Closed Bug 586294 Opened 15 years ago Closed 15 years ago

Firefox 4.0b Crash Report [@ FinalizeArenaList<JSObject, &FinalizeObject> ]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: chofmann, Assigned: sayrer)

Details

(Keywords: crash, regression, Whiteboard: [sg:critical?][no steps to reproduce][critsmash:investigating][waiting for crash stats from fx4b7])

Crash Data

possible trunk/firefox 4 regression, and currently ranked #30 in 4.0b2 data checking --- FinalizeArenaList.JSObject...FinalizeObject 20100810-crashdata.csv found in: 4.0b2 4.0b4pre 4.0b1 3.7a6pre 4.0b3pre 4.0b3 release total-crashes FinalizeArenaList.JSObject...FinalizeObject crashes pct. all 282106 43 0.000152425 4.0b2 14845 34 0.00229033 4.0b4pre1318 3 0.00227618 4.0b1 2484 2 0.000805153 3.7a6pre218 2 0.00917431 4.0b3pre519 1 0.00192678 4.0b3 204 1 0.00490196 os breakdown FinalizeArenaList.JSObject...FinalizeObjectTotal 41 Win5.1 0.83 Win6.0 0.02 Win6.1 0.15 stacks look like http://crash-stats.mozilla.com/report/index/aa940f7f-5a84-4cef-b3cb-368672100811 0 @0x6e0157 1 mozjs.dll FinalizeArenaList<JSObject,&FinalizeObject> js/src/jsgc.cpp:2957 2 mozjs.dll GC js/src/jsgc.cpp:3335 3 mozjs.dll GCUntilDone js/src/jsgc.cpp:3655 4 mozjs.dll js_GC js/src/jsgc.cpp:3709 5 mozjs.dll JS_GC js/src/jsapi.cpp:2447 6 xul.dll nsXPConnect::Collect js/src/xpconnect/src/nsXPConnect.cpp:465 7 xul.dll nsCycleCollector::Collect xpcom/base/nsCycleCollector.cpp:2523 8 xul.dll nsCycleCollector_collect xpcom/base/nsCycleCollector.cpp:3220 9 xul.dll nsJSContext::CC dom/base/nsJSEnvironment.cpp:3594 10 xul.dll nsJSContext::IntervalCC dom/base/nsJSEnvironment.cpp:3682 11 xul.dll nsUserActivityObserver::Observe dom/base/nsJSEnvironment.cpp:290 12 xul.dll nsObserverList::NotifyObservers xpcom/ds/nsObserverList.cpp:130 13 xul.dll nsObserverService::NotifyObservers xpcom/ds/nsObserverService.cpp:182 14 xul.dll nsUITimerCallback::Notify content/events/src/nsEventStateManager.cpp:282 15 xul.dll nsTimerImpl::Fire xpcom/threads/nsTimerImpl.cpp:430 16 xul.dll nsTimerEvent::Run xpcom/threads/nsTimerImpl.cpp:519 17 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:547 18 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:142 19 xul.dll MessageLoop::RunInternal ipc/chromium/src/base/message_loop.cc:219 20 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:202 21 xul.dll xul.dll@0x319963 22 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:176 23 xul.dll nsBaseAppShell::Run widget/src/xpwidgets/nsBaseAppShell.cpp:175 24 xul.dll xul.dll@0xa57bf3 25 xul.dll nsAppStartup::Run toolkit/components/startup/src/nsAppStartup.cpp:191 26 xul.dll XRE_main toolkit/xre/nsAppRunner.cpp:3630 27 firefox.exe wmain toolkit/xre/nsWindowsWMain.cpp:120 28 firefox.exe __tmainCRTStartup obj-firefox/memory/jemalloc/crtsrc/crtexe.c:591 29 kernel32.dll BaseProcessStart more reports at http://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&date=2010-08-11%2006%3A00%3A00&signature=FinalizeArenaList%3CJSObject%2C%20%26FinalizeObject%3E&version=Firefox%3A4.0b2 might be related to random orange bug 571420
blocking2.0: --- → ?
Are there already compartments in these releases? If so it might be related to comment 29 from bug 558861.
It would also mean we finalize a dead object. I guess that is ss.
Group: core-security
(In reply to comment #1) > Are there already compartments in these releases? > If so it might be related to comment 29 from bug 558861. the 3.7a6pre crashes correspond to builds from mozilla-central around June 22/23. 4.0b1 from mozilla-central around 2010 06 30 4.0b2 from mozilla-central around 2010 07 20 4.0b3 from mozilla-central around 2010 08 04
Whiteboard: [sg:critical?][critsmash:investigating]
Whiteboard: [sg:critical?][critsmash:investigating] → [sg:critical?][no steps to reproduce][critsmash:investigating]
blocking2.0: ? → beta6+
Sayre, can you assign this to someone to investigate, please?
blocking2.0: beta6+ → betaN+
still running about 80 crashes per day on b5,b6,and b7pre. not correlated to startup. Correlation to startup or time of session 88 total crashes for FinalizeArenaList.JSObject...FinalizeObject on 20100919-crashdata.csv 10 startup crashes inside 30 sec. 27 startup crashes inside 3 min. 16 repeated crashes inside 3 min. of last crash os breakdown FinalizeArenaList.JSObject...FinalizeObjectTotal 84 Win5.1 0.88 Win6.0 0.00 Win6.1 0.12 nothing consistent in the test urls. maybe related to some kind of downloading activity and the connection is refused as suggested in comment 1 and the random orange bug? 2 crashes on javascript:'' domains of sites 9 http://www.baixaki.com.br 2 http://www.baixaki.com.br/download/ares-galaxy.htm 1 http://www.baixakijogos.com.br/xbox-360/search/jogos?q=Forza+Motorsport+3&exact_search=1 1 http://www.baixaki.com.br/site/dwnld48923.htm 1 http://www.baixaki.com.br/site/dwnld39032.htm 1 http://www.baixaki.com.br/site/dwnld15117.htm 1 http://www.baixaki.com.br/imagens/35010/27808.jpg 1 http://www.baixaki.com.br/download/messenger-plus-live.htm 1 http://www.baixaki.com.br/download/dream-aquarium-screensaver.htm 1 http://www.baixaki.com.br/busca.asp?q=chrome&go=Buscar 7 http://www.facebook.com photos, albums, profiles, registration 6 about:blank// 5 http://static.ak.facebook.com 5 \N// 3 // 2 javascript:''// 2 http://www.wer-kennt-wen.de 2 http://www.orkut.com.br scrapbook, albums 2 http://www.google.com 1 http://www.1000files.com/free/ai-file-viewer.html
Assignee: general → sayrer
The last crash I see is using the 2010092800 build - no recent crashes since then.
I'm still seeing crashes on trunk for this, but might be difference in query methods using the web interface or looking at the .csv files here is an example http://crash-stats.mozilla.com/report/index/b9d54c34-5760-4918-9654-442602101011 and here are more stats date tl crashes at, count build, count build, ... FinalizeArenaList.JSObject...FinalizeObject. 20101008 60 48 4.0b62010091408, 6 4.0b42010081813, 2 4.0b12010063014, 1 4.0b7pre2010092104, 1 4.0b52010083108, 1 4.0b32010080519, 1 4.0b22010072019, 20101009 68 54 4.0b62010091408, 8 4.0b42010081813, 3 4.0b12010063014, 1 4.0b42010081714, 1 4.0b32010080519, 1 4.0b22010072019, 20101010 77 59 4.0b62010091408, 7 4.0b52010083108, 6 4.0b42010081813, 1 4.0b62010091323, 1 4.0b22010072019, 1 4.0b12010063014, 1 4.0b12010062821, 1 3.7a32010031509, 20101011 94 81 4.0b62010091408, 8 4.0b42010081813, 2 4.0b52010083108, 1 4.0b7pre2010092804, 1 4.0b22010072019, 1 4.0b12010063014,
yeah, maybe the angle brackets are giving the web query interface problems, or something else is going on here. here are b7pre crashes in the last 10 days that appear when grepping for FinalizeArenaList<JSObject, &FinalizeObject> converted to regx of FinalizeArenaList.JSObject...FinalizeObject. in the csv files here are the uuids of FinalizeArenaList<JSObject, &FinalizeObject> 4.0b7pre http://crash-stats.mozilla.com/report/index/9b20012a-36a0-4d06-9ed1-3ba2e2101004 FinalizeArenaList<JSObject, &FinalizeObject> 4.0b7pre http://crash-stats.mozilla.com/report/index/f611ba28-da24-4864-8c43-e342a2101004 FinalizeArenaList<JSObject, &FinalizeObject> 4.0b7pre http://crash-stats.mozilla.com/report/index/749439ac-6ce3-46a9-81e1-bfc9d2101004 FinalizeArenaList<JSObject, &FinalizeObject> 4.0b7pre http://crash-stats.mozilla.com/report/index/e861b78e-1d42-4ce0-a1ff-5ca662101005 FinalizeArenaList<JSObject, &FinalizeObject> 4.0b7pre http://crash-stats.mozilla.com/report/index/10908d29-f2ef-4f15-b28a-36e062101007 FinalizeArenaList<JSObject, &FinalizeObject> 4.0b7pre http://crash-stats.mozilla.com/report/index/f2187107-c635-4795-99dd-da74d2101008 FinalizeArenaList<JSObject, &FinalizeObject> 4.0b7pre http://crash-stats.mozilla.com/report/index/b9d54c34-5760-4918-9654-442602101011
are there any 4.0b8pre crashes? what are the buildids here?
the newest buildid in that UUID sample was from 09-28-2010
blocking2.0: betaN+ → ---
OS: Windows XP → All
no 4.0bb8pre crashes. that last crash seen on 201010112114 with 4.0b7pre 201009280419 http://crash-stats.mozilla.com/report/index/b9d54c34-5760-4918-9654-442602101011 maybe be the last we will see of this, although it might take the next beta to confirm since the trunk crash volume was low (one crash every few days).
Whiteboard: [sg:critical?][no steps to reproduce][critsmash:investigating] → [sg:critical?][no steps to reproduce][critsmash:investigating][waiting for crash stats from fx4b7]
So far I don't see any crashes in Beta 7 in this stack using a UI search. I see a lot of crashes in B6 but I don't see the 4.0b7pre crash chofmann notes in Comment 12.
Chris, could you dig through crash stats here and see if this is still happening?
no beta 7 reports for this looking at this query http://crash-stats.mozilla.com/report/list?signature=FinalizeArenaList%3CJSObject%2C%20%26FinalizeObject%3E
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ FinalizeArenaList<JSObject, &FinalizeObject> ]
Group: core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.