crash [@extent_tree_ad_s_RB_REMOVE jemalloc.c:1986] closing gmail...

RESOLVED WORKSFORME

Status

()

Core
Memory Allocator
--
critical
RESOLVED WORKSFORME
10 years ago
7 years ago

People

(Reporter: chris hofmann, Unassigned)

Tracking

({crash, topcrash})

Trunk
x86
Windows XP
crash, topcrash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

(Reporter)

Description

10 years ago
not sure which component to assign or where to go next but this now appears around #35 in topcrash reports for firefox 3 beta5

0  	extent_tree_ad_s_RB_REMOVE  	 jemalloc.c:1986
1 	arena_run_dalloc 	jemalloc.c:3237
2 	arena_dalloc 	jemalloc.c:4209
3 	free 	jemalloc.c:6067
4 	js_GC 	mozilla/js/src/jsgc.c:3361
5 	JS_GC 	mozilla/js/src/jsapi.c:2437
6 	nsXPConnect::Collect() 	mozilla/js/src/xpconnect/src/nsXPConnect.cpp:526
7 	nsCycleCollector::Collect(unsigned int) 	mozilla/xpcom/base/nsCycleCollector.cpp:2250
8 	nsJSContext::CC() 	mozilla/dom/src/base/nsJSEnvironment.cpp:3346
9 	xul.dll@0x2c5045 	

not too many comments to go on.  maybe some one will spot something to help understand more of what might be happening.


comments include:
was using gmail & homeseer.com in two tabs

Closing Gmail seems to coincide with 90% of my crashes.

Did it crash? I thought i closed it? Is this a false positive?
(Reporter)

Comment 2

10 years ago
out of the list from comment 1 here is another stack that ends in the same result.

0  	mozcrt19.dll  	extent_tree_ad_s_RB_REMOVE  	 jemalloc.c:1986
1 	mozcrt19.dll 	arena_run_dalloc 	jemalloc.c:3237
2 	mozcrt19.dll 	arena_dalloc 	jemalloc.c:4209
3 	mozcrt19.dll 	free 	jemalloc.c:6067
4 	xul.dll 	nsMemoryImpl::Free 	mozilla/xpcom/base/nsMemoryImpl.cpp:172
5 	xul.dll 	nsSegmentedBuffer::DeleteLastSegment 	mozilla/xpcom/io/nsSegmentedBuffer.cpp:134
6 	xul.dll 	xul.dll@0x241c7d 	
7 	xul.dll 	nsMemoryCacheDevice::OpenOutputStreamForEntry 	mozilla/netwerk/cache/src/nsMemoryCacheDevice.cpp:283
8 	xul.dll 	nsCacheEntryDescriptor::nsOutputStreamWrapper::LazyInit 	mozilla/netwerk/cache/src/nsCacheEntryDescriptor.cpp:588
9 	xul.dll 	nsCacheEntryDescriptor::nsOutputStreamWrapper::Write 	mozilla/netwerk/cache/src/nsCacheEntryDescriptor.cpp:635
10 	xul.dll 	nsInputStreamTee::TeeSegment 	mozilla/xpcom/io/nsInputStreamTee.cpp:80

Comment 3

10 years ago
This is currently #14 on the FF3rc1 topcrash list.
Assignee: general → nobody
Component: JavaScript Engine → jemalloc
QA Contact: general → jemalloc
(Reporter)

Comment 4

10 years ago
looks like there might be a wide variety of conditions or areas of code that call free and result in crashes with this stack signature.   we might need to break those down to make progress with this bug.


for example I also see a comment:

   Since Mozilla update, I crash about ever 30 minutes

that has a stack trace like


0  	mozcrt19.dll  	extent_tree_ad_s_RB_REMOVE  	 jemalloc.c:1988
1 	mozcrt19.dll 	arena_run_dalloc 	jemalloc.c:3228
2 	mozcrt19.dll 	arena_dalloc 	jemalloc.c:4200
3 	mozcrt19.dll 	free 	jemalloc.c:6009
4 	xul.dll 	nsTimerImpl::Release 	mozilla/xpcom/threads/nsTimerImpl.cpp:95
5 	xul.dll 	nsCOMPtr_base::assign_with_AddRef 	nsCOMPtr.cpp:89
6 	xul.dll 	nsWindow::DispatchMouseEvent 	mozilla/widget/src/windows/nsWindow.cpp:6127
7 	xul.dll 	ChildWindow::DispatchMouseEvent 	mozilla/widget/src/windows/nsWindow.cpp:6328
8 	xul.dll 	xul.dll@0x2eb7ed 	
9 	xul.dll 	nsWindow::WindowProc 	mozilla/widget/src/windows/nsWindow.cpp:1200
10 	xul.dll 	xul.dll@0x242d01 	
11 	xul.dll 	ChildIterator::get 	mozilla/layout/base/nsChildIterator.h:112
12 	xul.dll 	ChildIterator::get 	mozilla/layout/base/nsChildIterator.h:112
13 		@0x5c0131
Severity: normal → critical
Keywords: crash
(Reporter)

Comment 5

10 years ago
this has moved up to #7 topcrash on RC2

Comment 6

10 years ago
People are also reporting this crash in various Mozilla forums.
http://support.mozilla.com/tiki-view_forum_thread.php?forumId=1&comments_parentId=79953
and 
http://www.mozilla.org.il/board/viewtopic.php?f=9&t=6447#p30283
(last one is in Hebrew, but contains links to crash reports)

Updated

10 years ago
Duplicate of this bug: 442417
3.0.31 - extent_tree_ad_s_RB_REMOVE is topcrash #41

3.5.2 - zero crashes at extent_tree_ad_s_RB_REMOVE

--> WFM
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → WORKSFORME
(Assignee)

Updated

7 years ago
Crash Signature: [@extent_tree_ad_s_RB_REMOVE jemalloc.c:1986]
You need to log in before you can comment on or make changes to this bug.