If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Crash when switching to another application [@ _destroyJSDObject ][@ jsd_ObjectHook]

RESOLVED FIXED

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
9 years ago
2 years ago

People

(Reporter: whimboo, Unassigned)

Tracking

({crash})

1.9.1 Branch
x86
All
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

(Reporter)

Description

9 years ago
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b3pre) Gecko/20090215 Shiretoko/3.1b3pre Ubiquity/0.1.5 ID:20090215020429

The crash occured when I switched from Firefox to another application while the tab with Gmail was opened. Until now I'm not able to reproduce this crash. Venkman is installed but was never used in this session.

Crash report: bp-15d49b7d-8864-4597-930a-08a152090215

0  	XUL  	_destroyJSDObject  	js/jsd/jsd_obj.c:101
1 	XUL 	jsd_ObjectHook 	js/jsd/jsd_obj.c:180
2 	libmozjs.dylib 	js_FinalizeObject 	js/src/jsobj.cpp:3107
3 	libmozjs.dylib 	js_GC 	js/src/jsgc.cpp:3587
4 	libmozjs.dylib 	JS_GC 	js/src/jsapi.cpp:2487
5 	XUL 	nsXPConnect::Collect 	js/src/xpconnect/src/nsXPConnect.cpp:477
6 	XUL 	nsCycleCollector::Collect 	xpcom/base/nsCycleCollector.cpp:2256
7 	XUL 	nsCycleCollector_collect 	xpcom/base/nsCycleCollector.cpp:2904
8 	XUL 	nsJSContext::CC 	dom/src/base/nsJSEnvironment.cpp:3419
9 	XUL 	nsJSContext::MaybeCC 	dom/src/base/nsJSEnvironment.cpp:3471
10 	XUL 	nsJSContext::CCIfUserInactive 	dom/src/base/nsJSEnvironment.cpp:3488
11 	XUL 	nsJSContext::Notify 	dom/src/base/nsJSEnvironment.cpp:3512
12 	XUL 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:423
13 	XUL 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:512
14 	XUL 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:510
15 	XUL 	NS_ProcessPendingEvents_P 	nsThreadUtils.cpp:180
16 	XUL 	nsBaseAppShell::NativeEventCallback 	widget/src/xpwidgets/nsBaseAppShell.cpp:121
17 	XUL 	nsAppShell::ProcessGeckoEvents 	widget/src/cocoa/nsAppShell.mm:374 

Ted, I wonder why this crash report was sent twice:
http://crash-stats.mozilla.com/report/list?product=Firefox&branch=1.9.1&version=Firefox%3A3.1b3pre&query_search=signature&query_type=exact&query=_destroyJSDObject&date=&range_value=1&range_unit=weeks&do_query=1&signature=_destroyJSDObject
It wasn't, you'll note that both results in that search have the same Crash ID. Austin: looks like a bug in the search? (We should probably file a separate bug in Webtools : Socorro about that.)
(Reporter)

Comment 2

9 years ago
Done that's bug 478772 now.

Updated

8 years ago
Assignee: general → nobody
Component: JavaScript Engine → JavaScript Debugging APIs
QA Contact: general → jsd

Comment 3

8 years ago
so, afaict MOZILLA_CLIENT is defined which means JSD_THREADSAFE is defined.

_destroyJSDObject and friends seem to be cautious about always doing work under JSD_LOCK_OBJECTS

UUID	f365d992-e526-4c7f-b060-9958c2090818
Frame 	Module 	Signature [Expand] 	Source
0 	XUL 	_destroyJSDObject 	mozilla/js/jsd/jsd_obj.c:101
1 	XUL 	jsd_DestroyObjectManager 	mozilla/js/jsd/jsd_obj.c:244
2 	XUL 	jsd_DebuggerOff 	mozilla/js/jsd/jsd_high.c:177
3 	XUL 	jsdService::Off 	mozilla/js/jsd/jsd_xpc.cpp:2594
4 	XUL 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
5 	XUL 	XPCWrappedNative::CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2393
6 	XUL 	XPC_WN_CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1583

There are also crashes on windows (although the stacks in js suffer from either lack of symbols or an optimizer).

Of the current crashes 2/15 are in jsd_DestroyObjectManager, the others are js_FinalizeObject (and one isn't reporting), and there's one windows 1.9.1 crash which is missing (total = 17).
OS: Mac OS X → All
(Assignee)

Updated

6 years ago
Crash Signature: [@ _destroyJSDObject ] [@ jsd_ObjectHook]
(Assignee)

Updated

6 years ago
Component: JavaScript Debugging/Profiling APIs → JavaScript Engine
Product: Core → Core
We've since moved from JSD1 to the Debugger API.
Status: NEW → RESOLVED
Crash Signature: [@ _destroyJSDObject ] [@ jsd_ObjectHook] → [@ _destroyJSDObject ] [@ jsd_ObjectHook]
Last Resolved: 2 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.