597344 - crash [@ nsGenericElement::cycleCollection::Traverse(void*, nsCycleCollectionTraversalCallback&) ]

Status: RESOLVED INCOMPLETE

(Core :: XPCOM, defect)

Description

[Scoobidiver (away)]

Build : Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b7pre) Gecko/20100916 Firefox/4.0b7pre

It is a residual crash signature : 1-2 crashes/day (see bug 548248).
Since 20100912 build, the crash daily rate has been about 25 crashes/day.
It is #13 top crasher for this build.

Signature	nsGenericElement::cycleCollection::Traverse(void*, nsCycleCollectionTraversalCallback&)
UUID	249bab4e-261a-4bd1-9655-1b75a2100916
Time 	2010-09-16 23:50:00.713322
Uptime	13241
Last Crash	152421 seconds (1.8 days) before submission
Install Age	13240 seconds (3.7 hours) since version was first installed.
Product	Firefox
Version	4.0b7pre
Build ID	20100916041016
Branch	2.0
OS	Windows NT
OS Version	6.1.7600
CPU	x86
CPU Info	GenuineIntel family 6 model 30 stepping 5
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x9
App Notes 	AdapterVendorID: 1002, AdapterDeviceID: 9505	

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsGenericElement::cycleCollection::Traverse 	content/base/src/nsGenericElement.cpp:4441
1 	xul.dll 	nsCycleCollector::MarkRoots 	xpcom/base/nsCycleCollector.cpp:1732
2 	xul.dll 	xul.dll@0xd930a3 	
3 	xul.dll 	nsCycleCollector::BeginCollection 	xpcom/base/nsCycleCollector.cpp:2575
4 	xul.dll 	nsCycleCollector::BeginCollection 	xpcom/base/nsCycleCollector.cpp:2612

The regression range is :
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=73ab2c3c5ad9&tochange=cd3c926a7413

Comment 1

[chris hofmann]

moved up to #12 top crash on 4.0b7pre

checking --- nsGenericElement::cycleCollection::Traverse.void...nsCycleCollectionTraversalCallback.. 20100922-crashdata.csv
found in: 3.6.10 4.0b6 4.0b7pre 3.6.8 3.5.13 3.6.3 3.6.9 3.0.19 3.6 3.5.5 3.6.4 3.5.6 3.0b5 3.0.2 4.0b5 4.0b3 4.0b1 3.6.6 3.0.4 3.0 4.0b4 3.6b5 3.6b4 3.6b2 3.6b1 3.6.3plugin1 3.6.2 3.5.7 3.5.3 3.5.2 3.5.10 3.1b1 3.0b2 3.0.6 3.0.5
release total-crashes
              nsGenericElement::cycleCollection::Traverse.void...nsCycleCollectionTraversalCallback.. crashes
                         pct.
all     342643  278     0.00081134
3.6.10  179878  109     0.000605966
4.0b6   24477   31      0.0012665
4.0b7pre2622    22      0.00839054
3.6.8   29182   20      0.000685354
3.5.13  14415   20      0.00138744
3.6.3   11962   13      0.00108677
3.6.9   9378    9       0.000959693
3.0.19  9434    7       0.000741997


os breakdown
nsGenericElement::cycleCollection::Traverse.void...nsCycleCollectionTraversalCallback..Total 267
Win5.1  0.73
Win6.0  0.06
Win6.1  0.17
Mac10.4 0.01
Mac10.5 0.01
Mac10.6 0.01
Lin2.4  0.00

not much concentration around any urls for testing
  25 \N
   5 about:blank
   4 
   3 http://www.orkut.com.br/Main#Home
   2 http://www.google.co.in/firefox?client=firefox-a&rls=org.mozilla:en-US:official
   2 http://www.facebook.com/home.php?#!/home.php?sk=lf
   2 http://www.facebook.com/home.php?#!/?ref=home
   2 http://www.facebook.com/?ref=home#!/?ref=home
   2 http://www.facebook.com/?ref=home
   1 wyciwyg://1/http://talkgadget.google.com/talkgadget/mole?idxxxxxxxxxxx
   1 wyciwyg://1/http://co116w.col116.mail.live.com/mail/home.mvc?n=xxxxxx
   1 javascript:''

domains of sites
  47 http://www.facebook.com
  25 \N//
  17 http://www.orkut.com.br
   9 http://www.youtube.com
   7 http://apps.facebook.com
   5 https://mail.google.com
   5 http://vkontakte.ru

Comment 2

[Benjamin Smedberg]

Regression range includes JM, probably some GC funkiness. This can wait until compartments to see what the final effect is.

Comment 3

[Sheila Mooney]

It's still there in the latest builds on the trunk and in beta7. About 24 crashes on the trunk in the past week and 216 in beta7. It's hovering around #100 on beta7.

Comment 5

[[e-mail]]

This bug appeared today for me on Fx8 while editing a picture in Picasa.

Comment 6

[[e-mail]]

This bug appeared today for me on Fx8 while editing a picture in Picasa.

Report ID: bp-0421f9ff-1e12-4133-a580-8d7492111111

Comment 7

[Sheila Mooney]

Still a valid top crash. Sitting at #43 on 8.0 with over 1000 crashes a week.

Comment 8

[Sheila Mooney]

It's the #44 top crash for 10.0 so still sitting at the same volume.

Comment 9

[Sheila Mooney]

This seems to have gone way down. Removing the top crash keyword.

Comment 10

[Andrew McCreight [:mccr8]]

This has gone away, or at least morphed, from the top 300 list.