Closed Bug 622411 Opened 14 years ago Closed 13 years ago

top crash [@ nsCycleCollector::MarkRoots(GCGraphBuilder&)]

Categories

(Core :: XPCOM, defect)

defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 531961

People

(Reporter: wsmwk, Unassigned)

References

()

Details

(Keywords: crash, topcrash)

Crash Data

+++ This bug was initially created as a clone of Bug #437449 +++ Can someone clear the status1.9.2 and status1.9.1 fields please? Still many such crashes in 1.9.2 and on trunk after bug 437449. I've filed this because bug 531961 is marked as being for 1.9.1. ranks #22 for FF 3.6.13 Don't know which of the following stacks is most common. Nor did I determine which might overlap bug 551163 bp-caff67f9-b708-4bdf-8573-603992110101 FF 3.6.13 EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE 0x6 0 XUL nsCycleCollector::MarkRoots xpcom/base/nsCycleCollector.cpp:1389 1 XUL nsCycleCollector::BeginCollection xpcom/base/nsCycleCollector.cpp:2554 2 XUL XPCCycleCollectGCCallback js/src/xpconnect/src/nsXPConnect.cpp:391 3 libmozjs.dylib js_GC js/src/jsgc.cpp:3537 4 XUL nsXPConnect::Collect js/src/xpconnect/src/nsXPConnect.cpp:478 5 XUL nsCycleCollector::Collect xpcom/base/nsCycleCollector.cpp:2434 6 XUL nsUserActivityObserver::Observe dom/base/nsJSEnvironment.cpp:3641 7 XUL nsObserverList::NotifyObservers xpcom/ds/nsObserverList.cpp:130 8 XUL nsObserverService::NotifyObservers xpcom/ds/nsObserverService.cpp:182 9 XUL nsUITimerCallback::Notify content/events/src/nsEventStateManager.cpp:285 10 XUL nsTimerImpl::Fire xpcom/threads/nsTimerImpl.cpp:430 11 XUL nsTimerEvent::Run xpcom/threads/nsTimerImpl.cpp:519 12 XUL nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:527 13 XUL NS_ProcessPendingEvents_P nsThreadUtils.cpp:200 14 XUL nsBaseAppShell::NativeEventCallback widget/src/xpwidgets/nsBaseAppShell.cpp:125 15 XUL nsAppShell::ProcessGeckoEvents widget/src/cocoa/nsAppShell.mm:425 bp-95745368-ae2f-4eb0-9ba0-bfa7e2110101 EXCEPTION_ACCESS_VIOLATION_READ 0xa 0 xul.dll nsCycleCollector::MarkRoots 1 mozcrt19.dll free obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:6017 2 xul.dll nsPurpleBuffer::FreeBlocks xpcom/base/nsCycleCollector.cpp:738 3 xul.dll nsPurpleBuffer::SelectPointers xpcom/base/nsCycleCollector.cpp:917 4 xul.dll xul.dll@0xabe8b7 5 xul.dll nsCycleCollector::BeginCollection xpcom/base/nsCycleCollector.cpp:2554 6 iertutil.dll iertutil.dll@0x17000d 7 xul.dll XPCCycleCollectGCCallback js/src/xpconnect/src/nsXPConnect.cpp:391 8 js3250.dll js_GC js/src/jsgc.cpp:3537 9 xul.dll nsHTMLLinkElement::BindToTree content/html/content/src/nsHTMLLinkElement.cpp:213 10 nspr4.dll PR_Lock nsprpub/pr/src/threads/combined/prulock.c:233 bp-b74baa27-e767-4664-a619-7c6ee2110102 FF 4.0b8 EXCEPTION_ACCESS_VIOLATION_READ 0x2 0 xul.dll nsCycleCollector::MarkRoots xpcom/base/nsCycleCollector.cpp:1766 1 xul.dll nsCycleCollector::BeginCollection xpcom/base/nsCycleCollector.cpp:2644 2 xul.dll nsCycleCollectorRunner::Run xpcom/base/nsCycleCollector.cpp:3323 3 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:626 4 xul.dll nsThreadStartupEvent::`scalar deleting destructor' bp-c12dee88-9acb-4d6b-8da7-8a0112110102 EXCEPTION_ACCESS_VIOLATION_READ 0xffffffffb068086a 0 @0xb068086a 1 xul.dll nsCycleCollector::MarkRoots xpcom/base/nsCycleCollector.cpp:1611 2 xul.dll nsCycleCollector::BeginCollection xpcom/base/nsCycleCollector.cpp:2554 3 xul.dll XPCCycleCollectGCCallback js/src/xpconnect/src/nsXPConnect.cpp:391 4 js3250.dll js_GC js/src/jsgc.cpp:3537 5 js3250.dll JS_GC js/src/jsapi.cpp:2439 6 xul.dll nsXPConnect::Collect js/src/xpconnect/src/nsXPConnect.cpp:478 7 xul.dll nsCycleCollector::Collect xpcom/base/nsCycleCollector.cpp:2421
Priority: P2 → --
It is #21 top crasher in 4.0b12 and #24 in 3.6.13 (see bug 531961). Is it a dupe of bug 531961?
This crash has a somewhat high correlation to the Ask Toolbar - 53% (8/15) vs. 7% (12070/173285) toolbar@ask.com
#31 on 5.0 on its current beta state...
Crash Signature: [@ nsCycleCollector::MarkRoots(GCGraphBuilder&)]
It is now #8 top crasher in 6.0b2 and #18 top crasher in 5.0. Dupe of bug 531961?
(In reply to comment #4) > Dupe of bug 531961? as noted in comment 0, "I've filed this because bug 531961 is marked as being for 1.9.1." (which I admit is a rather weak reason for filing a separate bug). I also filed a separate bug because there didn't seem to be much interest in bug 531961 in it's 1.5 year life as a topcrash, plus there are multiple stacks for this signature (as noted in comment 0), so multiple bug reports may be needed anyway. Someone needs to do more digging here and in bug 531961 to find a testcase (there are plenty of people reporting crashes with their email address) and determine whether the multiple stacks have the same root cause - something I don't have time to do ATM. @0x0 | nsCycleCollector::MarkRoots(GCGraphBuilder&) is another signature. Lastly, there are no crashes yet for this for Thunderbird 5. But we probably need 2-3x more users on version 5 before declaring that Thunderbird crashes only happen for v3
Crash Signature: [@ nsCycleCollector::MarkRoots(GCGraphBuilder&)] → [@ nsCycleCollector::MarkRoots(GCGraphBuilder&)] [@ @0x0 | nsCycleCollector::MarkRoots(GCGraphBuilder&) ]
This signature shows up Linux-only, but is presumably the same thing.
Crash Signature: [@ nsCycleCollector::MarkRoots(GCGraphBuilder&)] [@ @0x0 | nsCycleCollector::MarkRoots(GCGraphBuilder&) ] → [@ nsCycleCollector::MarkRoots(GCGraphBuilder&)] [@ @0x0 | nsCycleCollector::MarkRoots(GCGraphBuilder&) ] [@ nsCycleCollector::MarkRoots ]
There seems to be a user sending such crashes in bug 695029, but he is on Windows.
Depends on: 695029
Keywords: topcrash
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
No longer depends on: 695029
You need to log in before you can comment on or make changes to this bug.