490164 - Crash [@ NoteJSChild]

Status: RESOLVED WORKSFORME

(Core :: XPConnect, defect)

Description

[Cees T.]

User-Agent:       Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Build Identifier: 3.1b3

STACK_TEXT:  
0012babc 0030b3d3 0012bb30 19d1e150 007194f4 xul!NoteJSChild+0x91 [e:\builds\moz2_slave\win32_build\build\js\src\xpconnect\src\nsxpconnect.cpp @ 693]
0012baf0 0030b167 0012bb30 1e650a40 0012bb94 js3250!js_TraceObject+0x253 [e:\builds\moz2_slave\win32_build\build\js\src\jsobj.cpp @ 5496]
0012bb00 1007d8a1 0012bb30 1e650a40 00000000 js3250!JS_TraceChildren+0x37 [e:\builds\moz2_slave\win32_build\build\js\src\jsgc.cpp @ 2428]
0012bb38 1007d0df 007194f4 00000000 0012bb94 xul!nsXPConnect::Traverse+0xf1 [e:\builds\moz2_slave\win32_build\build\js\src\xpconnect\src\nsxpconnect.cpp @ 924]
0012bb7c 1014e5c8 0078e000 00000000 01d95000 xul!nsCycleCollector::MarkRoots+0x5f [e:\builds\moz2_slave\win32_build\build\xpcom\base\nscyclecollector.cpp @ 1519]
0012bbe8 1015f55a 0078e000 00000000 00820000 xul!nsCycleCollector::BeginCollection+0x87 [e:\builds\moz2_slave\win32_build\build\xpcom\base\nscyclecollector.cpp @ 2385]
0012bbf8 003099dd 01d95000 00000002 01d95000 xul!XPCCycleCollectGCCallback+0x3b [e:\builds\moz2_slave\win32_build\build\js\src\xpconnect\src\nsxpconnect.cpp @ 391]
0012bca0 0033c51c 01d95000 00000000 00000000 js3250!js_GC+0x33d [e:\builds\moz2_slave\win32_build\build\js\src\jsgc.cpp @ 3534]
0012bcb4 1016a004 01d95000 01d95000 1015f51f js3250!JS_GC+0x4c [e:\builds\moz2_slave\win32_build\build\js\src\jsapi.cpp @ 2499]
0012bd70 10167f72 1019765a 00000001 00000002 xul!nsXPConnect::Collect+0x7b [e:\builds\moz2_slave\win32_build\build\js\src\xpconnect\src\nsxpconnect.cpp @ 479]
0012fc20 101c211b 0078e000 00000001 101c20e5 xul!nsCycleCollector::Collect+0x94 [e:\builds\moz2_slave\win32_build\build\xpcom\base\nscyclecollector.cpp @ 2256]
0012fc2c 101c20e5 10319f84 1031a053 00000001 xul!nsCycleCollector_collect+0x11 [e:\builds\moz2_slave\win32_build\build\xpcom\base\nscyclecollector.cpp @ 2905]
0012fc30 10319f84 1031a053 00000001 1019769c xul!nsJSContext::CC+0x2a [e:\builds\moz2_slave\win32_build\build\dom\src\base\nsjsenvironment.cpp @ 3422]
0012fc64 100aa74f 1cafd490 01b2da40 0071b4c0 xul!nsJSContext::MaybeCC+0x313706
0012fc88 100b70ba 00000001 00000001 0012fca8 xul!nsThread::ProcessNextEvent+0x21f [e:\builds\moz2_slave\win32_build\build\xpcom\threads\nsthread.cpp @ 511]
0012fca0 101b6422 00000001 00000000 100f4569 xul!nsBaseAppShell::Run+0x4a [e:\builds\moz2_slave\win32_build\build\widget\src\xpwidgets\nsbaseappshell.cpp @ 169]
0012fcac 100f4569 01b4d3d0 007164a0 00000000 xul!nsAppStartup::Run+0x1e [e:\builds\moz2_slave\win32_build\build\toolkit\components\startup\src\nsappstartup.cpp @ 193]
0012fcb4 007164a0 00000000 00716460 0071f1c0 xul!XRE_main+0xde5 [e:\builds\moz2_slave\win32_build\build\toolkit\xre\nsapprunner.cpp @ 3283]
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012fcb8 00000000 00716460 0071f1c0 0071f1c0 0x7164a0

Reproducible: Didn't try

Comment 1

[Cees T.]

Attachment: WinDbg log

I don't think this adds anything, but if it does, here it is.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b3) Gecko/20090305
Firefox/3.1b3

Comment 2

[Marcia Knous [:marcia]]

Cees: What are the steps to reproduce this bug?  Were you visiting a certain website when it happened? Thanks.

Comment 3

[Cees T.]

56 tabs in 7 windows. *restores* I didn't do anything special; maybe went back and forward a few times between http://www.last.fm/user/TheFalseProphet and http://atschool.eduweb.co.uk/sbs777/prophecy/falsepro.html and rightclicked on the first.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Topcrash at #79 with "Results within 1 weeks of now, and the product is one of Firefox, and the version is one of Firefox:3.5". Mostly on Win / Fx 3.5.

http://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A3.5&query_search=signature&query_type=exact&query=&date=&range_value=1&range_unit=weeks&do_query=1&signature=NoteJSChild

Comment 5

[Daniel Veditz [:dveditz]]

This does not appear to be the result of malware, but is maybe associated with Flash looking at the CrashKill data (though not 100% flash).

Since it's in GC I suppose it could be exploitable and that's presumably why sayre made it a security bug.

Comment 6

[(not currently active) Ted Mielczarek]

Tanner has been able to reproduce this (although perhaps not reliably), see bug 532456, where we were trying to determine why he gets zero-byte minidump files from a crash.

Comment 7

[Brandon Sterne (:bsterne)]

We need help reproducing the crash or we won't be able to do much with the report.  Tanner, short of the crash report, can you provide more details as to how you're reproducing this?

Comment 8

[Brandon Sterne (:bsterne)]

This is still overall topcrash #47, BTW.

Comment 9

[chris hofmann]

for some reason the affects of this crash seem reduced in 3.6


Correlation to releases

checking --- 20100214-crashdata.csv NoteJSChild
release total-crashes
              NoteJSChild crashes
                         pct.
all     238725  436     0.00182637
3.0.15  1054    1       0.000948767
3.0.16  436     2       0.00458716
3.5.5   2986    3       0.00100469
3.5.6   1857    9       0.00484653
3.5.7   111939  280     0.00250136
3.6     76969   63      0.000818511

some recent user comments 
  "I get ""Not Responding"" over and over, and crash about once per 50 to 70 page openings."
   I was trying to close some of the windows that I opened and it froze for like 10 mins. I tried using the alt + del method and nothing happened. After another 5 mins, it shut down itself.

lots of tabs open running facebook and youtube might be the way to set up conditions for this crash

domains of sites
  53 http://www.facebook.com
  53 \N//
  44 http://apps.facebook.com
  18 http://www.youtube.com
  16 http://www.orkut.com.br

Comment 10

[Johnny Stenback (:jst)]

Peter says this could be related to the other bugs we've had related to Relevant Knowledge and their misbehaving extensions. But given the fact that there's no known way to reproduce I don't know how likely it is that we can do much about this in our code.

Comment 11

[Tanner M. Young [:tmyoung]]

(In reply to comment #7)
> We need help reproducing the crash or we won't be able to do much with the
> report.  Tanner, short of the crash report, can you provide more details as to
> how you're reproducing this?

Strange, I haven't gotten any of the bugmail for this bug, which would explain my prolonged silence. :(

The code that causes this is behind a firewall, and it's something of a risky setup to begin with: I run testswarm as a container for an iframe with selenium test cases running in it, which in turn contains an iframe with the web page being tested with its own js.  If this runs for a long time, then I have this crash.  It does this only on the 3.7 branch, but beyond that I can't really begin to isolate at what level the problem is occurring since there are three js-heavy projects nested in each other and communicating with each other.  I could try and find the regression window, but since it can appear on 3.6 and other possibly other branches, that may not do a lot of good, and my time is limited as it is.

Also, I am seeing a different signature of late in the same scenario: ZwTerminateProcess.  I don't know if they are actually related but they occur in related circumstances.  Strangely NoteJsChild doesn't return a successful crash report to crash-stats.m.o, but ZwTerminateProcess doesn't even open the crash reporter dialog--if that is of any significance.

Comment 12

[Damon Sicore (:damons)]

Peter, can you make a call as to if this is really an sg:crit?

Comment 13

[Marcia Knous [:marcia]]

Tanner: Is there someone in the Web QA team that knows Selenium that can help us reproduce the bug? Perhaps you could work with them to talk them through it?

Comment 14

[Tanner M. Young [:tmyoung]]

(In reply to comment #13)
> Tanner: Is there someone in the Web QA team that knows Selenium that can help
> us reproduce the bug? Perhaps you could work with them to talk them through it?

What I have been meaning to do, now that I have WinDbg with symbols, is to get a full trace of the problem and much better idea of what is causing it for my use case.  I have just started the page running, but it could be a day or two before I get anything useful.  I would gladly ask WebQA for help--since they all know Selenium, but it doesn't occur with Selenium that I've seen; it happens with a Selenium server and code running inside Testswarm server with code, which would take a long time for them to set up.

If I don't get any useful results, I can open a port on my Firewall for others to test this on my server, but I would like to not have that overhead if at all possible.

With WinDbg, I have the advantage of having the crash tracked while I am away...

Comment 15

[Marcia Knous [:marcia]]

Tanner: Thanks for the update. If would be great if you could update us when you have more data points.

(In reply to comment #14)
> (In reply to comment #13)
> > Tanner: Is there someone in the Web QA team that knows Selenium that can help
> > us reproduce the bug? Perhaps you could work with them to talk them through it?
> 
> What I have been meaning to do, now that I have WinDbg with symbols, is to get
> a full trace of the problem and much better idea of what is causing it for my
> use case.  I have just started the page running, but it could be a day or two
> before I get anything useful.  I would gladly ask WebQA for help--since they
> all know Selenium, but it doesn't occur with Selenium that I've seen; it
> happens with a Selenium server and code running inside Testswarm server with
> code, which would take a long time for them to set up.
> 
> If I don't get any useful results, I can open a port on my Firewall for others
> to test this on my server, but I would like to not have that overhead if at all
> possible.
> 
> With WinDbg, I have the advantage of having the crash tracked while I am
> away...

Comment 16

[Tanner M. Young [:tmyoung]]

(In reply to comment #15)
> Tanner: Thanks for the update. If would be great if you could update us when
> you have more data points.

So far, I can't reproduce on a clean profile, but now I can reproduce on 3.6.3 without a clean profile.  So there are three probable explanations: either there is an extension problem--my guess is adblock plus which is common to the two instances; it is a plug-in problem--if it is, the problem is likely the Acrobat PDF extension which loads several times during the Selenium tests; or it has something to do with the Lorentz code not interacting well with the JS engine.

I will continue to investigate and first test if adblock plus has something to do with it.

Comment 17

[Tanner M. Young [:tmyoung]]

This is the 3.6.3 crash without symbols, but the signature appears to have moved or changed--if the symbols that I have on that system are remotely correct: http://pastebin.mozilla.org/718225.

I will now test installing different extensions and plug-ins, like adblock plus on the system that has correct and useful symbols.

Comment 18

[Marcia Knous [:marcia]]

Tanner: Any update re: Comment 17?

Comment 19

[Cees T.]

Maybe it only happens due to a timing issue involving Windows swapping and the user clicking and/or scrolling.

Comment 20

[Tanner M. Young [:tmyoung]]

(In reply to comment #18)
> Tanner: Any update re: Comment 17?

I've ruled out adblock plus, but I'm not sure that I am seeing the same crash that other users are, since it wont submit crash reports for this crash (and I don't always get this same signature).

I don't have a lot of time to look into this more, but I will see what I can do over the next few days.

Comment 21

[Tanner M. Young [:tmyoung]]

My problems were related to plug-in timeouts and so the values my testcase returned are meaningless.

Comment 23

[Marcia Knous [:marcia]]

About 1900 crashes for the week.

correlation data for 4.0

48% (21/44) vs.  25% (13237/52073) [e-mail] (Java Quick Starter, http://java.sun.com/javase/downloads/)
30% (13/44) vs.  13% (6766/52073) {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} (Adblock Plus, https://addons.mozilla.org/addon/1865)
14% (6/44) vs.   2% (1079/52073) [e-mail] (Xmarks (formerly Foxmarks), https://addons.mozilla.org/addon/2410)
14% (6/44) vs.   3% (1752/52073) {e4a8a97b-f2ed-450b-b12d-ee082ba24781} (Greasemonkey, https://addons.mozilla.org/addon/748)
11% (5/44) vs.   4% (2307/52073) {3112ca9c-de6d-4884-a869-9855de68056c} (Google Toolbar, https://addons.mozilla.org/addon/6249)
7% (3/44) vs.   1% (287/52073) [e-mail] (YouTube to MP3, https://addons.mozilla.org/addon/11047)
7% (3/44) vs.   1% (450/52073) {4176DFF4-4698-11DE-BEEB-45DA55D89593} (AniWeather, https://addons.mozilla.org/addon/12331)
9% (4/44) vs.   3% (1712/52073) [e-mail] (IDM CC, https://addons.mozilla.org/addon/6973)
7% (3/44) vs.   1% (590/52073) {46551EC9-40F0-4e47-8E18-8E5CF550CFB8} (Stylish, https://addons.mozilla.org/addon/2108)
95% (42/44) vs.  90% (46837/52073) {972ce4c6-7e08-4474-a285-3208198ce6fd} (Default, https://addons.mozilla.org/addon/8150)
18% (8/44) vs.  13% (6788/52073) {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

Comment 24

[LESLIE ORLOFF]

I do not know what this all means.  I get frequent crashes of Firefox that has made the swich to Internet Explorer mandatory.

Comment 25

[Wayne Mery (:wsmwk)]

echoing comment 9 ... collectively, the majority of crashes mention flash, facebook, frontierville 


xref bug 526843

Comment 26

[Wayne Mery (:wsmwk)]

signature mozalloc_abort(char const* const) | mozalloc_handle_oom() | NoteJSChild   adds another 300 crashes per week, and they are 4.x only crashes
bp-9337a609-71b2-4617-b3c0-cd1832110521  youtube

Comment 27

[Sheila Mooney]

Not super high volume - < 10 per week in a given version. Removing top crash keyword.

Comment 28

[Cosmin Muntean [:cmuntean], Ecosystem QA]

Hi Cees,

I have tried to reproduce this issue  on Windows XP x64 and Windows 7 x64, using the steps provided in comment 3 on latest Firefox (44.0.2) and latest Nightly (47.0a1). I have not encountered any crashes. 
I have looked over crash reports in Socorro based on provided crash signature. The latest Firefox version that has this crash signature is 40.0.2. The most crashes are from Thunderbird. If this crash signature does not occur on latest Firefox versions, we could close this bug as Resolved - WFM. 

Firefox: 47.0a1, Build ID: 20160228030239
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Firefox: 44.0.2, Build ID: 20160210153822
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:44.0) Gecko/20100101 Firefox/44.0

Can you please test this on the latest Firefox release (44.0.2) or latest Nightly (47.0a1, https://nightly.mozilla.org/) and tell me if this still reproduces for you ? When doing this please use a new fresh Firefox profile, maybe also in safe mode (https://support.mozilla.org/en-US/kb/troubleshoot-and-diagnose-firefox-problems). If this is still reproducible, please provide a minimal test case. 

Thanks,
Cosmin

Comment 29

[Cosmin Muntean [:cmuntean], Ecosystem QA]

Considering the fact that I cannot reproduce this and the fact that the reporter did not answered to my request until now, I will mark this as Resolved - Worksforme.
If anyone can still reproduce it, feel free to reopen the issue and provide more information.

Thanks,
Cosmin.