565222 - Crash in garbage collector (nsXPCOMCycleCollectionParticipant)

Status: RESOLVED INCOMPLETE

(Core :: XPConnect, defect)

Description

[Tim Starling]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.3) Gecko/20100423 Ubuntu/10.04 Firefox/3.6.3
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100423 Lightning/1.0b1 Thunderbird/3.0.4

Thunderbird 3.0.4 (from Ubuntu 10.04) crashes during garbage collection. I collected a core dump using apport, it is large and contains private data so I don't want to upload it. But here is the backtrace:

#0  0xb779d430 in __kernel_vsyscall ()
#1  0xb776e230 in raise (sig=11) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:42
#2  0x080872cf in nsProfileLock::FatalSignalHandler (signo=11) at nsProfileLock.cpp:212
#3  <signal handler called>
#4  0x0813a82f in CallQueryInterface<nsISupports, nsXPCOMCycleCollectionParticipant> (wrapper=<value optimised out>)
    at ../../../../dist/include/xpcom/nsISupportsUtils.h:203
#5  WrapperIsNotMainThreadOnly (wrapper=<value optimised out>) at nsXPConnect.cpp:711
#6  0x0813cfc8 in nsXPConnect::Traverse (this=0xb588a320, p=0xacc3c0e0, cb=...) at nsXPConnect.cpp:748
#7  0xb767262a in GCGraphBuilder::Traverse (this=0xbf8098cc, aPtrInfo=0xa911d354) at nsCycleCollector.cpp:1375
#8  0xb76726a2 in nsCycleCollector::MarkRoots (this=0xb6135000, builder=...) at nsCycleCollector.cpp:1574
#9  0xb7672e8f in nsCycleCollector::BeginCollection (this=0xb6135000) at nsCycleCollector.cpp:2507
#10 0xb7672ef4 in nsCycleCollector_beginCollection () at nsCycleCollector.cpp:3060
#11 0x0813d841 in XPCCycleCollectGCCallback (cx=0xb610e400, status=JSGC_MARK_END) at nsXPConnect.cpp:390
#12 0xb76d0d6d in js_GC (cx=0xb610e400, gckind=GC_NORMAL) at jsgc.cpp:3504
#13 0xb76aa5a4 in JS_GC (cx=0xb610e400) at jsapi.cpp:2459
#14 0x0813d23a in nsXPConnect::Collect (this=0xb588a320) at nsXPConnect.cpp:477
#15 0xb7672fde in nsCycleCollector::Collect (this=0xb6135000, aTryCollections=1) at nsCycleCollector.cpp:2389
#16 0xb7673136 in nsCycleCollector_collect () at nsCycleCollector.cpp:3048
#17 0x0845540b in nsJSContext::CC () at nsJSEnvironment.cpp:3534
#18 0x0845550f in nsJSContext::MaybeCC (aHigherProbability=1) at nsJSEnvironment.cpp:3602
#19 0x084558cd in nsUserActivityObserver::Observe (this=0xb3117c80, aSubject=0x0, 
    aTopic=0x8b14100 "user-interaction-active", aData=0x0) at nsJSEnvironment.cpp:287
#20 0xb7641625 in nsObserverList::NotifyObservers (this=0xb1f9bdd0, aSubject=0x0, 
    aTopic=0x8b14100 "user-interaction-active", someData=0x0) at nsObserverList.cpp:130
#21 0xb764193a in nsObserverService::NotifyObservers (this=0xb5866130, aSubject=0x0, 
    aTopic=0x8b14100 "user-interaction-active", someData=0x0) at nsObserverService.cpp:181
#22 0x083ec2a6 in nsUITimerCallback::Notify (this=0xb302e470, aTimer=0xb301e820) at nsEventStateManager.cpp:357
#23 0xb7669c46 in nsTimerImpl::Fire (this=0xb301e820) at nsTimerImpl.cpp:428
#24 0xb7669ce9 in nsTimerEvent::Run (this=0xa37857b0) at nsTimerImpl.cpp:512
#25 0xb766706f in nsThread::ProcessNextEvent (this=0xb61d80b0, mayWait=1, result=0xbf80dc0c) at nsThread.cpp:521
#26 0xb7635f52 in NS_ProcessNextEvent_P (thread=0x6d6f632e, mayWait=1) at nsThreadUtils.cpp:247
#27 0x0823de82 in nsBaseAppShell::Run (this=0xb587aa60) at nsBaseAppShell.cpp:170
#28 0x087418d0 in nsAppStartup::Run (this=0xb4624190) at nsAppStartup.cpp:193
#29 0x08080c3e in XRE_main (argc=1, argv=0xbf80e184, aAppData=0xb61103c0) at nsAppRunner.cpp:3321
#30 0x0807c950 in main (argc=1, argv=0xbf80e184) at nsMailApp.cpp:103



Reproducible: Sometimes

Comment 1

[Wayne Mery (:wsmwk)]

Tim, can you still reproduce this?

Comment 2

[Tim Starling]

Thunderbird still crashes sometimes, but I haven't been collecting backtraces lately. 

If the backtrace just indicates a normal consequence of a corrupted heap, then you may as well close this bug, since I was never able to isolate the cause of the corruption. "Something corrupted the heap once in some old version of Thunderbird" is not much of a bug report.

Comment 3

[Wayne Mery (:wsmwk)]

thanks. feel free then to reopen or file a new bug, *especially* if you get steps to reproduce