Closed Bug 759675 Opened 12 years ago Closed 12 years ago

crash in XPCWrappedNativeScope::TraceJS @ JS_DHashTableEnumerate


(Core :: XPConnect, defect)

14 Branch
Not set



Tracking Status
firefox14 --- fixed
blocking-fennec1.0 --- .N+
fennec 15+ ---


(Reporter: scoobidiver, Unassigned)



(Keywords: crash, topcrash, Whiteboard: [js:inv:p2][native-crash])

Crash Data

About half of crashes with this crash signature happen with that stack making it #6 top crasher in 14.0b3.

Signature 	JS_DHashTableEnumerate More Reports Search
UUID	2b5b36b8-afb7-4e1e-83e4-3c3d32120529
Date Processed	2012-05-29 23:30:20
Uptime	716
Install Age	11.9 minutes since version was first installed.
Install Time	2012-05-29 23:18:06
Product	FennecAndroid
Version	14.0
Build ID	20120524133102
Release Channel	beta
OS	Linux
OS Version	0.0.0 Linux #1 PREEMPT Mon Sep 19 08:03:47 2011 armv7l
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGSEGV
Crash Address	0x8
App Notes 	
AdapterVendorID: semc, AdapterDeviceID: R800a.
AdapterDescription: 'Model: 'R800a', Product: 'R800a_1247-6272', Manufacturer: 'Sony Ericsson', Hardware: 'semc''.
Sony Ericsson R800a
EMCheckCompatibility	True

Frame 	Module 	Signature 	Source
0 	JS_DHashTableEnumerate 	js/src/jsdhash.cpp:738
1 	XPCWrappedNativeScope::TraceJS 	js/xpconnect/src/XPCMaps.h:173
2 	XPCJSRuntime::TraceXPConnectRoots 	js/xpconnect/src/XPCJSRuntime.cpp:421
3 	XPCJSRuntime::TraceGrayJS 	js/xpconnect/src/XPCJSRuntime.cpp:357
4 	BeginMarkPhase 	js/src/jsgc.cpp:2335
5 	GCCycle 	js/src/jsgc.cpp:3245
6 	js::GCSlice 	js/src/jsgc.cpp:3692
7 	js::IncrementalGC 	js/src/jsfriendapi.cpp:162
8 	nsXPConnect::Collect 	js/xpconnect/src/nsXPConnect.cpp:420
9 	nsXPConnect::GarbageCollect 	js/xpconnect/src/nsXPConnect.cpp:430
10 	nsJSContext::GarbageCollectNow 	dom/base/nsJSEnvironment.cpp:2919
11 	GCTimerFired 	dom/base/nsJSEnvironment.cpp:3080
12 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:508
13 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:591
14 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:656
15 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:245
16 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:114
17 	MessageLoop::RunInternal 	ipc/chromium/src/base/
18 	MessageLoop::Run 	ipc/chromium/src/base/
19 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:189
20 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:295
21 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3780
22 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3857
23 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3933

More reports at:
This is the crash with IGC on the stack.
Whiteboard: [native-crash] → [js:inv:p2][native-crash]
Adding blake, too. JP says conversation with dmandelin suggests that these are coming from xpcom, can Bobby or Blake give us any thoughts on what's causing these crashes, and how to fix them?
mccr8 has been looking at these over in bug 759680.
Depends on: 761249
tracking-fennec: --- → 15+
blocking-fennec1.0: ? → .N+
Crash Signature: [@ JS_DHashTableEnumerate] → [@ JS_DHashTableEnumerate] [@ JS_DHashTableEnumerate | XPCWrappedNativeScope::TraceJS]
There are no crashes in 14.0b7, probably fixed by bug 756253.
One of the crash reports in bug 756253 had this signature, so I'll mark it as a dependency.
Depends on: 756253
I expect this crash went down with the fix in bug 756253. It still possible that other corruption can trigger this crash.
Closing as per #5 and #6
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla14
You need to log in before you can comment on or make changes to this bug.