544020 - Session restore crashing Linux/Minefield [@ @0x0 | XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)]

Status: RESOLVED INVALID

(Core :: XPConnect, defect)

Description

[David Dahl :ddahl]

Recently, I have noticed minefield has crashed overnight. When I restart, I try to restore my session and it immediately crashes Firefox.

Here is my crash report:  http://crash-stats.mozilla.com/report/index/bp-fa780254-5137-4646-b9c9-319f62100203

I tried to look at the crash report, but i'm not sure if it was submitted correctly, as I gtethe "Oh Noes" page.

Comment 1

[David Dahl :ddahl]

Whoops, I meant to say this happens when I click on "New Session", not "Restore Session", If I do nothing and just start surfing everything is ok.

Comment 2

[David Dahl :ddahl]

http://crash-stats.mozilla.com/report/index/361e80e8-ccd6-48df-a68c-65fc52100203

another one with a usable crash report

Comment 3

[timeless]

Signature	@0x0 | XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)
UUID	361e80e8-ccd6-48df-a68c-65fc52100203
Time 	2010-02-03 10:36:35.908978
Uptime	9
Last Crash	42 seconds before submission
Product	Firefox
Version	3.7a1pre
Build ID	20100203031016
Branch	1.9.3
OS	Linux
OS Version	0.0.0 Linux 2.6.31-17-generic #54-Ubuntu SMP Thu Dec 10 16:20:31 UTC 2009 i686
CPU	x86
CPU Info	GenuineIntel family 6 model 23 stepping 6
Crash Reason	SIGSEGV
Crash Address	0x0
User Comments	Hit "start new session" after a crash and it immediately crashed again
Processor Notes 	
Crashing Thread
Frame 	Module 	Signature 	Source
0 		@0x0 	
1 	libxul.so 	XPCWrappedNative::CallMethod 	js/src/xpconnect/src/xpcwrappednative.cpp:2727
2 	libxul.so 	XPC_WN_CallMethod 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1756
3 	libmozjs.so 	js_Invoke 	js/src/jsinterp.cpp:1388
4 	libmozjs.so 	js_Interpret 	js/src/jsops.cpp:2304
5 	libmozjs.so 	js_Invoke 	js/src/jsinterp.cpp:1396
6 	libmozjs.so 	js_fun_call 	js/src/jsfun.cpp:1989
...
24 	libmozjs.so 	js_fun_call 	js/src/jsfun.cpp:1989
25 	libmozjs.so 	js_Interpret 	js/src/jsops.cpp:2270
26 	libmozjs.so 	js_Invoke 	js/src/jsinterp.cpp:1396
27 	libxul.so 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1696
28 	libxul.so 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:570
29 	libxul.so 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp:95
30 	libxul.so 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:430
31 	libxul.so 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:519
32 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:527
33 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:250
34 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:142
35 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:211
36 	libxul.so 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:194
37 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:168

Comment 4

[David Dahl :ddahl]

I'm running an up-to-the-moment debug build now with all extensions disabled, if it crashes again I will get a better stack with Call JSStack in gdb. I imagine this is extension-related.

Comment 5

[David Dahl :ddahl]

Attachment: another crash, gdb bt output

Another crash tonight, attached gdb bt output, could not get JSStack:

(gdb) call DumpJSStack()
[New Thread 0x85cfdb70 (LWP 26366)]
[New Thread 0xa25ffb70 (LWP 26367)]
[New Thread 0x8b3feb70 (LWP 26368)]
[New Thread 0x864feb70 (LWP 26369)]
[New Thread 0xa1dfeb70 (LWP 26370)]

Program received signal SIGPIPE, Broken pipe.
[Switching to Thread 0xb1dffb70 (LWP 25252)]
0xb7825422 in __kernel_vsyscall ()
The program received a signal in another thread while
making a function call from GDB.
Evaluation of the expression containing the function
(DumpJSStack) will be abandoned.
When the function is done executing, GDB will silently stop.

Comment 6

[David Dahl :ddahl]

previous crash was not the same, once gdb killed most of the threads, i see this error and firefox is still running:

A script on this page may be busy, or it may have stopped responding. You can stop the script now, open the script in the debugger, or let the script continue.

Script: http://ad.doubleclick.net/adj/x1.adx/discoverbank/bmrm/ron;sz=728x90;click=http://googleads.g.doubleclick.net/aclk?sa=l&ai=B2rbvn1FqS4j8C5mqrAOe3J2SBJTsgqUBkJSb9BDw3cSZLAAQARgBIAA4AVCAx-HEBGDJrs6GyKOgGYIBF2NhLXB1Yi0wMjQzMDE3MTY0MTY2MTgxoAH04JnsA7IBF3d3dy5uYWtlZGNhcGl0YWxpc20uY29tugEJNzI4eDkwX2FzyAEJ2gFgaHR0cDovL3d3dy5uYWtlZGNhcGl0YWxpc20uY29tLzIwMTAvMDIvaXMtdGhlLXVzLXJlYWNoaW5nLWEtc3RyYXRlZ2ljLWRlZmF1bHQtdGlwcGluZy1wb2ludC5odG1smALmEMACAcgC9uuKDqgDAegD0gPoA5cC6APsBPUDAgAAhA&num=1&sig=AGiWqtwO_JLbGpNcfbRti6aGjnTIopXt1A&client=ca-pub-0243017164166181&adurl=;ord=1402142400?:41

Comment 7

[David Dahl :ddahl]

ok, it crashed once I dismissed the alert. I have a feeling this crash report is RESO:INVALID, but I will wait until morning to see if it dies again. all extensions are disabled, etc...

Comment 8

[David Dahl :ddahl]

I am marking reso:invalid on the original crash, it must have been an extension. The hang mentioned in comment 6 was real, but probably not a crash as gdb i think killed it. I will start turning on my extensions one by one to figure out which one did this.