Closed Bug 704488 Opened 8 years ago Closed 3 years ago

Firefox 9.0 Crash @ je_free | mozutils.dll@0x2...

Categories

(Core :: JavaScript Engine, defect, critical)

9 Branch
x86
Windows 7
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox9 + ---

People

(Reporter: marcia, Unassigned)

References

Details

(Keywords: crash, regression)

Crash Data

Seen while looking at the Firefox 9 explosive report. 200 crashes and all have the B2 build ID: 2011111600. https://crash-stats.mozilla.com/report/list?signature=je_free%20|%20mozutils.dll@0x2a9f.

We should watch this signature to see if it appears in B3.

https://crash-stats.mozilla.com/report/index/f1119420-444e-4dae-b999-457902111122

Frame 	Module 	Signature [Expand] 	Source
0 	mozutils.dll 	je_free 	memory/jemalloc/jemalloc.c:6260
1 	mozutils.dll 	mozutils.dll@0x2a9f 	
2 	mozjs.dll 	js::types::TypeScript::destroy 	js/src/jsinfer.cpp:6095
3 	mozjs.dll 	JSCompartment::sweep 	js/src/jscompartment.cpp:645
4 	mozjs.dll 	SweepPhase 	js/src/jsgc.cpp:2313
5 	mozjs.dll 	MarkAndSweep 	js/src/jsgc.cpp:2406
6 	mozjs.dll 	GCCycle 	js/src/jsgc.cpp:2649
7 	mozjs.dll 	js::MaybeGC 	js/src/jsgc.cpp:1986
8 	mozjs.dll 	JS_MaybeGC 	js/src/jsapi.cpp:2635
9 	xul.dll 	nsJSContext::ScriptEvaluated 	dom/base/nsJSEnvironment.cpp:3094
10 	xul.dll 	nsCxPusher::Pop 	content/base/src/nsContentUtils.cpp:2682
11 	xul.dll 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:1955
12 	xul.dll 	nsGlobalWindow::QueryInterface 	dom/base/nsGlobalWindow.cpp:1369
13 	xul.dll 	nsJSArgArray::Release 	dom/base/nsJSEnvironment.cpp:3935
14 	xul.dll 	nsRefPtr<nsIDOMEventListener>::~nsRefPtr<nsIDOMEventListener> 	obj-firefox/dist/include/nsAutoPtr.h:907
15 	xul.dll 	nsJSScriptTimeoutHandler::SetLateness 	dom/base/nsJSTimeoutHandler.cpp:368
16 		@0x158d35e3 	
17 	xul.dll 	nsHtml5TreeBuilder::elementPushed 	parser/html/nsHtml5TreeBuilderCppSupplement.h:466
18 		@0x128e77df
Crash Signature: [@ je_free | mozutils.dll@0x2a9f ]
It's #32 top crasher in 9.0b3.
Crash Signature: [@ je_free | mozutils.dll@0x2a9f ] → [@ je_free | mozutils.dll@0x2a3f ] [@ je_free | mozutils.dll@0x2a9f ] [@ je_free | mozutils.dll@0x2a0f ]
Summary: Firefox 9.0 Crash @ je_free | mozutils.dll@0x2a9f → Firefox 9.0 Crash @ je_free | mozutils.dll@0x2a..
This looks like an allocator mismatch.
It first appeared in 9.0a1/20110916030907.
The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=f2a2adaaacba&tochange=39b192706927
On the other hand, this could be generic memory corruption. https://crash-stats.mozilla.com/report/index/0216e870-f556-4ba8-917e-64a052111127 has nothing to do with js at all.
One comment says:
"I was customizing my google page when all my tabs closed out on me."
Crash Signature: [@ je_free | mozutils.dll@0x2a3f ] [@ je_free | mozutils.dll@0x2a9f ] [@ je_free | mozutils.dll@0x2a0f ] → [@ je_free | mozutils.dll@0x2a3f ] [@ je_free | mozutils.dll@0x2a9f ] [@ je_free | mozutils.dll@0x2a0f ] [@ je_free | mozutils.dll@0x2b0f ]
Summary: Firefox 9.0 Crash @ je_free | mozutils.dll@0x2a.. → Firefox 9.0 Crash @ je_free | mozutils.dll@0x2...
It's #24 top crasher in 9.0b4.
There's nothing interesting in correlations and comments.
Crash Signature: [@ je_free | mozutils.dll@0x2a3f ] [@ je_free | mozutils.dll@0x2a9f ] [@ je_free | mozutils.dll@0x2a0f ] [@ je_free | mozutils.dll@0x2b0f ] → [@ je_free | mozutils.dll@0x2a3f ] [@ je_free | mozutils.dll@0x2a9f ] [@ je_free | mozutils.dll@0x2a0f ] [@ je_free | mozutils.dll@0x2b0f ] [@ je_free | mozutils.dll@0x2a5f ]
It's at #68 on 9.0b5 so going down in volume.
(In reply to Sheila Mooney from comment #7)
> It's at #68 on 9.0b5 so going down in volume.
You can't compare rankings between a build with one week of history and 200K ADU (9.0b4), and a build with one day of history and 200K ADU (9.0b5):
https://crash-stats.mozilla.com/daily?form_selection=by_version&p=Firefox&v[]=9.0b4&throttle[]=10.00&v[]=9.0b5&throttle[]=10.00&v[]=&throttle[]=10.00&v[]=&throttle[]=10.00&hang_type=any&os[]=Windows&os[]=Mac&os[]=Linux&date_start=2011-11-27&date_end=2011-12-11&submit=Generate
Crash Signature: [@ je_free | mozutils.dll@0x2a3f ] [@ je_free | mozutils.dll@0x2a9f ] [@ je_free | mozutils.dll@0x2a0f ] [@ je_free | mozutils.dll@0x2b0f ] [@ je_free | mozutils.dll@0x2a5f ] → [@ je_free | mozutils.dll@0x2a3f ] [@ je_free | mozutils.dll@0x2a9f ] [@ je_free | mozutils.dll@0x2a0f ] [@ je_free | mozutils.dll@0x2b0f ] [@ je_free | mozutils.dll@0x2a5f ] [@ je_free | mozutils.dll@0x2a1f ]
Depends on: 711954
Assignee: general → nobody
I'm marking this bug as WORKSFORME as bug crashlog signature didn't appear from a long time (over half year) in Firefox (except some obsolete Fx <10).
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.