691784 - crash XPCJSStackFrame::Release

Status: RESOLVED DUPLICATE of bug 667915

(Core :: JavaScript Engine, defect)

Description

[Marius Strumyla]

Attachment: Stacktraces captured 2011-10-04

This bug was filed from the Socorro interface and is 
report bp-07df0710-619b-47d7-856b-860a32111004 .
============================================================= 

This happened to me several times. When I leave firefox overnight and come back the next morning, I cannot resume my old sessions. Firefox 7.0.1 goes into the loop of consuming 50% CPU and its windows are never restored.

When I look at the sysinternal's process monitor, firefox.exe main process' Virtual Memory memory consumption jumps between 580Mb and 760Mb every second. It could show 580Mb one second then 760Mb the next second, then somewhere in the 600s Mb then again in the 500s Mb etc.

I left firefox run for 30 minutes before it crashed. Usually I kill it earlier. Process Monitor gave me several "Insufficient system resources" messages before FF crashed.

While FF was consuming the CPU, I saved several stack traces.

0:000> cdb: Reading initial command '~~[0x6848]kf200;q'
  Memory  ChildEBP RetAddr
          0012afe4 01116651 mozjs!js_PCToLineNumber+0xf5
       14 0012aff8 010b61ab mozjs!js_FramePCToLineNumber+0x51
       8c 0012b084 010b68e0 mozjs!InitExnPrivate+0x39b
       5c 0012b0e0 010981e9 mozjs!js_ErrorToException+0x190
       1c 0012b0fc 010990e9 mozjs!ReportError+0x39
       4c 0012b148 01084232 mozjs!js_ReportErrorNumberVA+0xb9
       20 0012b168 01098407 mozjs!JS_ReportErrorNumber+0x22
       14 0012b17c 011411e1 mozjs!js_ReportOverRecursed+0x17
        c 0012b188 011418fa mozjs!js::StackSpace::bumpCommit+0x21
       1c 0012b1a4 01141bac mozjs!js::ContextStack::ensureOnTop+0x7a
       24 0012b1c8 0112f928 mozjs!js::ContextStack::pushDummyFrame+0x1c
       14 0012b1dc 0108a1cb mozjs!js::AutoCompartment::enter+0x48
        c 0012b1e8 0108a42d mozjs!JS_EnterCrossCompartmentCall+0x5b
       14 0012b1fc 0130ac72 mozjs!JS::AutoEnterFrameCompartment::enter+0x6d
       48 0012b244 0130395d xul!XPCJSStackFrame::CreateStack+0xf2
       20 0012b264 012f78db xul!nsXPConnect::GetCurrentJSStack+0xcd
       3c 0012b2a0 012692a0 xul!nsXPCException::NewException+0xbb
       b8 0012b358 01b34442 xul!XPCConvert::ConstructException+0xe5
      178 0012b4d0 016610e6 xul!XPCConvert::JSErrorToXPCException+0x162
       60 0012b530 0142c6ec xul!XPCConvert::JSValToXPCException+0x21563c
      1b4 0012b6e4 0130e1a1 xul!nsXPCWrappedJSClass::CheckForException+0xd1
      2b0 0012b994 012ec7b6 xul!nsXPCWrappedJSClass::CallMethod+0x1371
       28 0012b9bc 0152830e xul!nsXPCWrappedJS::CallMethod+0x56
       b4 0012ba70 01528378 xul!PrepareAndDispatch+0xe8
       1c 0012ba8c 01bcd348 xul!SharedStub+0x16
       b0 0012bb3c 0177ee41 xul!jsds_ErrorHookProc+0x111
       30 0012bb6c 0109820f xul!jsd_DebugErrorHook+0x55
       18 0012bb84 010990e9 mozjs!ReportError+0x5f
       4c 0012bbd0 01084232 mozjs!js_ReportErrorNumberVA+0xb9
       20 0012bbf0 01098407 mozjs!JS_ReportErrorNumber+0x22
       14 0012bc04 011411e1 mozjs!js_ReportOverRecursed+0x17
        c 0012bc10 01141665 mozjs!js::StackSpace::bumpCommit+0x21
       14 0012bc24 011aeef1 mozjs!js::StackSpace::tryBumpLimit+0x25
       38 0012bc5c 011af33e mozjs!UncachedInlineCall+0x71
       34 0012bc90 011af98e mozjs!js::mjit::stubs::UncachedCallHelper+0x8e
       24 0012bcb4 010d8485 mozjs!js::mjit::stubs::UncachedCall+0xe
       3c 0012bcf0 01174523 mozjs!js::Shape::get+0xc5
       44 0012bd34 010cc90c mozjs!js::mjit::EnterMethodJIT+0x33
      574 0012c2a8 011af0f1 mozjs!js::Interpret+0x56cc
       34 0012c2dc 011af33e mozjs!UncachedInlineCall+0x271
       34 0012c310 011af98e mozjs!js::mjit::stubs::UncachedCallHelper+0x8e
       24 0012c334 010d8485 mozjs!js::mjit::stubs::UncachedCall+0xe
       98 0012c3cc 0152830e mozjs!js::Shape::get+0xc5
       d8 0012c4a4 0131262c xul!PrepareAndDispatch+0xe8
       40 0012c4e4 0130f507 xul!CallMethodHelper::~CallMethodHelper+0xbc
        4 0012c4e8 00000000 xul!XPC_WN_CallMethod+0x967
quit:

Comment 1

[Marius Strumyla]

Attachment: Stacktraces captured 2011-09-30

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

This looks sorta like that bug from before. Was that fixed in 7?

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Oops, I just found it: bug 676934. The fix went into Firefox 9. Luke, do you think this looks like a dupe?

Comment 4

[Luke Wagner [:luke]]

Yes, it does.

Comment 5

[Luke Wagner [:luke]]

Actually, no.  On the stack it looks like content OOMs, that runs Firebug code which OOMs, and then it tries to report that exception, which OOMs and this all probably involves walking the stack a bunch of times.  I think FF7 is when the stackLimit when away and thus made it easier to get 50K-tall call stacks.  This OOM-while-handling-OOM problem should be addressed by bug 667915 which is currently in beta.

Comment 6

[Marius Strumyla]

OOM does sound like what might be a problem for me. 

I compile various open source projects using MSYS tools. If I recompile ffmpeg and libfaac a couple of times, eventually sh.exe from MSYS tools starts crashing and dumping core. I've read that Symantec Antivirus and MSYS do not play together very well. Eventually I may not be able to access shared drives etc. I start getting "Not enough resources" messages. I have to reboot my PC at this point (logout and log back in does not help).

I think that is when I might see FF jump to 50% of CPU when I try to do some browsing.

Comment 7

[Luke Wagner [:luke]]

Oops, I should have been more specific: I meant "runs out of stack space" which is different than exhausting heap memory.  function foo() { foo(); } is all it takes to exhaust stack space.

Do you get any hangs with this stack on mozilla-beta?

Comment 8

[Marius Strumyla]

I will try to run a beta version for a couple of days. I will report back.

Comment 9

[Marius Strumyla]

I hit the CPU thing today with FF 8.0 beta. It took browser 10-15 seconds before I got unresponsive script warning. I stopped the script and everything seems ok.

Btw, it is always accessing this website http://www.lrt.lt when FF/Firebug has trouble.

Comment 10

[Marius Strumyla]

Attachment: FF 8.0 beta unresponsive script dialog