408820 - gc crash [@ nsXULPrototypeNode::cycleCollection]

Status: RESOLVED INCOMPLETE

(Core :: XUL, defect)

Description

[timeless]

Build identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b3pre) Gecko/2007121205 Minefield/3.0b3pre

I'm playing w/ a file "0.xul" on c:\, and when i load it, if i then interact w/ firefox for a moment or so, it crashes. Unfortunately, my proxy seems to be unhappy, so i can't seem to send crash reports.

Here's what windbg has to say:

WARNING: Frame IP not in any known module. Following frames may be wrong.
00 0x46c17be
01 xul!nsXULPrototypeNode::cycleCollection::Unroot(void * p = 0x0000004f)+0x13 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\xul\content\src\nsxulelement.cpp @ 2454]
02 xul!nsCycleCollector::CollectWhite(struct GCGraph * graph = 0x0000004f)+0xe3 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\base\nscyclecollector.cpp @ 1527]
03 xul!nsCycleCollector::DoCollect(void)+0xb5 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\base\nscyclecollector.cpp @ 2217]
04 xul!XPCCycleCollectGCCallback(struct JSContext * cx = 0x014629c8, JSGCStatus status = JSGC_MARK_END (2))+0x1e [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\xpconnect\src\nsxpconnect.cpp @ 430]
05 js3250!js_GC(struct JSContext * cx = 0x014629c8, JSGCInvocationKind gckind = GC_NORMAL (0))+0x209 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\jsgc.c @ 2526]
06 js3250!JS_GC(struct JSContext * cx = 0x608abc3b)+0x2b [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\jsapi.c @ 2397]
07 xul!nsXPConnect::Collect(void)+0x6e [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\xpconnect\src\nsxpconnect.cpp @ 517]
08 xul!nsCycleCollector::Collect(unsigned int aTryCollections = 1)+0x50 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\base\nscyclecollector.cpp @ 2096]
09 xul!nsCycleCollector_collect(void)+0x11 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\base\nscyclecollector.cpp @ 2646]
0a xul!nsJSContext::CC(void)+0x23 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\dom\src\base\nsjsenvironment.cpp @ 3313]
0b xul!nsUserActivityObserver::Observe(class nsISupports * aSubject = 0x00000000, char * aTopic = 0x60a7cf30 "user-interaction-inactive", wchar_t * aData = 0x00000000 "")+0x4c [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\dom\src\base\nsjsenvironment.cpp @ 259]
0c xul!nsObserverList::NotifyObservers(class nsISupports * aSubject = 0x00000000, char * aTopic = 0x60a7cf30 "user-interaction-inactive", wchar_t * someData = 0x00000000 "")+0x44 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\ds\nsobserverlist.cpp @ 128]
0d xul!nsObserverService::NotifyObservers(class nsISupports * aSubject = 0x00000000, char * aTopic = 0x60a7cf30 "user-interaction-inactive", wchar_t * someData = 0x00000000 "")+0x50 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\ds\nsobserverservice.cpp @ 184]
0e xul!nsUITimerCallback::Notify(class nsITimer * aTimer = 0x0146f198)+0x75 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\events\src\nseventstatemanager.cpp @ 210]
0f xul!nsTimerImpl::Fire(void)+0x9f [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\threads\nstimerimpl.cpp @ 415]
10 xul!nsTimerEvent::Run(void)+0x1b [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\threads\nstimerimpl.cpp @ 489]
11 xul!nsThread::ProcessNextEvent(int mayWait = 1, int * result = 0x0012e0ac)+0xc3 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\threads\nsthread.cpp @ 511]
12 xul!NS_ProcessNextEvent_P(class nsIThread * thread = 0x00000001, int mayWait = 1)+0x20 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\obj-fx-trunk\xpcom\build\nsthreadutils.cpp @ 227]
13 xul!nsXULWindow::ShowModal(void)+0x94 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpfe\appshell\src\nsxulwindow.cpp @ 398]
14 xul!nsContentTreeOwner::ShowAsModal(void)+0x1d [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpfe\appshell\src\nscontenttreeowner.cpp @ 525]
15 xul!nsWindowWatcher::OpenWindowJSInternal(class nsIDOMWindow * aParent = 0x00000000, char * aUrl = 0x04fe8780 "chrome://mozapps/content/extensions/extensions.xul", char * aName = 0x00000000 "", char * aFeatures = 0x04fe8908 "chrome,centerscreen,extra-chrome,dialog,resizable,modal", int aDialog = 1, class nsIArray * argv = 0x05ae6f70, int aCalledFromJS = 0, class nsIDOMWindow ** _retval = 0x0012e404)+0xfa9 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\embedding\components\windowwatcher\src\nswindowwatcher.cpp @ 946]
16 xul!nsWindowWatcher::OpenWindow(class nsIDOMWindow * aParent = 0x00000000, char * aUrl = 0x04fe8780 "chrome://mozapps/content/extensions/extensions.xul", char * aName = 0x00000000 "", char * aFeatures = 0x04fe8908 "chrome,centerscreen,extra-chrome,dialog,resizable,modal", class nsISupports * aArguments = 0x00000000, class nsIDOMWindow ** _retval = 0x0012e404)+0x1d6 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\embedding\components\windowwatcher\src\nswindowwatcher.cpp @ 419]
17 xul!NS_InvokeByIndex_P(class nsISupports * that = 0x00c312e8, unsigned int methodIndex = 3, unsigned int paramCount = 6, struct nsXPTCVariant * params = 0x0012e3b4)+0x27 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp @ 102]
18 xul!XPCWrappedNative::CallMethod(class XPCCallContext * ccx = 0x603eab2d, XPCWrappedNative::CallMode mode = 1238020 (No matching enumerant))+0x874 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp @ 2342]
19 0x54e20b8
1a js3250!js_DefineProperty(struct JSContext * cx = 0x600b86a8, struct JSObject * obj = 0x01784558, long id = 1610960751, long value = 24659288, <function> * getter = 0x03430ac0, <function> * setter = 0x00000005, unsigned int attrs = 0x1784558, struct JSProperty ** propp = 0x60054f22)+0x24 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\jsobj.c @ 3054]
1b 0x3430ac0
1c xul!XPCNativeMember::GetCallInfo(class XPCCallContext * ccx = 0x0012e5e4, struct JSObject * funobj = 0x603eadb8, class XPCNativeInterface ** pInterface = 0x0012e564, class XPCNativeMember ** pMember = 0x00000000)+0x34 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\xpconnect\src\xpcwrappednativeinfo.cpp @ 101]
1d 0xf89372c4
1e js3250!js_Invoke(struct JSContext * cx = 0x00000001, unsigned int argc = 5, long * vp = 0x05c1302c, unsigned int flags = 0)+0x475 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\jsinterp.c @ 1356]
1f js3250!js_Interpret(struct JSContext * cx = 0x01784558, unsigned char * pc = 0x011a4b08 "T", long * result = 0x0012e850)+0x43ff [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\jsinterp.c @ 4176]
20 js3250!js_Invoke(struct JSContext * cx = 0x00000001, unsigned int argc = 3, long * vp = 0x05c12fe0, unsigned int flags = 2)+0x4b6 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\jsinterp.c @ 1376]
21 xul!nsXPCWrappedJSClass::CallMethod(class nsXPCWrappedJS * wrapper = 0x04c10570, unsigned short methodIndex = 3, struct XPTMethodDescriptor * info = 0x01164248, struct nsXPTCMiniVariant * nativeParams = 0x0012ea14)+0x749 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\xpconnect\src\xpcwrappedjsclass.cpp @ 1443]
22 xul!nsXPCWrappedJS::CallMethod(unsigned short methodIndex = 0x5b0, struct XPTMethodDescriptor * info = 0x00000003, struct nsXPTCMiniVariant * params = 0x0012eacc)+0x27 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\xpconnect\src\xpcwrappedjs.cpp @ 568]
23 xul!PrepareAndDispatch(class nsXPTCStubBase * self = 0x04c105b0, unsigned int methodIndex = 3, unsigned int * args = 0x0012eacc, unsigned int * stackBytesToPop = 0x0012eabc)+0xe7 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp @ 114]
24 xul!SharedStub(void)+0x16 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcstubs.cpp @ 142]
25 xul!NS_InvokeByIndex_P(class nsISupports * that = 0x04c105b0, unsigned int methodIndex = 0, unsigned int paramCount = 0x3d2dc68, struct nsXPTCVariant * params = 0x05409800)+0x27 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp @ 102]
26 xul!XPCWrappedNative::CallMethod(class XPCCallContext * ccx = 0x0012ebe8, XPCWrappedNative::CallMode mode = 1614609806 (No matching enumerant))+0x874 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp @ 2342]
27 0x1780091
28 xul!XPCCallContext::~XPCCallContext(void)+0x83 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\xpconnect\src\xpccallcontext.cpp @ 355]
29 xul!XPC_WN_OnlyIWrite_PropertyStub(struct JSContext * cx = 0x00000004, struct JSObject * obj = 0x00000000, long idval = 12551104, long * vp = 0x01784708)+0x48 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp @ 511]

Comment 1

[Boris Zbarsky [:bzbarsky]]

Can you attach the XUL file?

Comment 2

[timeless]

Attachment: doesn't seem very relevant

it doesn't seem to always reproduce, I think it might relate more to the fact that extension manager wants to trigger an update.

the js stack seems to hold this:

filename,lineno
0x01197bd1 "file:///C:/home/Desktop/firefox-3.0b3pre.en-US.win32/firefox/components/nsExtensionManager.js"
0x164f
0x053fa9f1 "chrome://global/content/alerts/alert.js"
0xb8
0x04996449 "chrome://global/content/alerts/alert.xul"
1

Comment 3

[Jason Oster (:Parasyte)]

Looks like the same crash that just struck me in Firefox 3.5 RC3: http://crash-stats.mozilla.com/report/index/cde3ed19-ada1-448c-a30a-8c0ea2090626

Comment 4

[Wayne Mery (:wsmwk)]

timeless, still see this?

not quite same stack bp-749ed9f8-743b-4e5a-9ba2-d92b22110425

EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

0x7d820000
0		@0x1007d820000	
1	XUL	nsXULPrototypeNode::cycleCollection::Unroot	content/xul/content/src/nsXULElement.h:219
2	XUL	nsCycleCollector::CollectWhite	xpcom/base/nsCycleCollector.cpp:1928
3	XUL	nsCycleCollector::FinishCollection	xpcom/base/nsCycleCollector.cpp:2720
4	XUL	nsCycleCollector::Collect	xpcom/base/nsCycleCollector.cpp:2530
5	XUL	nsCycleCollector_shutdown	xpcom/base/nsCycleCollector.cpp:2779
6	XUL	mozilla::ShutdownXPCOM	xpcom/build/nsXPComInit.cpp:694

Comment 5

[Wayne Mery (:wsmwk)]

je_free | nsXULPrototypeNode::cycleCollection::Unlink(void*) 
bp-a2b3471f-4be7-4963-8207-4f6d52120622
0	mozglue.dll	je_free	memory/jemalloc/jemalloc.c:6541
1	xul.dll	nsXULPrototypeNode::cycleCollection::Unlink	content/xul/content/src/nsXULElement.cpp:2530
2	xul.dll	nsCycleCollector::CollectWhite	xpcom/base/nsCycleCollector.cpp:2448
3	xul.dll	nsCycleCollector::FinishCollection	xpcom/base/nsCycleCollector.cpp:3273 

nsXULPrototypeNode::cycleCollection::Unlink(void*) 
bp-7100ccfd-81bb-4b13-8a59-03abb2120627


I sampled have the sigs of https://crash-stats.mozilla.com/query/query?product=Firefox&version=ALL%3AALL&range_value=2&range_unit=weeks&date=06%2F30%2F2012+14%3A31%3A28&query_search=signature&query_type=contains&query=nsXULPrototypeNode%3A%3AcycleCollection&reason=&build_id=&hang_type=any&do_query=1 and found only the above