopen ESPN (History > Recently Closed Tabs), start the ESPN video playing again and repeat steps 6 & 7.

Again, I get no talkback or breakpad appear.
(Reporter)

Comment 4

11 years ago
Step 4 is http://www.neowin.net/ damnit.
I've confirmed by local backout that bug 347743 is responsible for this.
Blocks: 347743
Keywords: crash → topcrash

Comment 6

11 years ago
can you backout bug 347743 on trunk now since this crash should not make it into the alpha 
mconnor just backed out 347743. FIXED.
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
Flags: blocking1.9?
(Reporter)

Comment 8

11 years ago
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a6pre) Gecko/20070629 Minefield/3.0a6pre ID:2007062910

I've been unable to reproduce since bug 347743 got backed out.
--> VERIFIED
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.