786742 - Firefox EXCEPTION_INVALID_HANDLE crash in js::GCHelperThread::doSweep (Correlation to Yandex Bar)

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-50ba3c22-00a3-4fae-b6b2-17c182120829 .
============================================================= 

Seen while looking at crash stats. This crash so far seems to only affect Firefox 15. https://crash-stats.mozilla.com/report/list?signature=RtlUlonglongByteSwap%20|%20RtlpDeCommitFreeBlock%20|%20je_free%20|%20js::GCHelperThread::doSweep%28%29

Correlation report points to Yandex Bar, and it seems different versions of the Yandex bar are implicated in this crash (6.9.1 and 7.1.1 ATM.

Frame 	Module 	Signature 	Source
0 	ntdll.dll 	RtlUlonglongByteSwap 	
1 	ntdll.dll 	RtlpDeCommitFreeBlock 	
2 	mozglue.dll 	je_free 	memory/jemalloc/jemalloc.c:6567
3 	mozjs.dll 	js::GCHelperThread::doSweep 	js/src/jsgc.cpp:2854
4 	mozjs.dll 	js::GCHelperThread::threadLoop 	js/src/jsgc.cpp:2715
5 	mozjs.dll 	js::GCHelperThread::threadMain 	js/src/jsgc.cpp:2694
6 	nspr4.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c:394
7 	nspr4.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c:90
8 	msvcr100.dll 	_callthreadstartex 	f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c:314
9 	msvcr100.dll 	_threadstartex 	f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c:292
10 	kernel32.dll 	BaseThreadInitThunk 	
11 	ntdll.dll 	__RtlUserThreadStart 	
12 	ntdll.dll 	_RtlUserThreadStart


RtlUlonglongByteSwap | RtlpDeCommitFreeBlock | je_free | js::GCHelperThread::doSweep()|EXCEPTION_INVALID_HANDLE (20 crashes)
     95% (19/20) vs.   2% (1242/72157) [e-mail] (Yandex.Bar, https://addons.mozilla.org/addon/3495)
     60% (12/20) vs.   0% (208/72157) [e-mail]
     25% (5/20) vs.   7% (4936/72157) {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} (Adblock Plus, https://addons.mozilla.org/addon/1865)
     10% (2/20) vs.   0% (261/72157) [e-mail]

Comment 1

[Marcia Knous [:marcia]]

[@ RtlRaiseStatus | SHATransformP3 ] seems to be the Win XP version of this crash based on the stack.

Comment 2

[Mihaela Velimiroviciu (:mihaelav)]

Firefox 10.0.8ESR crashed on win XP while restarting the browser during crash-me add-on install:
http://crash-stats.mozilla.com/report/index/bp-35a2f55c-de28-4b9a-8015-996dc2121008

Comment 3

[Scoobidiver (away)]

It's #8 top browser crasher in 16.0.

Comment 4

[Scoobidiver (away)]

It's #51 top browser crasher w/o hangs in 17.0, #41 in 18.0b1, and #45 in 19.0a2, so no longer a top crasher.

Comment 5

[u279076]

Is [@ RtlRaiseStatus | TransformMD5] related to this?
https://crash-stats.mozilla.com/report/list?product=Firefox&range_value=7&range_unit=days&date=2013-09-06&signature=RtlRaiseStatus+%7C+TransformMD5&version=Firefox%3A25.0a2

Note that [@ RtlRaiseStatus | SHATransformP3] and [@ RtlRaiseStatus | TransformMD5] are sitting at #12 and #14 respectively. This could be bordering on a top crash...

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.