top crash [@ nsCycleCollector::MarkRoots(GCGraphBuilder&)]

RESOLVED DUPLICATE of bug 531961

Status

()

--
critical
RESOLVED DUPLICATE of bug 531961
8 years ago
7 years ago

People

(Reporter: wsmwk, Unassigned)

Tracking

({crash, topcrash})

Trunk
crash, topcrash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

(Reporter)

Description

8 years ago
+++ This bug was initially created as a clone of Bug #437449 +++
Can someone clear the status1.9.2 and status1.9.1 fields please?

Still many such crashes in 1.9.2 and on trunk after bug 437449. 
I've filed this because bug 531961 is marked as being for 1.9.1.
ranks #22 for FF 3.6.13

Don't know which of the following stacks is most common.
Nor did I determine which might overlap bug 551163

bp-caff67f9-b708-4bdf-8573-603992110101 FF 3.6.13
EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE
0x6
0	XUL	nsCycleCollector::MarkRoots	xpcom/base/nsCycleCollector.cpp:1389
1	XUL	nsCycleCollector::BeginCollection	xpcom/base/nsCycleCollector.cpp:2554
2	XUL	XPCCycleCollectGCCallback	js/src/xpconnect/src/nsXPConnect.cpp:391
3	libmozjs.dylib	js_GC	js/src/jsgc.cpp:3537
4	XUL	nsXPConnect::Collect	js/src/xpconnect/src/nsXPConnect.cpp:478
5	XUL	nsCycleCollector::Collect	xpcom/base/nsCycleCollector.cpp:2434
6	XUL	nsUserActivityObserver::Observe	dom/base/nsJSEnvironment.cpp:3641
7	XUL	nsObserverList::NotifyObservers	xpcom/ds/nsObserverList.cpp:130
8	XUL	nsObserverService::NotifyObservers	xpcom/ds/nsObserverService.cpp:182
9	XUL	nsUITimerCallback::Notify	content/events/src/nsEventStateManager.cpp:285
10	XUL	nsTimerImpl::Fire	xpcom/threads/nsTimerImpl.cpp:430
11	XUL	nsTimerEvent::Run	xpcom/threads/nsTimerImpl.cpp:519
12	XUL	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:527
13	XUL	NS_ProcessPendingEvents_P	nsThreadUtils.cpp:200
14	XUL	nsBaseAppShell::NativeEventCallback	widget/src/xpwidgets/nsBaseAppShell.cpp:125
15	XUL	nsAppShell::ProcessGeckoEvents	widget/src/cocoa/nsAppShell.mm:425 


bp-95745368-ae2f-4eb0-9ba0-bfa7e2110101
EXCEPTION_ACCESS_VIOLATION_READ
0xa
0	xul.dll	nsCycleCollector::MarkRoots	
1	mozcrt19.dll	free	obj-firefox/memory/jemalloc/crtsrc/jemalloc.c:6017
2	xul.dll	nsPurpleBuffer::FreeBlocks	xpcom/base/nsCycleCollector.cpp:738
3	xul.dll	nsPurpleBuffer::SelectPointers	xpcom/base/nsCycleCollector.cpp:917
4	xul.dll	xul.dll@0xabe8b7	
5	xul.dll	nsCycleCollector::BeginCollection	xpcom/base/nsCycleCollector.cpp:2554
6	iertutil.dll	iertutil.dll@0x17000d	
7	xul.dll	XPCCycleCollectGCCallback	js/src/xpconnect/src/nsXPConnect.cpp:391
8	js3250.dll	js_GC	js/src/jsgc.cpp:3537
9	xul.dll	nsHTMLLinkElement::BindToTree	content/html/content/src/nsHTMLLinkElement.cpp:213
10	nspr4.dll	PR_Lock	nsprpub/pr/src/threads/combined/prulock.c:233 

bp-b74baa27-e767-4664-a619-7c6ee2110102  FF 4.0b8
EXCEPTION_ACCESS_VIOLATION_READ
0x2
0	xul.dll	nsCycleCollector::MarkRoots	xpcom/base/nsCycleCollector.cpp:1766
1	xul.dll	nsCycleCollector::BeginCollection	xpcom/base/nsCycleCollector.cpp:2644
2	xul.dll	nsCycleCollectorRunner::Run	xpcom/base/nsCycleCollector.cpp:3323
3	xul.dll	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:626
4	xul.dll	nsThreadStartupEvent::`scalar deleting destructor'

bp-c12dee88-9acb-4d6b-8da7-8a0112110102
EXCEPTION_ACCESS_VIOLATION_READ
0xffffffffb068086a
0		@0xb068086a	
1	xul.dll	nsCycleCollector::MarkRoots	xpcom/base/nsCycleCollector.cpp:1611
2	xul.dll	nsCycleCollector::BeginCollection	xpcom/base/nsCycleCollector.cpp:2554
3	xul.dll	XPCCycleCollectGCCallback	js/src/xpconnect/src/nsXPConnect.cpp:391
4	js3250.dll	js_GC	js/src/jsgc.cpp:3537
5	js3250.dll	JS_GC	js/src/jsapi.cpp:2439
6	xul.dll	nsXPConnect::Collect	js/src/xpconnect/src/nsXPConnect.cpp:478
7	xul.dll	nsCycleCollector::Collect	xpcom/base/nsCycleCollector.cpp:2421
(Reporter)

Updated

8 years ago
status1.9.1: wanted → ---
status1.9.2: beta5-fixed → ---
Priority: P2 → --

Comment 1

8 years ago
It is #21 top crasher in 4.0b12 and #24 in 3.6.13 (see bug 531961).
Is it a dupe of bug 531961?
This crash has a somewhat high correlation to the Ask Toolbar -

53% (8/15) vs.   7% (12070/173285) toolbar@ask.com

Comment 3

7 years ago
#31 on 5.0 on its current beta state...
(Assignee)

Updated

7 years ago
Crash Signature: [@ nsCycleCollector::MarkRoots(GCGraphBuilder&)]

Comment 4

7 years ago
It is now #8 top crasher in 6.0b2 and #18 top crasher in 5.0.

Dupe of bug 531961?
(Reporter)

Comment 5

7 years ago
(In reply to comment #4)
> Dupe of bug 531961?

as noted in comment 0, "I've filed this because bug 531961 is marked as being for 1.9.1." (which I admit is a rather weak reason for filing a separate bug). I also filed a separate bug because there didn't seem to be much interest in bug 531961 in it's 1.5 year life as a topcrash, plus there are multiple stacks for this signature (as noted in comment 0), so multiple bug reports may be needed anyway.

Someone needs to do more digging here and in bug 531961 to find a testcase (there are plenty of people reporting crashes with their email address) and determine whether the multiple stacks have the same root cause - something I don't have time to do ATM.  

@0x0 | nsCycleCollector::MarkRoots(GCGraphBuilder&) is another signature.

Lastly, there are no crashes yet for this for Thunderbird 5. But we probably need 2-3x more users on version 5 before declaring that Thunderbird crashes only happen for v3
Crash Signature: [@ nsCycleCollector::MarkRoots(GCGraphBuilder&)] → [@ nsCycleCollector::MarkRoots(GCGraphBuilder&)] [@ @0x0 | nsCycleCollector::MarkRoots(GCGraphBuilder&) ]
Duplicate of this bug: 682616
This signature shows up Linux-only, but is presumably the same thing.
Crash Signature: [@ nsCycleCollector::MarkRoots(GCGraphBuilder&)] [@ @0x0 | nsCycleCollector::MarkRoots(GCGraphBuilder&) ] → [@ nsCycleCollector::MarkRoots(GCGraphBuilder&)] [@ @0x0 | nsCycleCollector::MarkRoots(GCGraphBuilder&) ] [@ nsCycleCollector::MarkRoots ]

Comment 8

7 years ago
There seems to be a user sending such crashes in bug 695029, but he is on Windows.
Depends on: 695029

Updated

7 years ago
Keywords: topcrash
Firefox 9.0.1 crash report bp-673bd6fd-30bc-4376-b13f-1f58c2120121
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 531961

Updated

7 years ago
No longer depends on: 695029
You need to log in before you can comment on or make changes to this bug.