Closed Bug 686441 Opened 8 years ago Closed 7 years ago

Crash in JSLinearString::mark(JSTracer*) or JSString::mark(JSTracer*) mainly with Better Facebook


(Core :: JavaScript Engine, defect, critical)

6 Branch
Windows 7
Not set





(Reporter: w9wdxzaj2n, Unassigned)


(Keywords: crash)

Crash Data

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0.2) Gecko/20100101 Firefox/6.0.2
Build ID: 20110902133214

Steps to reproduce:

I had the Facebook home page open ( but was not actively doing anything in Firefox at all and Firefox crashed.  See it listed as the #2 crash URL here:
This report is for the #4 and #15 crash signatures for that URL.  I think the two crash signatures are correlated as they are very similar and both correlate with Facebook.
This may also be related to, where the reporter is using Facebook chat (I was not though), although it was reported as Linux originally (, and another commenter posted that it was #7 top crash on Mac/OS (

This is my first bugzilla report so excuse my reporting inadequacies.  Maybe this is XPConnect issue rather than Core JavaScript - I can't tell.  If it, please change it, or ask me to.
Severity: normal → critical
Crash Signature: [@ JSLinearString::mark(JSTracer*) ] [@ JSString::mark(JSTracer*) ]
Confirming this based on data in crash stats. Also see related Bug 687001 which appears to be the Mac version of this signature.

Reporter: Are you using the Better Facebook extension?
Ever confirmed: true
I am actually using the Greasemonkey add-on, running the Better Facebook script. So it's pure javascript. Not something that should be able to cause a crash! But, yes, I've looked at your bug and it does appear highly correlated.

However, the crash may have stopped for me a couple of days ago?  My most recent crash is
Maybe Facebook changed something in their code?  Facebook usually gradually roll out changes to their users (I got a new Facebook home page (newsfeed page) today) so others may be continuing to see the crash.
But... I also got this crash when I was logging into (or unlocking my) Yahoo Mail (session):
Could be a coincidence that I happened to be doing that when it crashed, or it could be that this javascript intensive moment precipitated a crash from a Facebook tab that I probably had open. The above crash report does not any "Related Bugs" in it though. But the stack trace is almost identical as my other 5, just missing frame 0 JSLinearString::mark, and everything else pushed up by 1.
It's #21 top crasher in 7.0.1 and #20 in 8.0b1.

There's an extension correlation in 7.0.1:
  JSLinearString::mark(JSTracer*)|EXCEPTION_ACCESS_VIOLATION_READ (236 crashes)
       79% (187/236) vs.   1% (406/57390)
          0% (0/236) vs.   0% (1/57390) 5.852
          0% (0/236) vs.   0% (2/57390) 5.911
          1% (2/236) vs.   0% (3/57390) 5.921
        42% (98/236) vs.   0% (228/57390) 5.931
        37% (87/236) vs.   0% (172/57390) 5.941
Summary: Crash in JSLinearString::mark(JSTracer*) or JSString::mark(JSTracer*) → Crash in JSLinearString::mark(JSTracer*) or JSString::mark(JSTracer*) mainly with Better Facebook
Keywords: crash
Hardware: x86_64 → x86
I don't see high correlations to BetterFacebook in 19.0.2 for any crash signatures:

Based on comment 5 and this comment, I close the bugs as workforme.
Closed: 7 years ago
Flags: needinfo?(scoobidiver)
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.