682616 - Crash, null pointer deref [@ nsCycleCollector::MarkRoots ]

Status: RESOLVED DUPLICATE of bug 622411

(Core :: XPCOM, defect)

Description

[Benoit Jacob [:bjacob] (mostly away)]

This is the 10th top Firefox 8.0a2 / Linux crasher last week with 3 crashes on 2 different distros.

https://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A8.0a2&platform=linux&query_search=signature&query_type=contains&reason_type=contains&date=&range_value=1&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=nsCycleCollector%3A%3AMarkRoots

Here's one crash report:

https://crash-stats.mozilla.com/report/index/caceffd3-1297-44ad-8cea-d99342110826

We're dereferencing null here:

http://hg.mozilla.org/releases/mozilla-aurora/annotate/3aba81100f4f/xpcom/base/nsCycleCollector.cpp#l1618

Comment 1

[Benoit Jacob [:bjacob] (mostly away)]

This code was last touched by

http://hg.mozilla.org/releases/mozilla-beta/rev/b79cf02287c6

-> bug 646574

Comment 2

[Benoit Jacob [:bjacob] (mostly away)]

Oops, wrong bug. Ignore comment 1, sorry.

Comment 3

[Robert Kaiser]

https://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=nsCycleCollector::MarkRoots says this is a low-volume crash that has been around since 3.6 but it seems to be Linux-specific with this particular signature.

Cycle collector isn't JS though, I think it belongs into XPCOM, but mmcr8 probably knows more.

Comment 4

[Andrew McCreight [:mccr8]]

Yup, XPCOM.  This looks like Bug 531961 and Bug 622411 to me.  It is just showing up differently in the call stacks on Linux, I guess.  I'll add that signature. Overall, about half of them show up as null-pointer derefs.  These crashes have been around for a few years, but we've never had any kind of reproducible test case.