776578 - crash in SweepTypeObjects

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-37c1ab01-0874-4445-8f4c-bd7d42120723 .
============================================================= 

Seen while looking at beta crash stats, but appears in 14.0.1 as well. Appears to be Linux and Mac only. https://crash-stats.mozilla.com/report/list?signature=SweepTypeObjects

One comment says "using scroll wheel to scroll down web page"

Frame 	Module 	Signature 	Source
0 	XUL 	SweepTypeObjects 	js/src/jsinfer.h:345
1 	XUL 	js::types::TypeCompartment::sweep 	js/src/jsinfer.cpp:5910
2 	XUL 	JSCompartment::sweep 	js/src/jscompartment.cpp:522
3 	XUL 	SweepPhase 	js/src/jsgc.cpp:3273
4 	XUL 	GCCycle 	js/src/jsgc.cpp:3719
5 	XUL 	Collect 	js/src/jsgc.cpp:3822
6 	XUL 	js::GCSlice 	js/src/jsgc.cpp:3852
7 	XUL 	js::IncrementalGC 	js/src/jsfriendapi.cpp:149
8 	XUL 	nsJSContext::GarbageCollectNow 	dom/base/nsJSEnvironment.cpp:2969
9 	XUL 	GCTimerFired 	dom/base/nsJSEnvironment.cpp:3141
10 	XUL 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:473
11 	XUL 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:556
12 	XUL 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:624
13 	XUL 	NS_ProcessPendingEvents_P 	obj-firefox/i386/xpcom/build/nsThreadUtils.cpp:163
14 	XUL 	nsBaseAppShell::NativeEventCallback 	widget/xpwidgets/nsBaseAppShell.cpp:97
15 	XUL 	nsAppShell::ProcessGeckoEvents 	widget/cocoa/nsAppShell.mm:410
16 	CoreFoundation 	__CFRunLoopDoSources0

Comment 1

[Marcia Knous [:marcia]]

Some URLs:

4	http://hellogiggles.com/
2 	http://irokotv.com/video/3689/older-2
2 	http://www.justin.tv/__sky__#/w/3465568560/6
1	about:newtab
1 	http://prettymuchamazing.com/
1 	http://www.kaleva.fi/uutiset/pohjois-suomi/kolarin-ajanut-mopokuski-luikki-polii
1 	http://abcnews.go.com/US/james-holmes-video-colorado-shooting-suspect-abc-news/s
1 	http://shop.autoanything.com/shop/in-bed-bike-rack
1 	http://abcnews.go.com/US/colorado-movie-theater-shooting-suspect-bought-guns-600
1 	http://hellogiggles.com/the-badassification-of-joseph-gordon-levitt
1 	http://www.leboncoin.fr/locations/offres/rhone_alpes/?f=a&th=1&mre=450&sqs=2&ret
1 	https://www.facebook.com/
1 	http://www.facebook.com/holly.k.austin?sk=photos
1 	http://www.facebook.com/ajax/pagelet/generic.php/PhotoViewerPagelet?ajaxpipe=1&a
1 	http://blog.sfgate.com/wp-content/plugins/hdn-nextgen-gallery-view/refresh.php?a
1 	http://www.flyingmag.com/photo-gallery/photos/top-100-airplanes?cmpid=enews07191
1 	http://www.justin.tv/__sky__
1 	wyciwyg://124/http://abcnews.go.com/US/aurora-shooting-miracle-worse/story?id=16
1 	http://abcnews.go.com/Blotter/aurora-dark-knight-shooting-suspect-identified-jam
1 	http://www.sfgate.com/giants/article/Lincecum-Crawford-shine-in-Giants-win-37241
1 	http://www.justin.tv/bro_movie

Comment 2

[Scoobidiver (away)]

It's #2 top browser crasher in 15.0b2 on Mac OS X.

74% of crashes happen on Mac OS X 10.5.

Here are today's correlation in 15.0:
  SweepTypeObjects|EXC_BAD_ACCESS / KERN_INVALID_ADDRESS (36 crashes)
     81% (29/36) vs.  20% (130/636) FlashPlayer-10.4-10.5

Comment 3

[Lukas Blakk [:lsblakk] use ?needinfo]

Thanks for the urls, Marcia, can you try to reproduce this on 10.5 with the Flash version mentioned in comment #2?

Comment 4

[David Mandelin [:dmandelin]]

(In reply to Scoobidiver from comment #2)
> It's #2 top browser crasher in 15.0b2 on Mac OS X.
> 
> 74% of crashes happen on Mac OS X 10.5.
> 
> Here are today's correlation in 15.0:
>   SweepTypeObjects|EXC_BAD_ACCESS / KERN_INVALID_ADDRESS (36 crashes)
>      81% (29/36) vs.  20% (130/636) FlashPlayer-10.4-10.5

How do I get to the correlation reports? All the links I used to use in Socorro are broken.

Comment 5

[Scoobidiver (away)]

(In reply to David Mandelin [:dmandelin] from comment #4)
> How do I get to the correlation reports? All the links I used to use in
> Socorro are broken.
They are there: https://crash-analysis.mozilla.com/crash_analysis/

Comment 6

[Marcia Knous [:marcia]]

Correlations from Beta:

the second addon in is DivX Plus Web Player HTML5

SweepTypeObjects|EXC_BAD_ACCESS / KERN_INVALID_ADDRESS (43 crashes)
     21% (9/43) vs.   3% (17/647) {AE93811A-5C9A-4d34-8462-F7B864FC4696} (StumbleUpon, https://addons.mozilla.org/addon/138)
     23% (10/43) vs.   8% (53/647) {23fcfd51-4958-4f00-80a3-ae97e717ed8b}
     23% (10/43) vs.   9% (56/647) {b9db16a4-6edc-47ec-a1f4-b86292ed211d} (Video DownloadHelper, https://addons.mozilla.org/addon/3006)
     12% (5/43) vs.   1% (6/647) {21e48e29-f574-4619-b65d-0f00eea92e5b} (GoogleEnhancer, https://addons.mozilla.org/addon/6435)
      9% (4/43) vs.   1% (4/647) [e-mail]
      9% (4/43) vs.   1% (4/647) {75e0046f-2275-4bce-9afd-d8da19abdf0b}
      9% (4/43) vs.   1% (5/647) [e-mail] (Download YouTube Videos +, https://addons.mozilla.org/addon/12984)
      9% (4/43) vs.   1% (6/647) {b9bfaf1c-a63f-47cd-8b9a-29526ced9060} (Download YouTube As MP4, https://addons.mozilla.org/addon/11869)
      9% (4/43) vs.   1% (6/647) [e-mail]
      9% (4/43) vs.   1% (7/647) [e-mail] (NetVideoHunter Video Downloader, https://addons.mozilla.org/addon/7447)
      9% (4/43) vs.   2% (10/647) [e-mail] (Ant.com Toolbar - Tube Downloader, https://addons.mozilla.org/addon/8174)
      9% (4/43) vs.   2% (10/647) {ada4b710-8346-4b82-8199-5de2b400a6ae} (ReminderFox, https://addons.mozilla.org/addon/1191)
      9% (4/43) vs.   2% (16/647) [e-mail] (Flash Video Downloader, https://addons.mozilla.org/addon/6584)
     12% (5/43) vs.   5% (33/647) {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} (Download Statusbar, https://addons.mozilla.org/addon/26)
      9% (4/43) vs.   4% (27/647) {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b} (Easy YouTube Video Downloader, https://addons.mozilla.org/addon/10137)

I can try to reproduce when I am back in Mt. View on Monday since I don't have a 10.5 machine ATM.

Comment 7

[David Mandelin [:dmandelin]]

(In reply to Scoobidiver from comment #5)
> (In reply to David Mandelin [:dmandelin] from comment #4)
> > How do I get to the correlation reports? All the links I used to use in
> > Socorro are broken.
> They are there: https://crash-analysis.mozilla.com/crash_analysis/

Thanks! I filed bug 779946.

Comment 8

[David Mandelin [:dmandelin]]

Hmmm, lots of add-ons. I wonder if this is more compartment bugs.

Comment 9

[Marcia Knous [:marcia]]

Attachment: Screenshot of banner ad

One thing I noticed about the URLs that are reported when people crash - they all seem to have this banner ad which has a clickable button that allows you to tailor your ad choices - something like:

"This ad was delivered on behalf of AT&T. It was automatically matched to your computer's browsing activity. AT&T is committed to providing you with transparency and control over the types of advertising you see from us. Please click links to opt out or learn more."  

http://www.gocomics.com/the-born-loser has it at the top and there is also a banner ad at the bottom of the page, and the user that crashed on this site said in his comment: "This is annoying. It happens every day for the last week or so. I even turned on the pop-up blocker. There's a certain pop-up ad that shows just before the crash. I'll try to catch exactly what it is."

Comment 10

[Marcia Knous [:marcia]]

I did some more testing on the 10.5 lab machine and haven't been able to repro the crash yet. I tried with some of the addons below, using some of the URLs that users were hitting.  Note that I could not test with Blockquote source since that addon was removed from AMO.

SweepTypeObjects|EXC_BAD_ACCESS / KERN_INVALID_ADDRESS (27 crashes)
     19% (5/27) vs.   1% (7/715) {ec8030f7-c20a-464f-9b0e-13a3a9e97384} (Blockquote source, https://addons.mozilla.org/addon/1006)
     19% (5/27) vs.   2% (15/715) {b9bfaf1c-a63f-47cd-8b9a-29526ced9060} (Download YouTube As MP4, https://addons.mozilla.org/addon/11869)
     19% (5/27) vs.   2% (16/715) {a3a5c777-f583-4fef-9380-ab4add1bc2a8}
     19% (5/27) vs.   2% (17/715) [e-mail] (Read It Later, https://addons.mozilla.org/addon/7661)
     96% (26/27) vs.  81% (581/715) [e-mail] (Mozilla Labs - Test Pilot, https://addons.mozilla.org/addon/13661)
     19% (5/27) vs.   4% (27/715) {9AA46F4F-4DC7-4c06-97AF-5035170634FE} (ImTranslator, https://addons.mozilla.org/addon/2257)
      7% (2/27) vs.   1% (4/715) {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} (WOT, https://addons.mozilla.org/addon/3456)
      7% (2/27) vs.   1% (6/715) [e-mail] (TinEye Reverse Image Search, https://addons.mozilla.org/addon/8922)
      7% (2/27) vs.   1% (8/715) [e-mail] (YouTube to MP3, https://addons.mozilla.org/addon/11047)

Comment 11

[u279076]

Any update here Marcia?

Comment 12

[Lukas Blakk [:lsblakk] use ?needinfo]

This seems to have dropped off of topcrashers - I don't see it in overall crashes nor in Mac OS only crashes.  Untracking for now. We can revisit if this re-appears in volume.

Comment 13

[Marcia Knous [:marcia]]

As Lukas notes in Comment 12, I see very few crashes showing up in B5 so far. I will keep an eye on this signature after we ship.

Comment 14

[Marcia Knous [:marcia]]

Volume seems significantly lower on this - Firefox 15.0.1 is only showing 13 crashes in this signature in the last week.

Comment 15

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

I'm marking this bug as WORKSFORME as bug crashlog signature didn't appear from a long time (over half year) in Firefox (except some obsolete Fx <17).