402661 - crash [@ RtlpCoalesceFreeBlocks][@ XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)]

Status: VERIFIED DUPLICATE of bug 354624

(Core :: XPConnect, defect, P1)

Description

[Samuel Sidler (old account; do not CC)]

This is a trunk topcrash. See bp-2d57830f-8c0f-11dc-b200-001a4bd43e5c and others in the URL field. Crashes with this signature were popular not too long ago and have regained their standing. Right now I'm only seeing this on Windows, but that might just be because there aren't enough users of trunk builds.

For posterity:

Firefox 3.0a9pre Crash Report
UUID	2d57830f-8c0f-11dc-b200-001a4bd43e5c
Time	2007-11-05 18:22:44-08:00
Build ID	2007110516
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 6 model 15 stepping 6
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x0
URL	http://www.bpb.de/themen/P7FIZR,,0,AlQaida.html

Stack of Crashing Thread
frame 	signature 	source
0 	RtlpCoalesceFreeBlocks 	
1 	RtlpCoalesceFreeBlocks 	
2 	msvcr80.dll@0x4c38 	
3 	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2514
4 	XPC_WN_CallMethod(JSContext*, JSObject*, unsigned int, long*, long*) 	mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1467
5 	js_Invoke 	mozilla/js/src/jsinterp.c:1386
6 	js_Interpret 	mozilla/js/src/jsinterp.c:4146
7 	js_Invoke 	mozilla/js/src/jsinterp.c:1406
8 	nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) 	mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1441
9 	nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) 	mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp:567
10 	PrepareAndDispatch 	mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114
11 	SharedStub 	mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141
12 	nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEventListener*, nsIDOMEvent*, nsISupports*, unsigned int) 	mozilla/content/events/src/nsEventListenerManager.cpp:1097
13 	nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**, nsISupports*, unsigned int, nsEventStatus*) 	mozilla/content/events/src/nsEventListenerManager.cpp:1211

Comment 1

[Johnny Stenback (:jst)]

Any help with ways to reproduce this would be greatly appreciated.

Comment 2

[Samuel Sidler (old account; do not CC)]

The URLs from the query don't give much information about what users were doing when the crash happened and none of them that I tried seem to cause the crash itself. (Wouldn't comments in crash reports be nice? Bug 382538 on file.)

Comment 3

[Benjamin Smedberg]

Crashes in RtlpCoalesceFreeBlocks mean that the heap has been corrupted, perhaps far in the past. It's unlikely that the current URL has anything to do with it. Valgrind and other memory-safety tools are the best bet for finding out what's going on.

Comment 4

[Michael Köhler [:Coce]]

I can reproduce this crash (report: <http://crash-stats.mozilla.com/report/index/b09cbd07-9481-11dc-8db3-001a4bd43e5c?date=2007-11-16-20>)
Gran Paradiso crashes, when I right-click somewhere on a webpage.
Operating system: Microsoft Windows XP + Service Pack 2
Firefox version: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9b1) Gecko/2007110904 Firefox/3.0b1 - Build ID: 2007110904
Extensions: 
Activated Extensions: [18]
- Adblock Plus 0.7.5.3: http://adblockplus.org/
- Add to Search Bar 1.6: http://maltekraus.de/Firefox/search-tools
- German Dictionary 1.0.1
- DOM Inspector 1.9b1: http://www.mozilla.org/projects/inspector/
- Download Manager Tweak 0.7.2: http://dmextension.mozdev.org/
- FlashGot 0.6.9.9: http://flashgot.net
- FootieFox 1.2.5: http://www.footiefox.com/
- Free Download Manager plugin 1.3: http://freedownloadmanager.org/
- Greasemonkey 0.6.9.20070507.0: http://greasemonkey.mozdev.org/
- IE Tab 1.3.3.20070528: http://ietab.mozdev.org/
- Menu Editor 1.2.3.3: http://menueditor.mozdev.org/
- MinimizeToTray 0.0.1.2006102615+: http://minimizetotray.mozdev.org/
- MR Tech Local Install 5.3.2.6: http://www.mrtech.com/extensions/local_install/
- noscript 1.1.8: http://noscript.net/
- Optimoz Tweaks 0.4: http://optimoz.mozdev.org/tweaks/
- Save Link in Folder 1.3.3: http://mozext.achimonline.de
- Update Notifier 0.1.5.2: http://www.longfocus.com/firefox/updatenotifier
- userChrome.js 0.7: http://forums.mozillazine.org/viewtopic.php?t=397735

Deactivated Extensions [4]
- Clippings 2.6: http://clippings.mozdev.org/
- Forecastfox Enhanced [de] 0.9.5.2: http://users.rcn.com/shoofy/forecastfox_enhanced/
- Locationbar² 0.9.1: http://en.design-noir.de/mozilla/locationbar2/
- Stop Autoplay [de] 0.4.1: http://hemiolapei.free.fr/divers/sap/sap-en.html

Total extensions: 22

Gran Paradiso does not crash, if I start it in Safe Mode

Comment 5

[Johnny Stenback (:jst)]

Michael, could you by any chance try to see if it's one of those extensions, or a combination of one of those extensions that is causing Firefox to crash when following your steps to reproduce? I.e. start disabling extensions and see if you can figure out which one(s) are causing the problem? That would help greatly here!

Comment 6

[Michael Köhler [:Coce]]

I just tested, and found the problem. It's the "Free Download Manager plugin", which causes Gran Paradiso to crash. (It's listed in the extensions manager, not in the plugins manager.) If I disable it, Gran Paradiso doesn't crash when I right-click on a page.

Comment 7

[(not currently active) Ted Mielczarek]

Dupe of bug 354624 ?

Comment 8

[Johnny Stenback (:jst)]

Yup, dupe, and it's not a Firefox bug, it's a extension bug, see bug 354624 for details.