776559 - crash in GraphWalker<scanVisitor>::DoWalk

Status: RESOLVED WORKSFORME

(Core :: XPCOM, defect)

Description

[Wayne Mery (:wsmwk)]

crash starts in version 14.
#41 crash

example below is version 15.
This bug was filed from the Socorro interface and is 
report bp-fea2218d-8f54-462e-88d0-d88642120626 .
============================================================= 

0	mozalloc.dll	mozalloc_abort	memory/mozalloc/mozalloc_abort.cpp:46
1	xul.dll	NS_DebugBreak_P	xpcom/base/nsDebugImpl.cpp:369
2	xul.dll	Fault	xpcom/base/nsCycleCollector.cpp:1124
3	xul.dll	scanVisitor::VisitNode	xpcom/base/nsCycleCollector.cpp:2107
4	xul.dll	GraphWalker<scanVisitor>::DoWalk	xpcom/base/nsCycleCollector.cpp:1229
5	xul.dll	GraphWalker<scanVisitor>::WalkFromRoots	xpcom/base/nsCycleCollector.cpp:1215
6	xul.dll	nsCycleCollector::ScanRoots	xpcom/base/nsCycleCollector.cpp:2165
7	xul.dll	nsCycleCollector::Collect	xpcom/base/nsCycleCollector.cpp:2700
8	xul.dll	nsCycleCollector::Shutdown	xpcom/base/nsCycleCollector.cpp:2864
9	xul.dll	nsCycleCollector_shutdown	xpcom/base/nsCycleCollector.cpp:3229
10	xul.dll	mozilla::ShutdownXPCOM	xpcom/build/nsXPComInit.cpp:642

Comment 1

[Benjamin Smedberg]

The fault is "traversed refs exceed refcount", and so there's probably a traversal error lurking somewhere. The stack won't help us find it, but a nightly regression range might.

Comment 2

[Wayne Mery (:wsmwk)]

is bp-bc58b1e2-707c-4cc6-bd00-81dae2120806 the same deal?  It has a reporter email address.  @ TouchBadMemory | mozalloc_abort | NS_DebugBreak_P | scanVisitor::VisitNode for several Mac Firefox users

Thunderbird 14 Mac crash bp-a74fb783-79df-4e31-bc19-b20362120802 cites doing a mail search - like bug 770262. bp-643577ec-361c-4f00-88d6-231b42120726 cites doing bing search

Comment 3

[Andrew McCreight [:mccr8]]

"traversed refs exceed refcount" is pretty bad.  The only time I've ever seen it tripped before was bug 708825, and it ended up being an excess reference during a failure in slim wrapper morphing. I might be able to mess with this so that we can see on the stack what class is faulting.  I haven't messed with it much because I've never noticed CC faulting crashes in the wild before.

Comment 4

[Wayne Mery (:wsmwk)]

(In reply to Wayne Mery (:wsmwk) from comment #2)
> is bp-bc58b1e2-707c-4cc6-bd00-81dae2120806 the same deal?  It has a reporter
> email address.  @ TouchBadMemory | mozalloc_abort | NS_DebugBreak_P |
> scanVisitor::VisitNode for several Mac Firefox users

Comment 5

[Wayne Mery (:wsmwk)]

(In reply to Benjamin Smedberg  [:bsmedberg] from comment #1)
> The fault is "traversed refs exceed refcount", and so there's probably a
> traversal error lurking somewhere. The stack won't help us find it, but a
> nightly regression range might.

earliest crash I find with scanVisitor::VisitNode on stack is 
bp-59f76978-c7c6-45fa-aa9d-178b42120405 tb14.0a1 20120405031419
a close second is 
bp-a2ffbee6-10a2-489c-b681-a02ac2120423 tb14.0a1 20120408031146

bp-c1961ad6-e48d-40aa-9fd9-471d92120322 is earlier crash, build 20120321031151, but stack is cut short

earliest crash for thunderbird is 
bp-c0ddbfa8-efc4-423f-972f-aa2fc2120516 tb14.0a2 20120515042007
and then release TB14, including beta TB14 bp-d333c1a9-bae8-41db-8c15-d86962120628

Comment 6

[Andrew McCreight [:mccr8]]

Yes, all of the crashes in comment 2 look like the same thing.

Comment 7

[Andrew McCreight [:mccr8]]

These assertions weren't fatal before Firefox 14 (bug 521853) which is why they wouldn't have show up earlier than that.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

In the last 28 days, there hasn't been a report of this crash on a Gecko revision newer than 21. Calling this WFM at this point.