386332 - Random crashing @ _PR_MD_ATOMIC_DECREMENT

Status: VERIFIED FIXED

(Core :: General, defect)

Description

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a6pre) Gecko/20070628 Minefield/3.0a6pre ID:2007062805

This is a recent regression, so I don't think it's anything to do with bug 354380 or bug 354912 (both filed about 9 months ago)

I can't reproduce it on demand. But doing general web-browsing (gmail, mozillazine forums, etc) firefox will close itself for no reason.

Peter reports seeing similar crashing with build Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a6pre) Gecko/20070627 Minefield/3.0a6pre ID:2007062721, so we have an upper limit on the checkin range.

I don't get the chance to send any crash data (neither talkback or breakpad appear for me) so I have no stack data.

Breakpad crash stats for the last 24 hours:
https://crash-reports.mozilla.com/reports/?do_query=1&product=Firefox&branch=1.9&signature_search=signature&signature_type=contains&signature=&date=&range_value=1&range_unit=days

People on the mozillazine build forum are reporting stacks:
405991ab-2593-11dc-b3d7-001a4bd43e5c
31ebbee1-2593-11dc-9ee3-001a4bd43ef6
3d856f94-25cc-11dc-b844-001a4bd43ef6
2a07f7ab-25d6-11dc-b42a-001a4bd46e84

All at _PR_MD_ATOMIC_DECREMENT and all Windows machines.

I will try and find: steps to reproduce, whether it can be reproduced on a clean profile or requires extension interaction, and a regression range.

Comment 1

[Steve England [:stevee]]

Three popular stacks are

UUID	8fb2cb35-2653-11dc-9efa-001a4bd43ed6
Time	2007-06-29 08:15:24.930000-07:00
Build ID	2007062805
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 15 model 4 stepping 3
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x661e2f4
Stack of Crashing Thread
frame 	signature
0 	_PR_MD_ATOMIC_DECREMENT
1 	_releaseobject
2 	NPObjWrapper_Finalize
3 	js_FinalizeObject
4 	js_GC
5 	JS_GC
6 	nsXPConnect::BeginCycleCollection()
7 	nsXPConnect::GetContext(JSContext *,nsXPConnect *)
8 	nsCycleCollector::Collect(unsigned int)
9 	nsCycleCollector_collect()

UUID	7a2d114a-2653-11dc-a299-001a4bd43e5c
Time	2007-06-29 08:14:48.830000-07:00
Build ID	2007062805
OS	Windows NT
OS Version	6.0.6000
CPU	x86
CPU Info	AuthenticAMD family 15 model 35 stepping 2
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x5e9e204
Stack of Crashing Thread
frame 	signature
0 	_PR_MD_ATOMIC_DECREMENT
1 	_releaseobject
2 	NPObjWrapper_Finalize
3 	js_FinalizeObject
4 	js_GC
5 	js_DestroyContext
6 	JS_DestroyContext
7 	nsXPConnect::ReleaseJSContext(JSContext *,int)
8 	nsJSContext::~nsJSContext()
9 	nsJSContext::`vector deleting destructor'(unsigned int)

UUID	b715fd59-2651-11dc-b8d9-001a4bd46e84
Time	2007-06-29 08:02:12.020000-07:00
Build ID	2007062805
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 6 model 13 stepping 6
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x830eca4
Stack of Crashing Thread
frame 	signature
0 	_PR_MD_ATOMIC_DECREMENT
1 	_releaseobject
2 	NPObjWrapper_Finalize
3 	js_FinalizeObject
4 	js_GC
5 	JS_GC
6 	nsXREDirProvider::DoShutdown()
7 	ScopedXPCOMStartup::~ScopedXPCOMStartup()
8 	XRE_main
9 	main

Comment 2

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

I'm attempting a build with the patch from bug 347743 backed out now. We'll see how it goes.

Comment 3

[Steve England [:stevee]]

I've been able to crash:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a6pre) Gecko/2007062718 Minefield/3.0a6pre  (20070627_1759_firefox-3.0a6pre.en-US.win32.zip)

I've not yet been able to crash:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a6pre) Gecko/2007062716 Minefield/3.0a6pre  (20070627_1622_firefox-3.0a6pre.en-US.win32.zip)

Regression Range (from build IDs, plus/minus 1hr):
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-06-27+15&maxdate=2007-06-27+19&cvsroot=%2Fcvsroot

Regression Range (from cf's hourly build archive page at http://hourly-archive.localgho.st/ )
http://bonsai.mozilla.org/cvsquery.cgi?module=PhoenixTinderbox&date=explicit&mindate=1182986520&maxdate=1182992339 

Steps to reproduce (not 100%)
1. New profile, start firefox
2. In first tab, open http://espn.go.com/
3. In second tab, open your gmail account
4. In third tab, open http://nepwin.net
5. In first tab, start the video playing if it's not already (in right hand column)
6. Switch to neowin tab, middle click on Software, Gamers, Forum at top
7. Whilst neowin pages are loading, switch to ESPN tab and close it

Firefox usually crashes for me here. If it doesn't, close the three neowin tabs you opened and reopen ESPN (History > Recently Closed Tabs), start the ESPN video playing again and repeat steps 6 & 7.

Again, I get no talkback or breakpad appear.

Comment 4

[Steve England [:stevee]]

Step 4 is http://www.neowin.net/ damnit.

Comment 5

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

I've confirmed by local backout that bug 347743 is responsible for this.

Comment 6

[gabe]

can you backout bug 347743 on trunk now since this crash should not make it into the alpha 

Comment 7

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

mconnor just backed out 347743. FIXED.

Comment 8

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a6pre) Gecko/20070629 Minefield/3.0a6pre ID:2007062910

I've been unable to reproduce since bug 347743 got backed out.
--> VERIFIED