401664 - crashes at nsTObserverArray_base::AdjustIterators(int, int)

Status: RESOLVED WORKSFORME

(Core :: General, defect)

Description

[Mike Beltzner [:beltzner, not reading bugmail]]

(Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.9a9pre) Gecko/2007102904 Minefield/3.0a9pre, on OS X 10.5 9A559)

I've been getting a lot of crashes lately, all with the same stack trace. I don't have solid STR, but it seems to happen more when I'm using Bugzilla, like now!

The symptoms are:
 - the in focus tab fails to load (half-renders, throbber just spins)
 - I click any UI element
 - crash!

Comment 1

[Mike Beltzner [:beltzner, not reading bugmail]]

Attachment: contents of safe-mode console output

Attached the console output from safe-mode in case it's indicative of something ...

Comment 2

[timeless]

the comments list a number of bugs, are you sure we needed one more?

Comment 3

[Boris Zbarsky [:bzbarsky]]

I don't see what XBL has to do with it.  All document mutations go through the binding manager, but that's the only XBL involvement I see in the stack.  Putting back in General pending someone having some idea what's going on.

If we have other bugs with the same stack, perhaps they should all depend on one of them.  Do any of those other bugs have any reliable steps to reproduce?

Comment 4

[Mike Beltzner [:beltzner, not reading bugmail]]

Again, not sure if it helps, but when I attach gdb to a build and watch it crash, I get:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x0000003f
0x0139247f in GetSecurityContext ()

Not running a debug build (can't get XCode 3.0 to install on this machine atm), sorry that I don't have symbols.

Comment 5

[(not reading, please use [e-mail] instead)]

I hit this same crasher a bunch of times with 2007112004 and 2007112104  on Mac OS X 10.4.11

Like beltzner, I don't have any steps to reproduce.  

I think I was either closing tabs, closing windows, or clicking on links?  Sorry, that isn't very helpful.

http://crash-stats.mozilla.com/report/index/31f23c2e-98a0-11dc-99b3-001a4bd43ef6?date=2007-11-22-02
http://crash-stats.mozilla.com/report/index/2ca60b23-98a0-11dc-a232-001a4bd46e84?date=2007-11-22-02
http://crash-stats.mozilla.com/report/index/3066154a-98a0-11dc-8cb4-001a4bd43e5c?date=2007-11-22-02
http://crash-stats.mozilla.com/report/index/3433630a-98a0-11dc-9538-001a4bd46e84?date=2007-11-22-02
http://crash-stats.mozilla.com/report/index/a3ae9fb5-989f-11dc-94c3-001a4bd43e5c?date=2007-11-22-02
http://crash-stats.mozilla.com/report/index/7a059f21-989f-11dc-8ea1-001a4bd43ed6?date=2007-11-22-02
http://crash-stats.mozilla.com/report/index/b4905eab-989f-11dc-8b51-001a4bd46e84?date=2007-11-22-02
http://crash-stats.mozilla.com/report/index/e68cee14-989f-11dc-8654-001a4bd43ef6?date=2007-11-22-02
http://crash-stats.mozilla.com/report/index/ee7d8930-989f-11dc-8ec1-001a4bd46e84?date=2007-11-22-02
http://crash-stats.mozilla.com/report/index/f0c29942-989f-11dc-9ca3-001a4bd43e5c?date=2007-11-22-02
http://crash-stats.mozilla.com/report/index/f1e5e599-989f-11dc-9482-001a4bd43ef6?date=2007-11-22-02
http://crash-stats.mozilla.com/report/index/375a4557-98a0-11dc-8fa7-001a4bd46e84?date=2007-11-22-02

On the top of the stacks, I usually see something like:

0     nsTObserverArray_base::AdjustIterators(int, int)     nsTObserverArray.cpp:50
1     nsBindingManager::RemoveObserver(nsIMutationObserver*)     mozilla/content/xbl/src/nsBindingManager.cpp:159
2     nsDocument::RemoveMutationObserver(nsIMutationObserver*)     mozilla/content/base/src/nsDOMSerializer.cpp:2684
3     nsDocument::RemoveObserver(nsIDocumentObserver*)     mozilla/content/base/src/nsDOMSerializer.cpp:2705

or

0  	nsTObserverArray_base::AdjustIterators(int, int)  	 nsTObserverArray.cpp:51
1 	nsDocument::DeleteShell(nsIPresShell*) 	mozilla/content/base/src/nsDOMSerializer.cpp:159

But beyond that, it varies.

Comment 6

[Mike Beltzner [:beltzner, not reading bugmail]]

So, for a while I tried disabling extensions, but it kept happening.
I tried ditching my sessionstore, but it kept happening.

Then it stopped for a while. I haven't felt it since.

It saddens me that Seth is affected.

Josh: anything in that stack inspire you?

Comment 7

[(not reading, please use [e-mail] instead)]

I'm not using extensions.  I don't think I was using the proto theme, either.

note, I haven't crashed Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b2pre) Gecko/2007112104 Minefield/3.0b2pre since I've rebooted.

I'll keep an eye out.

Comment 8

[Jesse Ruderman]

There were only 5 crash reports in nsTObserverArray_base::AdjustIterators this week, and most of those were from Firefox 3.0 Beta 3 (!).  I think I can confidently say this is no longer a frequent crash.