Closed Bug 725009 Opened 8 years ago Closed 3 years ago

crash in js::GCHelperThread::doSweep

Categories

(Core :: JavaScript Engine, defect, critical)

10 Branch
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: marcia, Unassigned)

References

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-1063c85f-5e35-4cc3-8696-35dbf2120205 .
============================================================= 

Seen while looking at 10 crash stats.  https://crash-stats.mozilla.com/report/list?signature=je_free%20|%20mozutils.dll%400x36ef. Currently ranks as #61 top browser crash and has no bug associated with it, so filing now.

Some addon correlations:

je_free | mozutils.dll@0x36ff|EXCEPTION_ACCESS_VIOLATION_READ (30 crashes)
     13% (4/30) vs.   3% (401/13378) mozilla_cc@internetdownloadmanager.com (IDM CC, https://addons.mozilla.org/addon/6973)
     17% (5/30) vs.  11% (1461/13378) {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} (Adblock Plus, https://addons.mozilla.org/addon/1865)
    100% (30/30) vs.  94% (12632/13378) {972ce4c6-7e08-4474-a285-3208198ce6fd} (Default, https://addons.mozilla.org/addon/8150)

One of the comments mentions Adobe, and the signature summary shows a high correlation to a "blank" version of flash.

Frame 	Module 	Signature [Expand] 	Source
0 	mozutils.dll 	je_free 	memory/jemalloc/jemalloc.c:6497
1 	mozutils.dll 	mozutils.dll@0x36ef 	
2 	mozjs.dll 	js::GCHelperThread::doSweep 	js/src/jsgc.cpp:2354
3 	mozjs.dll 	js::GCHelperThread::threadLoop 	js/src/jsgc.cpp:2229
4 	nspr4.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c:426
5 	nspr4.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c:122
6 	msvcr80.dll 	_callthreadstartex 	f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\threadex.c:348
7 	msvcr80.dll 	_threadstartex 	f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\threadex.c:326
8 	kernel32.dll 	BaseThreadInitThunk 	
9 	ntdll.dll 	__RtlUserThreadStart 	
10 	ntdll.dll 	_RtlUserThreadStart
62% of crashes are on Window XP.

There are also other stacks but with a lower volume.

(In reply to Marcia Knous [:marcia] from comment #0)
> Some addon correlations:
Correlation files are broken on 10.0 and will be fixed in Socorro 2.4.2 released on Feb 15th (see bug 724799).
Assignee: nobody → general
Component: General → JavaScript Engine
Depends on: 711954
OS: Windows NT → Windows XP
Product: Firefox → Core
QA Contact: general → general
Summary: crash je_free | mozutils.dll → crash in js::GCHelperThread::doSweep @ je_free | mozutils.dll@0x3...
Crash Signature: [@ je_free | mozutils.dll@0x36ef] → [@ je_free | mozutils.dll@0x36ef] [@ arena_dalloc | js::GCHelperThread::doSweep] [@ je_free | js::GCHelperThread::doSweep()]
OS: Windows XP → All
Hardware: x86 → All
Crash Signature: [@ je_free | mozutils.dll@0x36ef] [@ arena_dalloc | js::GCHelperThread::doSweep] [@ je_free | js::GCHelperThread::doSweep()] → [@ je_free | mozutils.dll@0x36ef] [@ je_free | mozutils.dll@0x36bf] [@ arena_dalloc | js::GCHelperThread::doSweep] [@ je_free | js::GCHelperThread::doSweep()]
This is rising on 15, and is now the #18 topcrash on 15.0b4.
Keywords: topcrash
Correlations from 16 (Firefox 15 correlations for largest volume signature show only test pilot)

je_free | js::GCHelperThread::doSweep()|EXCEPTION_ACCESS_VIOLATION_READ (100 crashes)
     14% (14/100) vs.   3% (767/26645) {EEE6C361-6118-11DC-9C72-001320C79847}
     11% (11/100) vs.   2% (424/26645) plugin@videofiledownload.com
     90% (90/100) vs.  82% (21744/26645) testpilot@labs.mozilla.com (Mozilla Labs - Test Pilot, https://addons.mozilla.org/addon/13661)
     13% (13/100) vs.   5% (1437/26645) plugin@yontoo.com
     10% (10/100) vs.   3% (705/26645) OneClickDownload@OneClickDownload.com
      6% (6/100) vs.   0% (13/26645) puzzle@internauta1024a.pl (Puzzle, https://addons.mozilla.org/addon/10100)
      6% (6/100) vs.   0% (39/26645) {a5312b79-bf0d-4825-a25f-b33d67d4a58a}

On the module side, 96% on Firefox 15 have freebl3.dll, but that dll does not show in the 16 module correlations:

je_free | js::GCHelperThread::doSweep()|EXCEPTION_ACCESS_VIOLATION_READ (250 crashes)
     87% (218/250) vs.  47% (48210/102739) t2embed.dll
    100% (250/250) vs.  60% (61839/102739) winrnr.dll
     99% (248/250) vs.  60% (61135/102739) feclient.dll
     96% (241/250) vs.  57% (58317/102739) nssckbi.dll
     95% (238/250) vs.  56% (57320/102739) shdocvw.dll
     96% (241/250) vs.  58% (59599/102739) freebl3.dll

A search shows that dll is most frequently associated with:

%AppData%\imvuclient\freebl3.dll
%ProgramFiles%\mozilla firefox\freebl3.dll
%ProgramFiles%\pando networks\pando\freebl3.dll
%Temp%\7zs1.tmp\nonlocalized\freebl3.dll
Crash Signature: [@ je_free | mozutils.dll@0x36ef] [@ je_free | mozutils.dll@0x36bf] [@ arena_dalloc | js::GCHelperThread::doSweep] [@ je_free | js::GCHelperThread::doSweep()] → [@ je_free | mozutils.dll@0x36ef] [@ je_free | mozutils.dll@0x36bf] [@ arena_dalloc | js::GCHelperThread::doSweep] [@ je_free | js::GCHelperThread::doSweep()] [@ RtlEnterCriticalSection | je_free | js::GCHelperThread::doSweep()]
Crash Signature: [@ je_free | mozutils.dll@0x36ef] [@ je_free | mozutils.dll@0x36bf] [@ arena_dalloc | js::GCHelperThread::doSweep] [@ je_free | js::GCHelperThread::doSweep()] [@ RtlEnterCriticalSection | je_free | js::GCHelperThread::doSweep()] → [@ je_free | mozutils.dll@0x36ef] [@ je_free | mozutils.dll@0x36bf] [@ arena_dalloc | js::GCHelperThread::doSweep] [@ je_free | js::GCHelperThread::doSweep()] [@ RtlEnterCriticalSection | je_free | js::GCHelperThread::doSweep()] [@ zzz_AsmCodeRange_B…
Depends on: 793430
Summary: crash in js::GCHelperThread::doSweep @ je_free | mozutils.dll@0x3... → crash in js::GCHelperThread::doSweep
Crash Signature: [@ je_free | mozutils.dll@0x36ef] [@ je_free | mozutils.dll@0x36bf] [@ arena_dalloc | js::GCHelperThread::doSweep] [@ je_free | js::GCHelperThread::doSweep()] [@ RtlEnterCriticalSection | je_free | js::GCHelperThread::doSweep()] [@ zzz_AsmCodeRange_B… → [@ je_free | mozutils.dll@0x36ef] [@ je_free | mozutils.dll@0x36bf] [@ arena_dalloc | js::GCHelperThread::doSweep] [@ je_free | js::GCHelperThread::doSweep()] [@ RtlEnterCriticalSection | je_free | js::GCHelperThread::doSweep()]
No longer depends on: 793430
Crash Signature: [@ je_free | mozutils.dll@0x36ef] [@ je_free | mozutils.dll@0x36bf] [@ arena_dalloc | js::GCHelperThread::doSweep] [@ je_free | js::GCHelperThread::doSweep()] [@ RtlEnterCriticalSection | je_free | js::GCHelperThread::doSweep()] → [@ je_free | mozutils.dll@0x36ef] [@ je_free | mozutils.dll@0x36bf] [@ arena_dalloc | js::GCHelperThread::doSweep] [@ je_free | js::GCHelperThread::doSweep()] [@ RtlEnterCriticalSection | je_free | js::GCHelperThread::doSweep()] [@ arena_dalloc | js:…
Assignee: general → nobody
Crash Signature: js::GCHelperThread::doSweep()] → js::GCHelperThread::doSweep()] [@ je_free | js::GCHelperThread::doSweep] [@ RtlEnterCriticalSection | je_free | js::GCHelperThread::doSweep]
I'm marking this bug as WORKSFORME as bug crashlog signature didn't appear from a long time (over half year) in Firefox (except some obsolete Fx <30).
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.