633668 - Crash in [@ DoDeferredRelease<nsISupports*>]

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-c6768ef4-9e11-4328-a477-583e02110205 .
============================================================= 

Happens with Firefox 4.0b12pre and betas, but also with 3.6.x branch. http://tinyurl.com/4jrhuf8 to the reports which are all Windows. 832 crash reports in the past week across all branches.

Trunk stack looks like:

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	DoDeferredRelease<nsISupports*> 	js/src/xpconnect/src/xpcjsruntime.cpp:623
1 	xul.dll 	DeleteInsertionPointEntry 	content/xbl/src/nsXBLPrototypeBinding.cpp:1194
2 	xul.dll 	XPCJSRuntime::GCCallback 	js/src/xpconnect/src/xpcjsruntime.cpp:932
3 	xul.dll 	DeleteInsertionPointEntry 	content/xbl/src/nsXBLPrototypeBinding.cpp:1194
4 	xul.dll 	nsXPConnect::Collect 	js/src/xpconnect/src/nsXPConnect.cpp:407

Sample Branch stack:

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	DoDeferredRelease<nsISupports*> 	js/src/xpconnect/src/xpcjsruntime.cpp:489
1 	xul.dll 	XPCJSRuntime::GCCallback 	js/src/xpconnect/src/xpcjsruntime.cpp:760
2 	xul.dll 	nsCycleCollector::FinishCollection 	xpcom/base/nsCycleCollector.cpp:2641
3 	xul.dll 	DOMGCCallback 	dom/base/nsJSEnvironment.cpp:3827
4 	js3250.dll 	js_GC 	js/src/jsgc.cpp:3822
5 	xul.dll 	nsHTMLLinkElement::BindToTree 	content/html/content/src/nsHTMLLinkElement.cpp:213
6 	xul.dll 	XPCCallContext::XPCCallContext 	js/src/xpconnect/src/xpccallcontext.cpp:64
7 	js3250.dll 	JS_GC 	js/src/jsapi.cpp:2439
8 	xul.dll 	nsVoidArray::~nsVoidArray 	obj-firefox/xpcom/build/nsVoidArray.cpp:376
9 	xul.dll 	xul.dll@0x9d8ab7 	
10 	xul.dll 	nsCOMArray_base::~nsCOMArray_base 	obj-firefox/xpcom/build/nsCOMArray.cpp:59
11 	xul.dll 	nsObserverService::NotifyObservers 	xpcom/ds/nsObserverService.cpp:185
12 	xul.dll 	nsCycleCollector::Collect 	xpcom/base/nsCycleCollector.cpp:2421
13 	xul.dll 	nsJSContext::CC 	dom/base/nsJSEnvironment.cpp:3641
14 	xul.dll 	nsJSContext::IntervalCC 	dom/base/nsJSEnvironment.cpp:3729
15 	xul.dll 	GCTimerFired 	dom/base/nsJSEnvironment.cpp:3755
16 	xul.dll 	nsTArray<nsString>::AppendElements<nsString> 	obj-firefox/dist/include/nsTArray.h:621
17 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:519
18 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
19 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:199
20 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:173
21 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:174
22 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:183
23 	nspr4.dll 	nspr4.dll@0xd94f 	
24 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:120
25 	firefox.exe 	__tmainCRTStartup 	obj-firefox/memory/jemalloc/crtsrc/crtexe.c:591
26 	kernel32.dll 	BaseThreadInitThunk 	
27 	ntdll.dll 	__RtlUserThreadStart 	
28 	ntdll.dll 	_RtlUserThreadStart

Comment 1

[Wayne Mery (:wsmwk)]

most crashes for current crashes are after GC. 
And I didn't find any crashes that match stacks of comment 0

WFM?

And for those crashes that remain, is DoDeferredRelease just a blameless victim ?

for example bp-0f975152-a663-4106-a6fd-c62ba2130718
0	xul.dll	DoDeferredRelease<nsISupports *>	js/xpconnect/src/XPCJSRuntime.cpp
1	xul.dll	XPCJSRuntime::GCCallback(JSRuntime *,JSGCStatus)	js/xpconnect/src/XPCJSRuntime.cpp
2	mozjs.dll	Collect	js/src/jsgc.cpp
3	mozjs.dll	js::GCSlice(JSRuntime *,js::JSGCInvocationKind,JS::gcreason::Reason,__int64)	js/src/jsgc.cpp
4	mozjs.dll	JS::IncrementalGC(JSRuntime *,JS::gcreason::Reason,__int64)	js/src/jsfriendapi.cpp
5	xul.dll	nsJSContext::GarbageCollectNow(JS::gcreason::Reason,nsJSContext::IsIncremental,nsJSContext::IsCompartment,nsJSContext::IsShrinking,__int64)	dom/base/nsJSEnvironment.cpp
6	xul.dll	GCTimerFired(nsITimer *,void *)	dom/base/nsJSEnvironment.cpp
7	xul.dll	nsTimerImpl::Fire()	xpcom/threads/nsTimerImpl.cpp

Comment 2

[Scoobidiver (away)]

(In reply to Wayne Mery (:wsmwk) from comment #1)
> And I didn't find any crashes that match stacks of comment 0
Let's use this generic bug for the current stack trace.

More reports at:
https://crash-stats.mozilla.com/report/list?signature=DoDeferredRelease%3CnsISupports*%3E

Comment 3

[Wayne Mery (:wsmwk)]

The most common stack for versions 21 and newer (maybe 30%?) appear to be startup crashes of the form

bp-6bca0190-1643-45f0-b7e0-673f32130719
0	xul.dll	DoDeferredRelease<nsISupports *>	js/xpconnect/src/XPCJSRuntime.cpp
1	xul.dll	XPCJSRuntime::GCCallback(JSRuntime *,JSGCStatus)	js/xpconnect/src/XPCJSRuntime.cpp
2	mozjs.dll	Collect	js/src/jsgc.cpp
3	mozjs.dll	js::GCSlice(JSRuntime *,js::JSGCInvocationKind,JS::gcreason::Reason,__int64)	js/src/jsgc.cpp
4	mozjs.dll	JS::IncrementalGC(JSRuntime *,JS::gcreason::Reason,__int64)	js/src/jsfriendapi.cpp
5	xul.dll	nsJSContext::GarbageCollectNow(JS::gcreason::Reason,nsJSContext::IsIncremental,nsJSContext::IsCompartment,nsJSContext::IsShrinking,__int64)	dom/base/nsJSEnvironment.cpp
6	xul.dll	GCTimerFired(nsITimer *,void *)	dom/base/nsJSEnvironment.cpp
7	xul.dll	nsTimerImpl::Fire()	xpcom/threads/nsTimerImpl.cpp
8	nss3.dll	nss3.dll@0xa950	

more examples
bp-ec9494da-0c56-47fe-9875-9af872130722
bp-cbe4e54a-2b5c-4ac8-857b-9f0b52130716

Stack of lesser frequency is 
bp-9cef02af-139c-4fea-8ae1-059822130728 nspr4.dll nspr4.dll@0x8d20

Comment 4

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/message/reply/question/etc.)]

I'm marking this bug as WORKSFORME as bug crashlog signature didn't appear from a long time (over half year) in Firefox (except some obsolete Fx <18).