843074 - crash in tag_nsresult via FinalizeArenas

Status: RESOLVED WORKSFORME

(Core :: XPConnect, defect)

Description

[Merike Sell (:merike)]

This bug was filed from the Socorro interface and is 
report bp-f536a7ba-a4c7-4ae0-9089-c43b22130217 .
=============================================================
0 	libxul.so 	tag_nsresult CallQueryInterface<nsISupports, nsWrapperCache> 	nsISupportsUtils.h:149
1 	libxul.so 	XPCWrappedNative::FlatJSObjectFinalized 	XPCWrappedNative.cpp:1310
2 	libxul.so 	WrappedNativeFinalize 	XPCWrappedNativeJSOps.cpp:636
3 	libxul.so 	bool js::gc::Arena::finalize<JSObject> 	jsobjinlines.h:239
4 	libxul.so 	FinalizeArenas 	jsgc.cpp:413
5 	libxul.so 	js::gc::ArenaLists::queueObjectsForSweep 	jsgc.cpp:1222
6 	libxul.so 	BeginSweepingCompartmentGroup 	jsgc.cpp:3445
7 	libxul.so 	IncrementalCollectSlice 	jsgc.cpp:3583
8 	libxul.so 	GCCycle 	jsgc.cpp:4165
9 	libxul.so 	Collect 	jsgc.cpp:4283
10 	libxul.so 	js::IncrementalGC 	jsfriendapi.cpp:190
11 	libxul.so 	nsJSContext::GarbageCollectNow 	nsJSEnvironment.cpp:2959
12 	libxul.so 	InterSliceGCTimerFired 	nsJSEnvironment.cpp:3280
13 	libxul.so 	nsTimerImpl::Fire 	nsTimerImpl.cpp:482
14 	libxul.so 	nsTimerEvent::Run 	nsTimerImpl.cpp:565
15 	libxul.so 	nsThread::ProcessNextEvent 	nsThread.cpp:627
16 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:238
17 	libxul.so 	mozilla::ipc::MessagePump::Run 	MessagePump.cpp:117
18 	libxul.so 	MessageLoop::RunInternal 	message_loop.cc:215
19 	libxul.so 	MessageLoop::Run 	message_loop.cc:208
20 	libxul.so 	nsBaseAppShell::Run 	nsBaseAppShell.cpp:163
21 	libxul.so 	nsAppStartup::Run 	nsAppStartup.cpp:288
22 	libxul.so 	XREMain::XRE_mainRun 	nsAppRunner.cpp:3823
23 	libxul.so 	XREMain::XRE_main 	nsAppRunner.cpp:3890
24 	libxul.so 	XRE_main 	nsAppRunner.cpp:4093
25 	thunderbird 	main 	nsMailApp.cpp:111
26 	libc-2.15.so 	libc-2.15.so@0x194d3 	
27 	libc-2.15.so 	libc-2.15.so@0x194d3 	
28 	libc-2.15.so 	libc-2.15.so@0x1a5ff4 	
29 	ld-2.15.so 	ld-2.15.so@0x146a0 	
30 	libc-2.15.so 	libc-2.15.so@0x193e9 	
31 	ld-2.15.so 	ld-2.15.so@0x20ff4 	
32 	thunderbird 	nsGetterAddRefs<nsIFile>::operator nsIFile** 	dist/include/nsCOMPtr.h:815
33 		@0x3 	
34 	ld-2.15.so 	ld-2.15.so@0xf270 	
35 	ld-2.15.so 	ld-2.15.so@0x21918

I've been crashing into this for a while now couple times a week using Thunderbird Aurora channel builds. Sadly I have no idea what it's related to that makes this frequent for me. Crash-stats asserts that it is processor and application agnostic having at least two other crash sources in addition to me in last 4 weeks.

Hopefully someone knows a better component for this, I have no idea what it should be.

Comment 1

[Wayne Mery (:wsmwk)]

duplicate of bug 835798?

Comment 2

[Merike Sell (:merike)]

Seems like te same thing with slightly different stack: 381e7dcd-4215-43ae-85fe-409932130221

Comment 3

[Merike Sell (:merike)]

At least for me it is likely to occur when trying to open newly arrived and filtered bugmail:
https://crash-stats.mozilla.com/report/index/bp-c17c75f3-f016-4097-bcfd-df2602130410
https://crash-stats.mozilla.com/report/index/e520c5ad-9298-45f2-8850-2d8902130417

Comment 4

[Wayne Mery (:wsmwk)]

(In reply to Merike (:merike) from comment #3)
> At least for me it is likely to occur when trying to open newly arrived and
> filtered bugmail:

any particular type of mail?  calendar?

Starting at js::gc::Arena::finalize<JSObject>, this has same stack as bug 702531

Comment 5

[Merike Sell (:merike)]

I got it twice some months ago when going through newly arrived bugmail. I never found a way to repro though. I also once got it when opening an event from a reminder in Lightning but I do that regularly and it hasn't happened again.

Comment 6

[Wayne Mery (:wsmwk)]

You surely have a ton of crashes :)

- @0x0 | nsInterfaceRequestorAgg::GetInterface(nsID const&, void**) bp-24ed1570-1085-4680-b297-a4a072140319 aka bug 907096
- Bug 935651 - crash in pl_DefConnectcontinue  (most of yours are this)

plus others

Comment 7

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

I'm marking this bug as WORKSFORME as bug crashlog signature didn't appear from a long time (over half year).