462773 - top crash [@ JS_TraceChildren]

Status: RESOLVED DUPLICATE of bug 462778

(Core :: JavaScript Engine, defect)

Description

[Samuel Sidler (old account; do not CC)]

I still need to investigate this further, but I wanted to get a bug on file...

The number 7 topcrash (high on both Windows and Mac) in Firefox 3.1b1 happens with the following stack:

From bp-220b1161-a913-11dd-b0b1-001a4bd43ef6:

Frame  	Module  	Signature [Expand]  	Source
0 	js3250.dll 	JS_TraceChildren 	js/src/jsgc.cpp:2365
1 	js3250.dll 	JS_CallTracer 	js/src/jsgc.cpp:2642
2 	js3250.dll 	gc_root_traversal 	js/src/jsgc.cpp:2746
3 	js3250.dll 	JS_DHashTableEnumerate 	js/src/jsdhash.cpp:724
4 	js3250.dll 	js_TraceRuntime 	js/src/jsgc.cpp:3015
5 	js3250.dll 	js_GC 	js/src/jsgc.cpp:3415
6 	js3250.dll 	js3250.dll@0x71f8b 	
7 	js3250.dll 	js_NewObjectWithGivenProto 	js/src/jsobj.cpp:2556
8 	js3250.dll 	js3250.dll@0xbe367

Sometimes, however, there's a larger stack (from bp-b94b8391-a85a-11dd-8a25-001a4bd43ed6):

Frame  	Module  	Signature [Expand]  	Source
0 	libmozjs.dylib 	JS_TraceChildren 	js/src/jsgc.cpp:2365
1 	libmozjs.dylib 	JS_CallTracer 	js/src/jsgc.cpp:2642
2 	libmozjs.dylib 	js_CallValueTracerIfGCThing 	js/src/jsgc.cpp:2690
3 	libmozjs.dylib 	gc_root_traversal 	js/src/jsgc.cpp:2746
4 	libmozjs.dylib 	JS_DHashTableEnumerate 	js/src/jsdhash.cpp:724
5 	libmozjs.dylib 	js_TraceRuntime 	js/src/jsgc.cpp:3015
6 	libmozjs.dylib 	js_GC 	js/src/jsgc.cpp:3415
7 	libmozjs.dylib 	js_NewGCThing 	js/src/jsgc.cpp:1842
8 	libmozjs.dylib 	js_NewObjectWithGivenProto 	js/src/jsobj.cpp:2556
9 	libmozjs.dylib 	js_NewObject 	js/src/jsobj.cpp:2522
10 	libmozjs.dylib 	JS_NewObject 	js/src/jsapi.cpp:3017
11 	libmozjs.dylib 	js_ConsumeJSONText 	js/src/json.cpp:531
12 	libmozjs.dylib 	js_json_parse 	js/src/json.cpp:81
13 	libmozjs.dylib 	js_Interpret 	js/src/jsinterp.cpp:4985
14 	libmozjs.dylib 	js_Invoke 	js/src/jsinvoke.cpp:1324
15 	libmozjs.dylib 	js_fun_apply 	js/src/jsfun.cpp:1731
16 	libmozjs.dylib 	js_Interpret 	js/src/jsinterp.cpp:4985
17 	libmozjs.dylib 	js_Invoke 	js/src/jsinvoke.cpp:1324
18 	libmozjs.dylib 	js_InternalInvoke 	js/src/jsinvoke.cpp:1381
19 	libmozjs.dylib 	JS_CallFunctionValue 	js/src/jsapi.cpp:5136
20 	XUL 	nsJSContext::CallEventHandler 	dom/src/base/nsJSEnvironment.cpp:2000
21 	XUL 	nsGlobalWindow::RunTimeout 	dom/src/base/nsGlobalWindow.cpp:7721
22 	XUL 	nsGlobalWindow::TimerCallback 	dom/src/base/nsGlobalWindow.cpp:8053
23 	XUL 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:420
24 	XUL 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:512
25 	XUL 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:510
26 	XUL 	NS_ProcessPendingEvents_P 	nsThreadUtils.cpp:180
27 	XUL 	nsBaseAppShell::NativeEventCallback 	widget/src/xpwidgets/nsBaseAppShell.cpp:121
28 	XUL 	nsAppShell::ProcessGeckoEvents 	widget/src/cocoa/nsAppShell.mm:302
29 	CoreFoundation 	CoreFoundation@0x72614 	
30 	CoreFoundation 	CoreFoundation@0x72cf7 	
31 	HIToolbox 	HIToolbox@0x2f47f 	
32 	HIToolbox 	HIToolbox@0x2f298 	
33 	HIToolbox 	HIToolbox@0x2f10c 	
34 	AppKit 	AppKit@0x403ec 	
35 	AppKit 	AppKit@0x3fc9f 	
36 	AppKit 	AppKit@0x38cda 	
37 	XUL 	nsAppShell::Run 	widget/src/cocoa/nsAppShell.mm:591
38 	XUL 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:182
39 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3265
40 	firefox-bin 	main 	browser/app/nsBrowserApp.cpp:156
41 	firefox-bin 	_start 	
42 	firefox-bin 	start 	
43 		@0x1 

There's only one comment in the stacks for beta 1:

  Attempting to organize bookmarks ... moving a folder (embedded) to a
  higher level.

That's from bp-02e4c85e-a44b-11dd-b676-001a4bd43ef6 in case you're wondering.

In the last two weeks of reports for Firefox 3.1b2pre, there are only 8 stacks available and it ranks number 76. Possibly due to nightly usage vs beta usage, or because it's been fixed, or because of extension usage in betas, or or or... I need to look a bit deeper, but if anyone has any ideas, let me know...