427108 - crash [@extent_tree_ad_s_RB_REMOVE jemalloc.c:1986] closing gmail...

Status: RESOLVED WORKSFORME

(Core :: Memory Allocator, defect)

Description

[chris hofmann]

not sure which component to assign or where to go next but this now appears around #35 in topcrash reports for firefox 3 beta5

0  	extent_tree_ad_s_RB_REMOVE  	 jemalloc.c:1986
1 	arena_run_dalloc 	jemalloc.c:3237
2 	arena_dalloc 	jemalloc.c:4209
3 	free 	jemalloc.c:6067
4 	js_GC 	mozilla/js/src/jsgc.c:3361
5 	JS_GC 	mozilla/js/src/jsapi.c:2437
6 	nsXPConnect::Collect() 	mozilla/js/src/xpconnect/src/nsXPConnect.cpp:526
7 	nsCycleCollector::Collect(unsigned int) 	mozilla/xpcom/base/nsCycleCollector.cpp:2250
8 	nsJSContext::CC() 	mozilla/dom/src/base/nsJSEnvironment.cpp:3346
9 	xul.dll@0x2c5045 	

not too many comments to go on.  maybe some one will spot something to help understand more of what might be happening.


comments include:
was using gmail & homeseer.com in two tabs

Closing Gmail seems to coincide with 90% of my crashes.

Did it crash? I thought i closed it? Is this a false positive?

Comment 1

[chris hofmann]

http://crash-stats.mozilla.com/report/list?range_unit=weeks&query_search=signature&query_type=contains&version=Firefox%3A3.0b5&signature=extent_tree_ad_s_RB_REMOVE&range_value=1 links to all the reports...

Comment 2

[chris hofmann]

out of the list from comment 1 here is another stack that ends in the same result.

0  	mozcrt19.dll  	extent_tree_ad_s_RB_REMOVE  	 jemalloc.c:1986
1 	mozcrt19.dll 	arena_run_dalloc 	jemalloc.c:3237
2 	mozcrt19.dll 	arena_dalloc 	jemalloc.c:4209
3 	mozcrt19.dll 	free 	jemalloc.c:6067
4 	xul.dll 	nsMemoryImpl::Free 	mozilla/xpcom/base/nsMemoryImpl.cpp:172
5 	xul.dll 	nsSegmentedBuffer::DeleteLastSegment 	mozilla/xpcom/io/nsSegmentedBuffer.cpp:134
6 	xul.dll 	xul.dll@0x241c7d 	
7 	xul.dll 	nsMemoryCacheDevice::OpenOutputStreamForEntry 	mozilla/netwerk/cache/src/nsMemoryCacheDevice.cpp:283
8 	xul.dll 	nsCacheEntryDescriptor::nsOutputStreamWrapper::LazyInit 	mozilla/netwerk/cache/src/nsCacheEntryDescriptor.cpp:588
9 	xul.dll 	nsCacheEntryDescriptor::nsOutputStreamWrapper::Write 	mozilla/netwerk/cache/src/nsCacheEntryDescriptor.cpp:635
10 	xul.dll 	nsInputStreamTee::TeeSegment 	mozilla/xpcom/io/nsInputStreamTee.cpp:80

Comment 3

[Bob Clary [:bc] (inactive)]

This is currently #14 on the FF3rc1 topcrash list.

Comment 4

[chris hofmann]

looks like there might be a wide variety of conditions or areas of code that call free and result in crashes with this stack signature.   we might need to break those down to make progress with this bug.


for example I also see a comment:

   Since Mozilla update, I crash about ever 30 minutes

that has a stack trace like


0  	mozcrt19.dll  	extent_tree_ad_s_RB_REMOVE  	 jemalloc.c:1988
1 	mozcrt19.dll 	arena_run_dalloc 	jemalloc.c:3228
2 	mozcrt19.dll 	arena_dalloc 	jemalloc.c:4200
3 	mozcrt19.dll 	free 	jemalloc.c:6009
4 	xul.dll 	nsTimerImpl::Release 	mozilla/xpcom/threads/nsTimerImpl.cpp:95
5 	xul.dll 	nsCOMPtr_base::assign_with_AddRef 	nsCOMPtr.cpp:89
6 	xul.dll 	nsWindow::DispatchMouseEvent 	mozilla/widget/src/windows/nsWindow.cpp:6127
7 	xul.dll 	ChildWindow::DispatchMouseEvent 	mozilla/widget/src/windows/nsWindow.cpp:6328
8 	xul.dll 	xul.dll@0x2eb7ed 	
9 	xul.dll 	nsWindow::WindowProc 	mozilla/widget/src/windows/nsWindow.cpp:1200
10 	xul.dll 	xul.dll@0x242d01 	
11 	xul.dll 	ChildIterator::get 	mozilla/layout/base/nsChildIterator.h:112
12 	xul.dll 	ChildIterator::get 	mozilla/layout/base/nsChildIterator.h:112
13 		@0x5c0131

Comment 5

[chris hofmann]

this has moved up to #7 topcrash on RC2

Comment 6

[Yehuda]

People are also reporting this crash in various Mozilla forums.
http://support.mozilla.com/tiki-view_forum_thread.php?forumId=1&comments_parentId=79953
and 
http://www.mozilla.org.il/board/viewtopic.php?f=9&t=6447#p30283
(last one is in Hebrew, but contains links to crash reports)

Comment 8

[Jesse Ruderman on Windows]

3.0.31 - extent_tree_ad_s_RB_REMOVE is topcrash #41

3.5.2 - zero crashes at extent_tree_ad_s_RB_REMOVE

--> WFM