575886 - Random Crash during tsvg_opacity [@ nsDeque::PopFront()]

Status: RESOLVED FIXED

(Firefox :: Bookmarks & History, defect)

Description

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(Away: -9/28)]

> Operating system: Mac OS X
>                   10.5.8 9L31a
> CPU: x86
>      GenuineIntel family 6 model 23 stepping 10
>      2 CPUs
> 
> Crash reason:  EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE
> Crash address: 0x8
> 
> Thread 0 (crashed)
>  0  XUL!nsDeque::PopFront() [nsDeque.cpp : 296 + 0x2]
>     eip = 0x02e4a809   esp = 0xbfffac74   ebp = 0xbfffac78   ebx = 0x02d33904
>     esi = 0x00000000   edi = 0x1ffb4cd0   eax = 0x00000008   ecx = 0x00000008
>     edx = 0x00000000   efl = 0x00210246
>     Found by: given as instruction pointer in context
>  1  XUL!mozilla::places::(anonymous namespace)::StartSetURITitleStep::Release() [History.cpp:c79b744ca114 : 900 + 0xa]
>     eip = 0x02d33961   esp = 0xbfffac80   ebp = 0xbfffacc8
>     Found by: previous frame's frame pointer
>  2  XUL + 0xc51fb3
>     eip = 0x02e44fb4   esp = 0xbfffacd0   ebp = 0xbffface8
>     Found by: previous frame's frame pointer
>  3  XUL + 0xb40301
>     eip = 0x02d33302   esp = 0xbfffacf0   ebp = 0xbfffad28
>     Found by: previous frame's frame pointer
>  4  XUL!mozilla::places::History::Release() [History.cpp:c79b744ca114 : 880 + 0x7]
>     eip = 0x02d33629   esp = 0xbfffad30   ebp = 0xbfffad48
>     Found by: previous frame's frame pointer
>  5  XUL!nsContentUtils::Shutdown() [nsContentUtils.cpp:c79b744ca114 : 1083 + 0x11]
>     eip = 0x02568a29   esp = 0xbfffad50   ebp = 0xbfffad98
>     Found by: previous frame's frame pointer
>  6  XUL + 0x16aa8f
>     eip = 0x0235da90   esp = 0xbfffada0   ebp = 0xbfffadc8
>     Found by: previous frame's frame pointer
>  7  XUL + 0x3c7d24
>     eip = 0x025bad25   esp = 0xbfffadd0   ebp = 0xbfffade8
>     Found by: previous frame's frame pointer
>  8  XUL!nsNodeInfo::LastRelease() [nsNodeInfoManager.h : 71 + 0x7]
>     eip = 0x025ba40e   esp = 0xbfffadf0   ebp = 0xbfffae28
>     Found by: previous frame's frame pointer
>  9  XUL!nsNodeInfo::Release() [nsNodeInfo.cpp:c79b744ca114 : 141 + 0x7]
>     eip = 0x025ba50f   esp = 0xbfffae30   ebp = 0xbfffae48
>     Found by: previous frame's frame pointer
> 10  XUL + 0xc51fb3
>     eip = 0x02e44fb4   esp = 0xbfffae50   ebp = 0xbfffae68
>     Found by: previous frame's frame pointer
> 11  XUL + 0x725859
>     eip = 0x0291885a   esp = 0xbfffae70   ebp = 0xbfffaeb8
>     Found by: previous frame's frame pointer
> 12  XUL!nsXULPrototypeNode::cycleCollection::Unroot(void*) [nsXULElement.h:c79b744ca114 : 219 + 0x7]
>     eip = 0x0291219c   esp = 0xbfffaec0   ebp = 0xbfffaed8
>     Found by: previous frame's frame pointer
> 13  XUL!nsCycleCollector::CollectWhite() [nsCycleCollector.cpp:c79b744ca114 : 1870 + 0x10]
>     eip = 0x02e97a7d   esp = 0xbfffaee0   ebp = 0xbfffaf18
>     Found by: previous frame's frame pointer
> 14  XUL + 0xca5046
>     eip = 0x02e98047   esp = 0xbfffaf20   ebp = 0xbfffaf48
>     Found by: previous frame's frame pointer
> 15  XUL!XPCCycleCollectGCCallback [nsXPConnect.cpp:c79b744ca114 : 374 + 0x4]
>     eip = 0x02a933ed   esp = 0xbfffaf50   ebp = 0xbfffaf88
>     Found by: previous frame's frame pointer
> 16  libmozjs.dylib!js_GC(JSContext*, JSGCInvocationKind) [jsgc.cpp:c79b744ca114 : 3214 + 0xf]
>     eip = 0x0027517a   esp = 0xbfffaf90   ebp = 0xbfffb198
>     Found by: previous frame's frame pointer
> 17  libmozjs.dylib + 0x3dcc
>     eip = 0x00225dcd   esp = 0xbfffb1a0   ebp = 0xbfffb1b8
>     Found by: previous frame's frame pointer
> 18  XUL!nsXPConnect::Collect() [nsXPConnect.cpp:c79b744ca114 : 448 + 0x7]
>     eip = 0x02a906f7   esp = 0xbfffb1c0   ebp = 0xbfffb298
>     Found by: previous frame's frame pointer
> 19  XUL!nsCycleCollector::Collect(unsigned int) [nsCycleCollector.cpp:c79b744ca114 : 2523 + 0x7]
>     eip = 0x02e991b3   esp = 0xbfffb2a0   ebp = 0xbffff178
>     Found by: previous frame's frame pointer
> 20  XUL + 0xca64c1
>     eip = 0x02e994c2   esp = 0xbffff180   ebp = 0xbffff1d8
>     Found by: previous frame's frame pointer
> 21  XUL!mozilla::ShutdownXPCOM(nsIServiceManager*) [nsXPComInit.cpp:c79b744ca114 : 851 + 0x4]
>     eip = 0x02e4e13a   esp = 0xbffff1e0   ebp = 0xbffff248
>     Found by: previous frame's frame pointer
> 22  XUL + 0x4b36
>     eip = 0x021f7b37   esp = 0xbffff250   ebp = 0xbffff298
>     Found by: previous frame's frame pointer
> 23  XUL!XRE_main [nsAppRunner.cpp:c79b744ca114 : 1085 + 0xd]
>     eip = 0x021fb3e4   esp = 0xbffff2a0   ebp = 0xbffff7a8
>     Found by: previous frame's frame pointer
> 24  firefox-bin!main [nsBrowserApp.cpp:c79b744ca114 : 158 + 0x18]
>     eip = 0x00001d48   esp = 0xbffff7b0   ebp = 0xbffff808
>     Found by: previous frame's frame pointer
> 25  firefox-bin + 0xbf5
>     eip = 0x00001bf6   esp = 0xbffff810   ebp = 0xbffff828
>     Found by: previous frame's frame pointer
> 26  0xb
>     eip = 0x0000000c   esp = 0xbffff830   ebp = 0x00000000
>     Found by: previous frame's frame pointer

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1277864362.1277864875.12784.gz

Comment 1

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(Away: -9/28)]

This might be fixed by http://hg.mozilla.org/mozilla-central/rev/d5f0b1f2f2f0

Comment 2

[Benjamin Stover (:stechz)]

Thanks for this report, a check for this has been added to bug 556400.

Should I resolve this as resolved invalid, since this crash has been backed out?

Comment 3

[timeless]

if you know the code change that fixed a problem, then you fixed it.

Comment 4

[(no longer active)]

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1280967880.1280968364.9784.gz

Comment 5

[Marco Bonardo [:mak]]

steps were removed on the branch in favor of a single step in a background thread, thus this won't happen anymore

Comment 6

[Marco Bonardo [:mak]]

fixed by removing that code in bug 599969. This cannot happen anymore