608217 - Crash @ XPCWrappedNative::FlatJSObjectFinalized (Mac+linux)

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Carsten Book [:Tomcat]]

Mac and Linux Crash (so far no Windows Crash) http://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&date=2010-10-29%2000%3A00%3A00&signature=XPCWrappedNative%3A%3AFlatJSObjectFinalized&version=Firefox%3A4.0b8pre
 for Beta8pre - no comments so far 

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	XUL 	XPCWrappedNative::FlatJSObjectFinalized 	nsISupportsUtils.h:184
1 	XUL 	XPC_WN_NoHelper_Finalize 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:674
2 	XUL 	MarkAndSweep 	js/src/jsobjinlines.h:134
3 	XUL 	js_GC 	js/src/jsgc.cpp:2529
4 	XUL 	nsXPConnect::Collect 	js/src/xpconnect/src/nsXPConnect.cpp:400
5 	XUL 	nsXPConnect::GarbageCollect 	js/src/xpconnect/src/nsXPConnect.cpp:408
6 	XUL 	nsJSContext::CC 	dom/base/nsJSEnvironment.cpp:3623
7 	XUL 	nsJSContext::MaybeCC 	dom/base/nsJSEnvironment.cpp:3712
8 	XUL 	GCTimerFired 	dom/base/nsJSEnvironment.cpp:3700
9 	XUL 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:425
10 	XUL 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:517
11 	XUL 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:547
12 	XUL 	NS_ProcessPendingEvents_P 	nsThreadUtils.cpp:200
13 	XUL 	nsBaseAppShell::NativeEventCallback 	widget/src/xpwidgets/nsBaseAppShell.cpp:131
14 	XUL 	nsAppShell::ProcessGeckoEvents 	widget/src/cocoa/nsAppShell.mm:399
15 	CoreFoundation 	CoreFoundation@0x4dd3c 	
16 	CoreFoundation 	CoreFoundation@0x4c088 	
17 	XUL 	nsDOMEvent::Release 	content/events/src/nsDOMEvent.cpp:189
18 		@0x43ffffffff 	
19 	XUL 	nsGlobalWindow::QueryInterface 	dom/base/nsGlobalWindow.cpp:1236
20 	XUL 	nsGlobalChromeWindow::QueryInterface 	dom/base/nsGlobalWindow.cpp:9778
21 	XUL 	nsDocShell::GetInterface 	docshell/base/nsDocShell.cpp:886
22 		@0x1032355d7 	
23 	XUL 	XPCJSContextStack::Push 	nsTArray.h:654
24 	XUL 	nsCxPusher::Push 	content/base/src/nsContentUtils.cpp:3013
25 		@0x7fff70ba762f 	
26 	CoreFoundation 	CoreFoundation@0x1ad8f 	
27 	XUL 	nsEventStateManager::PostHandleEvent 	nsAutoPtr.h:969

Comment 1

[Marcia Knous [:marcia]]

Just hit this on 10.7 after a very long uptime: https://crash-stats.mozilla.com/report/index/bp-05184855-bda0-4fbb-bf9f-913d02110705

Comment 2

[Tobias (:Tobbi) Markus]

This seems to happen with Thunderbird too: https://crash-stats.mozilla.com/report/index/bp-3d2e537b-8070-4bb5-a18e-de8582110925

Comment 4

[Tim Taubert [:ttaubert] (inactive)]

https://crash-stats.mozilla.com/report/index/bp-65169b07-a0c1-44f0-acb9-19f5f2120506

Comment 5

[Wayne Mery (:wsmwk)]

(In reply to Tim Taubert [:ttaubert] from comment #4)
> https://crash-stats.mozilla.com/report/index/bp-65169b07-a0c1-44f0-acb9-
> 19f5f2120506 (firefox crash)
Tim, did you ever get this crash again?


(In reply to Tobias Markus (:Tobbi) [hiatus beginning January 2013] from comment #2)
> This seems to happen with Thunderbird too:
> https://crash-stats.mozilla.com/report/index/bp-3d2e537b-8070-4bb5-a18e-
> de8582110925  

unclear whether the crashes seen last year are the same.

What I see now is different stack than comment 4, and higher crash rate for thunderbird than firefox - at least for the crashes I examined.

bp-21034098-5750-4de6-a9ea-5ad422130110 tb 17.0.2
0	libxul.so	XPCWrappedNative::FlatJSObjectFinalized	nsISupportsUtils.h:149
1	libxul.so	WrappedNativeFinalize	XPCWrappedNativeJSOps.cpp:617
2	libxul.so	js::gc::Arena::finalize<JSObject>	jsobjinlines.h:235
3	libxul.so	js::gc::FinalizeArenas	jsgc.cpp:412
4	libxul.so	IncrementalCollectSlice	jsgc.cpp:1626 

bp-bf842c98-21f0-44b4-b8a9-5d8fc2121223 FF18.0
0	XUL	XPCWrappedNative::FlatJSObjectFinalized	js/xpconnect/src/XPCWrappedNative.cpp:1336
1	XUL	WrappedNativeFinalize	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:617
2	XUL	js::gc::finalize<JSObject>	js/src/jsobjinlines.h:234
3	XUL	js::gc::FinalizeArenas	js/src/jsgc.cpp:419
4	XUL	js::gc::ArenaLists::queueObjectsForSweep	js/src/jsgc.cpp:1660
5	XUL	IncrementalCollectSlice	js/src/jsgc.cpp:3865

Comment 6

[Tim Taubert [:ttaubert] (inactive)]

(In reply to Wayne Mery (:wsmwk) from comment #5)
> (In reply to Tim Taubert [:ttaubert] from comment #4)
> > https://crash-stats.mozilla.com/report/index/bp-65169b07-a0c1-44f0-acb9-
> > 19f5f2120506 (firefox crash)
> Tim, did you ever get this crash again?

No.

Comment 8

[Wayne Mery (:wsmwk)]

firefox 15
XPCWrappedNative::FlatJSObjectFinalized
bp-65169b07-a0c1-44f0-acb9-19f5f2120506
0	libxul.so	XPCWrappedNative::FlatJSObjectFinalized	nsISupportsUtils.h:184
1	libxul.so	XPC_WN_NoHelper_Finalize	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:645
2	libxul.so	js::gc::FinalizeArenas	js/src/jsobjinlines.h:263
3	libxul.so	js::gc::ArenaLists::finalizeObjects	js/src/jsgc.cpp:1505
4	libxul.so	GCCycle	js/src/jsgc.cpp:3179

Comment 9

[Wayne Mery (:wsmwk)]

I'm not so sure now that current linux and Mac thunderbird crashes are good match to what's happening in firefox

firefox 18
bp-c2db1774-71f7-47a4-a01e-a4bcd2130324
0	libxul.so	XPCWrappedNative::FlatJSObjectFinalized	xpcprivate.h:1615
1	libxul.so	WrappedNativeFinalize	XPCWrappedNativeJSOps.cpp:617
2	libxul.so	js::gc::FinalizeArenas	jsobjinlines.h:234
3	libxul.so	js::gc::ArenaLists::queueObjectsForSweep	jsgc.cpp:1660
4	libxul.so	BeginSweepPhase	jsgc.cpp:3865
5	libxul.so	IncrementalCollectSlice	jsgc.cpp:4362
6	libxul.so	GCCycle	jsgc.cpp:4540
7	libxul.so	Collect	jsgc.cpp:4655
8	libxul.so	js::IncrementalGC	jsfriendapi.cpp:172

Comment 10

[Wayne Mery (:wsmwk)]

As a firefox crash, this signature is gone for current versions, so => WFM
https://crash-stats.mozilla.com/signature/?product=Firefox&signature=XPCWrappedNative%3A%3AFlatJSObjectFinalized&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_sort=-version&_sort=-date&page=1

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'XPCWrappedNative::FlatJSObjectFinalized':
 - nightly (version 51): 1 crash from 2016-08-01.
 - aurora  (version 50): 5 crashes from 2016-08-01.
 - beta    (version 49): 71 crashes from 2016-08-02.
 - release (version 48): 2 crashes from 2016-07-25.
 - esr     (version 45): 4 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       0       0       1
 - aurora        2       1       1
 - beta         17      28      10
 - release       1       0       0
 - esr           0       0       0

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora  #1099
 - beta    #759      #1858
 - release #15254
 - esr