478706 - Crash when switching to another application [@ _destroyJSDObject ][@ jsd_ObjectHook]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b3pre) Gecko/20090215 Shiretoko/3.1b3pre Ubiquity/0.1.5 ID:20090215020429

The crash occured when I switched from Firefox to another application while the tab with Gmail was opened. Until now I'm not able to reproduce this crash. Venkman is installed but was never used in this session.

Crash report: bp-15d49b7d-8864-4597-930a-08a152090215

0  	XUL  	_destroyJSDObject  	js/jsd/jsd_obj.c:101
1 	XUL 	jsd_ObjectHook 	js/jsd/jsd_obj.c:180
2 	libmozjs.dylib 	js_FinalizeObject 	js/src/jsobj.cpp:3107
3 	libmozjs.dylib 	js_GC 	js/src/jsgc.cpp:3587
4 	libmozjs.dylib 	JS_GC 	js/src/jsapi.cpp:2487
5 	XUL 	nsXPConnect::Collect 	js/src/xpconnect/src/nsXPConnect.cpp:477
6 	XUL 	nsCycleCollector::Collect 	xpcom/base/nsCycleCollector.cpp:2256
7 	XUL 	nsCycleCollector_collect 	xpcom/base/nsCycleCollector.cpp:2904
8 	XUL 	nsJSContext::CC 	dom/src/base/nsJSEnvironment.cpp:3419
9 	XUL 	nsJSContext::MaybeCC 	dom/src/base/nsJSEnvironment.cpp:3471
10 	XUL 	nsJSContext::CCIfUserInactive 	dom/src/base/nsJSEnvironment.cpp:3488
11 	XUL 	nsJSContext::Notify 	dom/src/base/nsJSEnvironment.cpp:3512
12 	XUL 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:423
13 	XUL 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:512
14 	XUL 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:510
15 	XUL 	NS_ProcessPendingEvents_P 	nsThreadUtils.cpp:180
16 	XUL 	nsBaseAppShell::NativeEventCallback 	widget/src/xpwidgets/nsBaseAppShell.cpp:121
17 	XUL 	nsAppShell::ProcessGeckoEvents 	widget/src/cocoa/nsAppShell.mm:374 

Ted, I wonder why this crash report was sent twice:
http://crash-stats.mozilla.com/report/list?product=Firefox&branch=1.9.1&version=Firefox%3A3.1b3pre&query_search=signature&query_type=exact&query=_destroyJSDObject&date=&range_value=1&range_unit=weeks&do_query=1&signature=_destroyJSDObject

Comment 1

[(not currently active) Ted Mielczarek]

It wasn't, you'll note that both results in that search have the same Crash ID. Austin: looks like a bug in the search? (We should probably file a separate bug in Webtools : Socorro about that.)

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Done that's bug 478772 now.

Comment 3

[timeless]

so, afaict MOZILLA_CLIENT is defined which means JSD_THREADSAFE is defined.

_destroyJSDObject and friends seem to be cautious about always doing work under JSD_LOCK_OBJECTS

UUID	f365d992-e526-4c7f-b060-9958c2090818
Frame 	Module 	Signature [Expand] 	Source
0 	XUL 	_destroyJSDObject 	mozilla/js/jsd/jsd_obj.c:101
1 	XUL 	jsd_DestroyObjectManager 	mozilla/js/jsd/jsd_obj.c:244
2 	XUL 	jsd_DebuggerOff 	mozilla/js/jsd/jsd_high.c:177
3 	XUL 	jsdService::Off 	mozilla/js/jsd/jsd_xpc.cpp:2594
4 	XUL 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
5 	XUL 	XPCWrappedNative::CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2393
6 	XUL 	XPC_WN_CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1583

There are also crashes on windows (although the stacks in js suffer from either lack of symbols or an optimizer).

Of the current crashes 2/15 are in jsd_DestroyObjectManager, the others are js_FinalizeObject (and one isn't reporting), and there's one windows 1.9.1 crash which is missing (total = 17).

Comment 4

[Terrence Cole [:terrence]]

We've since moved from JSD1 to the Debugger API.