503651 - Crash [@ JS_RemoveRootRT | nsJSObjWrapper::NP_Invalidate]

Status: RESOLVED WORKSFORME

(Core Graveyard :: Plug-ins, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Topcrash for the past day (numbering 156) at #32 for "Results within 1 days of now, and the product is one of Firefox, and the version is one of Firefox:3.5." Most on Windows XP/Vista and using 3.5 final release.

http://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A3.5&query_search=signature&query_type=exact&query=&date=&range_value=1&range_unit=days&do_query=1&signature=JS_RemoveRootRT

It'll be cool if there was a list of URLs that crash at this location. One of the comments mention "trying to download yahoo widgets".

Comment 1

[Samuel Sidler (old account; do not CC)]

URLs for this bug will be generated in (the confidential to protect user privacy) bug 503725.

Comment 2

[timeless]

Signature	JS_RemoveRootRT
UUID	dea0afd4-18e5-4d6c-a7b1-3ab4f2090711
Time 	2009-07-11 14:30:41.958818
Uptime	146
Last Crash	162 seconds before submission
Product	Firefox
Version	3.5
Build ID	20090624025744
Branch	1.9.1
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
CPU	x86
CPU Info	GenuineIntel family 6 model 23 stepping 6
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x1d8
User Comments	http://widgets.yahoo.com/widgets/desk-calendar
Processor Notes 	
Related Bugs

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	js3250.dll 	JS_RemoveRootRT 	js/src/jsapi.cpp:1924
1 	xul.dll 	nsJSObjWrapper::NP_Invalidate 	modules/plugin/base/src/nsJSNPRuntime.cpp:532
2 	xul.dll 	nsJSObjWrapper::~nsJSObjWrapper 	modules/plugin/base/src/nsJSNPRuntime.cpp:501
3 	xul.dll 	nsJSObjWrapper::`scalar deleting destructor' 	
4 	xul.dll 	nsJSObjWrapper::NP_Deallocate 	modules/plugin/base/src/nsJSNPRuntime.cpp:521
5 	xul.dll 	_releaseobject 	modules/plugin/base/src/nsNPAPIPlugin.cpp:1556
6 	npyaxmpb.dll 	npyaxmpb.dll@0xb018 	
7 	xul.dll 	DoStopPlugin 	layout/generic/nsObjectFrame.cpp:1957
8 	xul.dll 	nsStopPluginRunnable::Run 	layout/generic/nsObjectFrame.cpp:2020
9 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:510
10 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:170
11 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:193
12 	nspr4.dll 	PR_GetEnv 	
13 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:110
14 	firefox.exe 	firefox.exe@0x21a7 	
15 	kernel32.dll 	kernel32.dll@0x17066

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Adjusting summary to (hopefully) get it back on the bug reference in crash-stats.

Comment 4

[timeless]

gary: that signature isn't valid. the signature is the crashing frame, and nsJSObjWrapper::NP_Invalidate is *not* the crashing frame, it's the calling frame.

in this stupid integration system, you probably need to use | instead of - (that's a bug, get them to fix their system to support the normal syntax).

Comment 5

[Daniel Veditz [:dveditz]]

The most common crash here is due to Flash

  JS_RemoveRootRT
  nsJSObjWrapper::NP_Invalidate
  nsJSObjWrapper::~nsJSObjWrapper
  nsJSObjWrapper::`scalar deleting destructor' 	
  nsJSObjWrapper::NP_Deallocate/nsJSNPRuntime.cpp:521
  _releaseobject
  _releasevariantvalue
  NPSWF32.dll@0x132bfd

Others, still plugin-related, seem to be associated with Yahoo widgets

  JS_RemoveRootRT
  nsJSObjWrapper::NP_Invalidate
  nsJSObjWrapper::~nsJSObjWrapper
  nsJSObjWrapper::`scalar deleting destructor' 	
  nsJSObjWrapper::NP_Deallocate
  _releaseobject
  npyaxmpb.dll@0xb018 	
  DoStopPlugin
  nsStopPluginRunnable::Run
  nsThread::ProcessNextEvent
  nsBaseAppShell::Run
  nsAppStartup::Run

A rare few happen during GC and may or may not involve objects from plugins
like bp-5d9e2e79-a1db-416c-beda-38bfd2100113

Crashes happen in 3.0.x as well.

Comment 6

[Sheila Mooney]

I don't see this signature anymore when searching crash stats. Did it just get fixed? Is this something we should close? I am removing the top crash keyword for now.

Comment 7

[Robert Claypool]

I've got a WinDBG dump for a crash which caused windbg to spit out *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Mozilla\Firefox\mozjs.dll - 
mozjs!js_RemoveRoot+0xfe5:
Is it this bug?

Comment 8

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

https://crash-stats.mozilla.com/report/list?date=2014-12-04&range_unit=days&range_value=28&signature=JS_RemoveRootRT#tab-reports

shows that this only seems to occur with Firefox 3.6.x and below in the past month.

-> WORKSFORME