725009 - crash in js::GCHelperThread::doSweep

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-1063c85f-5e35-4cc3-8696-35dbf2120205 .
============================================================= 

Seen while looking at 10 crash stats.  https://crash-stats.mozilla.com/report/list?signature=je_free%20|%20mozutils.dll%400x36ef. Currently ranks as #61 top browser crash and has no bug associated with it, so filing now.

Some addon correlations:

je_free | mozutils.dll@0x36ff|EXCEPTION_ACCESS_VIOLATION_READ (30 crashes)
     13% (4/30) vs.   3% (401/13378) [e-mail] (IDM CC, https://addons.mozilla.org/addon/6973)
     17% (5/30) vs.  11% (1461/13378) {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} (Adblock Plus, https://addons.mozilla.org/addon/1865)
    100% (30/30) vs.  94% (12632/13378) {972ce4c6-7e08-4474-a285-3208198ce6fd} (Default, https://addons.mozilla.org/addon/8150)

One of the comments mentions Adobe, and the signature summary shows a high correlation to a "blank" version of flash.

Frame 	Module 	Signature [Expand] 	Source
0 	mozutils.dll 	je_free 	memory/jemalloc/jemalloc.c:6497
1 	mozutils.dll 	mozutils.dll@0x36ef 	
2 	mozjs.dll 	js::GCHelperThread::doSweep 	js/src/jsgc.cpp:2354
3 	mozjs.dll 	js::GCHelperThread::threadLoop 	js/src/jsgc.cpp:2229
4 	nspr4.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c:426
5 	nspr4.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c:122
6 	msvcr80.dll 	_callthreadstartex 	f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\threadex.c:348
7 	msvcr80.dll 	_threadstartex 	f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\threadex.c:326
8 	kernel32.dll 	BaseThreadInitThunk 	
9 	ntdll.dll 	__RtlUserThreadStart 	
10 	ntdll.dll 	_RtlUserThreadStart

Comment 1

[Scoobidiver (away)]

62% of crashes are on Window XP.

There are also other stacks but with a lower volume.

(In reply to Marcia Knous [:marcia] from comment #0)
> Some addon correlations:
Correlation files are broken on 10.0 and will be fixed in Socorro 2.4.2 released on Feb 15th (see bug 724799).

Comment 2

[Robert Kaiser]

This is rising on 15, and is now the #18 topcrash on 15.0b4.

Comment 3

[Marcia Knous [:marcia]]

Correlations from 16 (Firefox 15 correlations for largest volume signature show only test pilot)

je_free | js::GCHelperThread::doSweep()|EXCEPTION_ACCESS_VIOLATION_READ (100 crashes)
     14% (14/100) vs.   3% (767/26645) {EEE6C361-6118-11DC-9C72-001320C79847}
     11% (11/100) vs.   2% (424/26645) [e-mail]
     90% (90/100) vs.  82% (21744/26645) [e-mail] (Mozilla Labs - Test Pilot, https://addons.mozilla.org/addon/13661)
     13% (13/100) vs.   5% (1437/26645) [e-mail]
     10% (10/100) vs.   3% (705/26645) [e-mail]
      6% (6/100) vs.   0% (13/26645) [e-mail] (Puzzle, https://addons.mozilla.org/addon/10100)
      6% (6/100) vs.   0% (39/26645) {a5312b79-bf0d-4825-a25f-b33d67d4a58a}

On the module side, 96% on Firefox 15 have freebl3.dll, but that dll does not show in the 16 module correlations:

je_free | js::GCHelperThread::doSweep()|EXCEPTION_ACCESS_VIOLATION_READ (250 crashes)
     87% (218/250) vs.  47% (48210/102739) t2embed.dll
    100% (250/250) vs.  60% (61839/102739) winrnr.dll
     99% (248/250) vs.  60% (61135/102739) feclient.dll
     96% (241/250) vs.  57% (58317/102739) nssckbi.dll
     95% (238/250) vs.  56% (57320/102739) shdocvw.dll
     96% (241/250) vs.  58% (59599/102739) freebl3.dll

A search shows that dll is most frequently associated with:

%AppData%\imvuclient\freebl3.dll
%ProgramFiles%\mozilla firefox\freebl3.dll
%ProgramFiles%\pando networks\pando\freebl3.dll
%Temp%\7zs1.tmp\nonlocalized\freebl3.dll

Comment 4

[Scoobidiver (away)]

Since Firefox 17, it has been a low volume crash:
https://crash-stats.mozilla.com/report/list?signature=je_free+|+js%3A%3AGCHelperThread%3A%3AdoSweep%28%29
https://crash-stats.mozilla.com/report/list?signature=RtlEnterCriticalSection+|+je_free+|+js%3A%3AGCHelperThread%3A%3AdoSweep%28%29

Comment 5

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

I'm marking this bug as WORKSFORME as bug crashlog signature didn't appear from a long time (over half year) in Firefox (except some obsolete Fx <30).