462744 - crash in @js_GC @nsXPConnect::Collect

Status: RESOLVED INCOMPLETE

(Core :: XPConnect, defect)

Description

[Alexander Sack]

Reported against ubuntus firefox 3.0:

Maybe related to bug 459581?

https://bugs.launchpad.net/bugs/282292:

#0  0xb7f19430 in __kernel_vsyscall ()
#1  0xb7ed14c0 in raise () from /lib/tls/i686/cmov/libpthread.so.0
#2  0xb70e6ca1 in nsProfileLock::FatalSignalHandler (signo=-1209167884) at nsProfileLock.cpp:212
	unblock_sigs = {__val = {1024, 0 <repeats 31 times>}}
	oldact = <value optimized out>
#3  <signal handler called>
#4  0x00370031 in ?? ()
#5  0xb7bd8fed in js_GC (cx=0xa5b77e0, gckind=GC_NORMAL) at jsgc.c:3320
	rt = (JSRuntime *) 0x9fe18b0
	keepAtoms = 0
	callback = <value optimized out>
	i = 3
	type = 0
	trc = {context = 0xa5b77e0, callback = 0}
	thingSize = 8
	a = (JSGCArenaInfo *) 0xaeb74ff0
	ap = (JSGCArenaInfo **) 0xab033ff4
	emptyArenas = (JSGCArenaInfo *) 0x0
	flags = 32 ' '
	flagp = (uint8 *) 0xaeb74fc7 " "
	thing = (JSGCThing *) 0xa5b77e0
	freeList = (JSGCThing *) 0xaeb74150
	arenaList = (JSGCArenaList *) 0x9fe18bc
	allClear = 0
	requestDebit = 1
	acx = <value optimized out>
	iter = (JSContext *) 0x0
#6  0xb7bb563a in JS_GC (cx=0xa5b77e0) at jsapi.c:2469
No locals.
#7  0xb70ec950 in nsXPConnect::Collect (this=0x9ff96d0) at nsXPConnect.cpp:529
	cycleCollectionContext = {<nsAXPCNativeCallContext> = {_vptr.nsAXPCNativeCallContext = 0xb7a6c8a8}, 
  mState = XPCCallContext::HAVE_CONTEXT, mXPC = 0x9ff96d0, mThreadData = 0x9f9e510, mXPCContext = 0xa5b79a8, 
  mJSContext = 0xa5b77e0, mContextPopRequired = 1, mDestroyJSContextInDestructor = 0, 
  mCallerLanguage = XPCContext::LANG_NATIVE, mPrevCallerLanguage = XPCContext::LANG_UNKNOWN, mPrevCallContext = 0x0, 
  mOperandJSObject = 0xf519f85a, mCurrentJSObject = 0xb7933e9e, mFlattenedJSObject = 0x7a, mWrapper = 0xb7862693, 
  mTearOff = 0x19, mScriptableInfo = 0xb7b21ff4, mSet = 0xbf811a58, mInterface = 0xb786d9a2, mMember = 0x0, 
  mName = 167787204, mStaticMemberIsLocal = -1082058136, mArgc = 3079004096, mArgv = 0x0, mRetVal = 0xb7933e9e, 
  mExceptionWasThrown = -1215182732, mReturnValueWasSet = -1315418288, mMethodIndex = 15044, mCallee = 0x0, 
  mStringWrapperData = "\236>\223·Zø\031õÄ:\000\n\000\000\000\000\210\032\201¿tÜ\206·¸\032\201¿\000\000\000"}
	cx = (JSContext *) 0xa5b77e0
#8  0xb789e8ee in nsCycleCollector::Collect (this=0x9f8a8b8, aTryCollections=1) at nsCycleCollector.cpp:2250
	collected = -1213656760
	obs = {<nsCOMPtr_base> = {mRawPtr = 0xa003ab8}, <No data fields>}
	whiteNodes = {<nsTPtrArray<PtrInfo>> = {<nsTArray<PtrInfo*>> = {<nsTArray_base> = {static sEmptyHdr = {
          mLength = 0, mCapacity = 0, mIsAutoArray = 0}, mHdr = 0xaad87f80}, <No data fields>}, <No data fields>}, 
  mAutoBuf = "\000\000\000\000 \017\000\200x\017\000\000\224\211\000\000\b~\023¬\000\000\000\000À\016©·À\016©·\b~\023¬À\016©·\030\033\201¿»\026'·\b~\023¬Ð\034\201¿x\017\000\000\000\000\000\000Ø\200\023¬\000\000\000\000¸þ¨·¸þ¨·Ø\200\023¬¸þ¨·H\033\201¿»\026'·Ø\200\023¬Ð\034\201¿\000\000\000\000\000\000\000\000$\201\023¬\000\000\000\000Ð\034\201¿Ð\034\201¿$\201\023¬Ð\034\201¿¸\033\201¿ì\233&·$\201\023¬Ð\034\201¿\000\000\000\000\000\000\000\000$\201\023¬\000\000\000\000\f\003\000\000\f\003\000\000ø·ö\tT\034\201¿T\034\201¿ô\037²·T\034\201¿p\036\201¿"...}
	totalCollections = 0
#9  0xb789ea2d in nsCycleCollector_collect () at nsCycleCollector.cpp:2898
No locals.
#10 0xb7499f3a in nsJSContext::CC () at nsJSEnvironment.cpp:3346
No locals.
#11 0xb749a00a in nsJSContext::MaybeCC (aHigherProbability=0) at nsJSEnvironment.cpp:3397
No locals.
#12 0xb749a3bd in nsUserActivityObserver::Observe (this=0xa5b5e40, aSubject=0x0, 
    aTopic=0xb7a05bac "user-interaction-inactive", aData=0x0) at nsJSEnvironment.cpp:291
	higherProbability = 0
#13 0xb786d994 in nsObserverList::NotifyObservers (this=0xa10cd1c, aSubject=0x0, 
    aTopic=0xb7a05bac "user-interaction-inactive", someData=0x0) at nsObserverList.cpp:128
	i = 1
	observers = {<nsCOMArray_base> = {mArray = {mImpl = 0xb1e8ceb0}}, <No data fields>}
#14 0xb786dc62 in nsObserverService::NotifyObservers (this=0xa003ab8, aSubject=0x0, 
    aTopic=0xb7a05bac "user-interaction-inactive", someData=0x0) at nsObserverService.cpp:181
No locals.
#15 0xb73c37de in nsUITimerCallback::Notify (this=0xa881b20, aTimer=0xa79ef98) at nsEventStateManager.cpp:210
	rv = 0
	obs = {<nsCOMPtr_base> = {mRawPtr = 0xa003ab8}, <No data fields>}
#16 0xb7895a36 in nsTimerImpl::Fire (this=0xa79ef98) at nsTimerImpl.cpp:403
	now = 4060259649
	timeout = <value optimized out>
	callback = {c = 0xa881b20, i = 0xa881b20, o = 0xa881b20}
	callbackType = 1
#17 0xb7895aab in nsTimerEvent::Run (this=0xaeb0298) at nsTimerImpl.cpp:490
No locals.
#18 0xb7893560 in nsThread::ProcessNextEvent (this=0x9f64858, mayWait=1, result=0xbf815b34) at nsThread.cpp:510
	notifyGlobalObserver = 1
	obs = {<nsCOMPtr_base> = {mRawPtr = 0xa07261c}, <No data fields>}
	event = {<nsCOMPtr_base> = {mRawPtr = 0xaeb0298}, <No data fields>}
	rv = 0
#19 0xb7863f7c in NS_ProcessNextEvent_P (thread=0xaeb74120, mayWait=1) at nsThreadUtils.cpp:227
	val = <value optimized out>
#20 0xb77e72b8 in nsBaseAppShell::Run (this=0xa072618) at nsBaseAppShell.cpp:170
	thread = (class nsIThread *) 0x9f64858
#21 0xb767cab0 in nsAppStartup::Run (this=0xa109b68) at nsAppStartup.cpp:181
	rv = <value optimized out>
#22 0xb70e1508 in XRE_main (argc=1, argv=0xbf819294, aAppData=0x9f1e830) at nsAppRunner.cpp:3194
	obsService = {<nsCOMPtr_base> = {mRawPtr = 0xa003ab8}, <No data fields>}
	remoteService = {<nsCOMPtr_base> = {mRawPtr = 0xa794690}, <No data fields>}
	appStartup = {<nsCOMPtr_base> = {mRawPtr = 0xa109b68}, <No data fields>}
	workingDir = {<nsCOMPtr_base> = {mRawPtr = 0xa5312e0}, <No data fields>}
	chromeObserver = {<nsCOMPtr_base> = {mRawPtr = 0xa068df8}, <No data fields>}
	cmdLine = {<nsCOMPtr_base> = {mRawPtr = 0xa5312c0}, <No data fields>}
	noEMRestart = <value optimized out>
	xpcom = {mServiceManager = 0x9f6b9dc}
	desktopStartupIDEnv = <value optimized out>
	desktopStartupID = {<nsFixedCString> = {<nsCString> = {<nsACString_internal> = {<nsCSubstring_base> = {<No data fields>}, mData = 0xbf815fa8 "gnome-panel/firefox/6661-0-yofel-laptop_TIME229023", mLength = 50, 
        mFlags = 65553}, <No data fields>}, mFixedCapacity = 63, 
    mFixedBuf = 0xbf815fa8 "gnome-panel/firefox/6661-0-yofel-laptop_TIME229023"}, 
  mStorage = "gnome-panel/firefox/6661-0-yofel-laptop_TIME229023\000¿¬Î\004\bÈ`\201¿\000\000\000"}
	xremotearg = <value optimized out>
	upgraded = 0
	appInitiatedRestart = <value optimized out>
	dirProvider = {<nsIDirectoryServiceProvider2> = {<nsIDirectoryServiceProvider> = {<nsISupports> = {
        _vptr.nsISupports = 0xb7a6c108}, <No data fields>}, <No data fields>}, <nsIProfileStartup> = {<nsISupports> = {
      _vptr.nsISupports = 0xb7a6c12c}, <No data fields>}, mAppProvider = {<nsCOMPtr_base> = {
      mRawPtr = 0x0}, <No data fields>}, mGREDir = {<nsCOMPtr_base> = {mRawPtr = 0x9f1ea50}, <No data fields>}, 
  mSysPluginDir = {<nsCOMPtr_base> = {mRawPtr = 0x0}, <No data fields>}, mXULAppDir = {<nsCOMPtr_base> = {
      mRawPtr = 0x9f1e9b0}, <No data fields>}, mProfileDir = {<nsCOMPtr_base> = {
      mRawPtr = 0x9f64420}, <No data fields>}, mProfileLocalDir = {<nsCOMPtr_base> = {
      mRawPtr = 0x9f646f0}, <No data fields>}, mProfileNotified = 1 '\001', mExtensionsLoaded = 1 '\001', 
  mAppBundleDirectories = {<nsCOMArray_base> = {mArray = {mImpl = 0x0}}, <No data fields>}, 
  mExtensionDirectories = {<nsCOMArray_base> = {mArray = {mImpl = 0x9f9cc98}}, <No data fields>}, 
  mThemeDirectories = {<nsCOMArray_base> = {mArray = {mImpl = 0x9f9b2c8}}, <No data fields>}}
	display = (GdkDisplay *) 0x9f42028
	nativeApp = {<nsCOMPtr_base> = {mRawPtr = 0x9f4a968}, <No data fields>}
	desktopStartupIDPtr = 0xbf815fa8 "gnome-panel/firefox/6661-0-yofel-laptop_TIME229023"
	startOffline = 0
	profLD = {<nsCOMPtr_base> = {mRawPtr = 0x9f646f0}, <No data fields>}
	profD = {<nsCOMPtr_base> = {mRawPtr = 0x9f64420}, <No data fields>}
	needsRestart = 0
	canRun = 1
	profileLock = {<nsCOMPtr_base> = {mRawPtr = 0x9f64498}, <No data fields>}
	profileName = {<nsFixedCString> = {<nsCString> = {<nsACString_internal> = {<nsCSubstring_base> = {<No data fields>}, mData = 0x9f64620 "default", mLength = 7, mFlags = 65541}, <No data fields>}, mFixedCapacity = 63, 
    mFixedBuf = 0xbf815f54 ""}, 
  mStorage = "\000_\201¿eøÊ·@qÙ·t\000\000\000@qÙ·\210_\201¿ôoë·t\000\000\000È`\201¿¨_\201¿}îµ·Xêñ\tô\037²·¨_\201¿\024¬\210·Xêñ\t"}
	version = {<nsFixedCString> = {<nsCString> = {<nsACString_internal> = {<nsCSubstring_base> = {<No data fields>}, mData = 0xbf815f00 "3.0.3_2008092417/2008092515", mLength = 27, mFlags = 65553}, <No data fields>}, 
    mFixedCapacity = 63, mFixedBuf = 0xbf815f00 "3.0.3_2008092417/2008092515"}, 
  mStorage = "3.0.3_2008092417/2008092515\000Hêñ\t°éñ\tä`\201¿\002\000\000\000\000\000\000\000¸éñ\tô\037²·X_\201¿\024¬\210·"}
	osABI = {<nsCString> = {<nsACString_internal> = {<nsCSubstring_base> = {<No data fields>}, 
      mData = 0xb791c2ce "Linux_x86-gcc3", mLength = 14, mFlags = 1}, <No data fields>}, <No data fields>}
	versionOK = <value optimized out>
	rv = 0
	ar = <value optimized out>
	gtkModules = <value optimized out>
	override = 0x0
	appData = {<nsXREAppData> = {size = 56, directory = 0x9f1e9b0, vendor = 0x9f1f2f0 "Mozilla", 
    name = 0x9f1f2d0 "Firefox", version = 0x9f1f2e0 "3.0.3", buildID = 0x9f0fc10 "2008092417", 
    ID = 0x9f1eaf0 "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}", 
    copyright = 0x9f1eb20 "Copyright (c) 1998 - 2008 mozilla.org", flags = 6, xreDirectory = 0x9f1ea50, 
    minVersion = 0x9f0fc20 "1.9.0.1", maxVersion = 0x9f0fc30 "1.9.0.*", 
    crashReporterURL = 0x9f1eb50 "https://crash-reports.mozilla.com/submit", profile = 0x0}, <No data fields>}
	iniFile = {<nsCOMPtr_base> = {mRawPtr = 0x9f1eb80}, <No data fields>}
	localIniFile = {<nsCOMPtr_base> = {mRawPtr = 0x9f1eb80}, <No data fields>}
	parser = {
  mSections = {<nsBaseHashtable<nsDepCharHashKey, nsAutoPtr<nsINIParser_internal::INIValue>, nsINIParser_internal::INIValue*>> = {<nsTHashtable<nsBaseHashtableET<nsDepCharHashKey, nsAutoPtr<nsINIParser_internal::INIValue> > >> = {mTable = {
          ops = 0xb7b385c0, data = 0x0, hashShift = 28, maxAlphaFrac = 192 'À', minAlphaFrac = 64 '@', entrySize = 12, 
          entryCount = 1, removedCount = 0, generation = 0, 
          entryStore = 0x9f1ed60 ""}}, <No data fields>}, <No data fields>}, mFileContents = {
    mRawPtr = 0x9f1ee28 "[Build"}}
	i = <value optimized out>
#23 0x080491ab in ?? ()
#24 0xb7c52685 in __libc_start_main () from /lib/tls/i686/cmov/libc.so.6
#25 0x08048d11 in ?? ()

Comment 1

[Jesse Ruderman]

We've fixed lots of GC and cycle collection issues since Firefox 3, so I don't think it's worth it to try to squeeze information out of this stack trace.