Firefox crashes on [@ array_trace]

RESOLVED DUPLICATE of bug 427718

Status

()

--
critical
RESOLVED DUPLICATE of bug 427718
11 years ago
8 years ago

People

(Reporter: amargos, Unassigned)

Tracking

({crash, stackwanted})

Trunk
x86
Windows XP
crash, stackwanted
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

11 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a1pre) Gecko/2008070703 Minefield/3.1a1pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a1pre) Gecko/2008070703 Minefield/3.1a1pre

FF crashes while using webmail service http://poczta.onet.pl  

Reproducible: Always

Steps to Reproduce:
1.Go to http://poczta.onet.pl/login.html
2.Log into service. 
Email: ff3fup@poczta.onet.pl 
OnetHasło: poczta1
3.Change page to http://poczta.onet.pl/folder_d.html
4.Mark any message using checkbox
5.Delete message using [Usuń] 
6.Mark another message
7. Click [Przenieś]
8. Choose "SPAM"
9. OK
At step 6,9 or after going to error console and copying error message FF crashes with error:
AppName: firefox.exe	 AppVer: 1.9.1.3110	 ModName: js3250.dll
ModVer: 4.0.0.0	 Offset: 0003974c
Crash report is sent but I cannot find it on about:crashes


  



We had to force our users to use static version of webmail service instead of dynamic one. Problem has appeared in version 3.0 and is still present.
I can not reproduce the crash with FF3.0 on Vista.

Reporter:
Please do this :
Try to reproduce this crash in the Firefox safemode.
- http://kb.mozillazine.org/Safe_mode

If you still crash disable the flash plugin because it breaks the crash reporter.
Use Tools/Addons/Plugins for that.
If the crash reporter still fails then try this instructions to get a stack trace :
- http://developer.mozilla.org/en/docs/How_to_get_a_stacktrace_with_WinDbg
(Reporter)

Comment 2

11 years ago
Please pay attantion to step 3. 
Crash happens often when I switch to Error Console and try to copy error info.
I attach stacktrace generated from WindBbg.


(Reporter)

Comment 3

11 years ago
Created attachment 328476 [details]
Stacktrace

Comment 4

11 years ago
thanks, that was almost correct, except you didn't issue a command to get a stack trace, such as:

!analyze -v -f
Assignee: nobody → general
Component: General → JavaScript Engine
Keywords: crash, stackwanted
Product: Firefox → Core
QA Contact: general → general
Summary: Firefox crashes on js3250.dll → Firefox crashes on [@ array_trace]
Version: unspecified → Trunk
(Reporter)

Comment 5

11 years ago
Here it is: ( from first exception)

FAULTING_IP: 
js3250!js_GetGCThingTraceKind+a
0045eb2a 8b41f1          mov     eax,dword ptr [ecx-0Fh]

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0045eb2a (js3250!js_GetGCThingTraceKind+0x0000000a)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000ff0
Attempt to read from address 00000ff0

FAULTING_THREAD:  00000250

DEFAULT_BUCKET_ID:  WRONG_SYMBOLS

PROCESS_NAME:  firefox.exe

MODULE_NAME: js3250

FAULTING_MODULE: 7c900000 ntdll

DEBUG_FLR_IMAGE_TIMESTAMP:  4871ee4c

ERROR_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod "0x%08lx" odwo

READ_ADDRESS:  00000ff0 

PRIMARY_PROBLEM_CLASS:  WRONG_SYMBOLS

BUGCHECK_STR:  APPLICATION_FAULT_WRONG_SYMBOLS

LAST_CONTROL_TRANSFER:  from 10059d18 to 0045eb2a

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
0012baec 10059d18 00000070 0088a06c 0012bbbc js3250!js_GetGCThingTraceKind+0xa
0012bb54 10144f73 0087a000 00895950 00000002 xul!NS_CycleCollectorSuspect_P+0xafd8
0012bbbc 100cf882 00895950 00000000 0012bc88 xul!gfxWindowsFontGroup::MakeTextRun+0x4118
0012bbd0 00451185 00895950 00000002 00895950 xul!NS_InitXPCOM3_P+0x8e8
0012bbf4 10079f4e 0381c000 00000001 00000000 js3250!JS_strtod+0x1365
0012bc04 1007c422 0342dba0 00000000 1007c27c xul!NS_CycleCollectorSuspect_P+0x2b20e
00000000 00000000 00000000 00000000 00000000 xul!NS_CycleCollectorForget_P+0x1122


FOLLOWUP_IP: 
js3250!js_GetGCThingTraceKind+a
0045eb2a 8b41f1          mov     eax,dword ptr [ecx-0Fh]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  js3250!js_GetGCThingTraceKind+a

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  js3250.dll

STACK_COMMAND:  ~0s ; kb

BUCKET_ID:  WRONG_SYMBOLS

FAILURE_BUCKET_ID:  WRONG_SYMBOLS_c0000005_js3250.dll!base_address

Followup: MachineOwner
---------
Status: UNCONFIRMED → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 427718
Crash Signature: [@ array_trace]
You need to log in before you can comment on or make changes to this bug.