704488 - Firefox 9.0 Crash @ je_free | mozutils.dll@0x2...

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Marcia Knous [:marcia]]

Seen while looking at the Firefox 9 explosive report. 200 crashes and all have the B2 build ID: 2011111600. https://crash-stats.mozilla.com/report/list?signature=je_free%20|%20mozutils.dll@0x2a9f.

We should watch this signature to see if it appears in B3.

https://crash-stats.mozilla.com/report/index/f1119420-444e-4dae-b999-457902111122

Frame 	Module 	Signature [Expand] 	Source
0 	mozutils.dll 	je_free 	memory/jemalloc/jemalloc.c:6260
1 	mozutils.dll 	mozutils.dll@0x2a9f 	
2 	mozjs.dll 	js::types::TypeScript::destroy 	js/src/jsinfer.cpp:6095
3 	mozjs.dll 	JSCompartment::sweep 	js/src/jscompartment.cpp:645
4 	mozjs.dll 	SweepPhase 	js/src/jsgc.cpp:2313
5 	mozjs.dll 	MarkAndSweep 	js/src/jsgc.cpp:2406
6 	mozjs.dll 	GCCycle 	js/src/jsgc.cpp:2649
7 	mozjs.dll 	js::MaybeGC 	js/src/jsgc.cpp:1986
8 	mozjs.dll 	JS_MaybeGC 	js/src/jsapi.cpp:2635
9 	xul.dll 	nsJSContext::ScriptEvaluated 	dom/base/nsJSEnvironment.cpp:3094
10 	xul.dll 	nsCxPusher::Pop 	content/base/src/nsContentUtils.cpp:2682
11 	xul.dll 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:1955
12 	xul.dll 	nsGlobalWindow::QueryInterface 	dom/base/nsGlobalWindow.cpp:1369
13 	xul.dll 	nsJSArgArray::Release 	dom/base/nsJSEnvironment.cpp:3935
14 	xul.dll 	nsRefPtr<nsIDOMEventListener>::~nsRefPtr<nsIDOMEventListener> 	obj-firefox/dist/include/nsAutoPtr.h:907
15 	xul.dll 	nsJSScriptTimeoutHandler::SetLateness 	dom/base/nsJSTimeoutHandler.cpp:368
16 		@0x158d35e3 	
17 	xul.dll 	nsHtml5TreeBuilder::elementPushed 	parser/html/nsHtml5TreeBuilderCppSupplement.h:466
18 		@0x128e77df

Comment 1

[Scoobidiver (away)]

It's #32 top crasher in 9.0b3.

Comment 2

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

This looks like an allocator mismatch.

Comment 3

[Scoobidiver (away)]

It first appeared in 9.0a1/20110916030907.
The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=f2a2adaaacba&tochange=39b192706927

Comment 4

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

On the other hand, this could be generic memory corruption. https://crash-stats.mozilla.com/report/index/0216e870-f556-4ba8-917e-64a052111127 has nothing to do with js at all.

Comment 5

[Scoobidiver (away)]

One comment says:
"I was customizing my google page when all my tabs closed out on me."

Comment 6

[Scoobidiver (away)]

It's #24 top crasher in 9.0b4.
There's nothing interesting in correlations and comments.

Comment 7

[Sheila Mooney]

It's at #68 on 9.0b5 so going down in volume.

Comment 8

[Scoobidiver (away)]

(In reply to Sheila Mooney from comment #7)
> It's at #68 on 9.0b5 so going down in volume.
You can't compare rankings between a build with one week of history and 200K ADU (9.0b4), and a build with one day of history and 200K ADU (9.0b5):
https://crash-stats.mozilla.com/daily?form_selection=by_version&p=Firefox&v[]=9.0b4&throttle[]=10.00&v[]=9.0b5&throttle[]=10.00&v[]=&throttle[]=10.00&v[]=&throttle[]=10.00&hang_type=any&os[]=Windows&os[]=Mac&os[]=Linux&date_start=2011-11-27&date_end=2011-12-11&submit=Generate

Comment 9

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

I'm marking this bug as WORKSFORME as bug crashlog signature didn't appear from a long time (over half year) in Firefox (except some obsolete Fx <10).