93458 - EXC_BAD_ACCESS @ nsMacMemoryCushion::RecoverMemoryReserve(long) - heap corruption

Status: RESOLVED DUPLICATE of bug 124517

(SeaMonkey :: General, defect)

Description

[Henri Sivonen (:hsivonen)]

Build ID: 2001080105 trunk FizzillaCFM

I was using Bugzilla when Mozilla crashed. I can't give useful steps to
reproduce. The crash.log excerpt (coming up) is all I've got.

Comment 1

[Henri Sivonen (:hsivonen)]

Attachment: crash.log excerpt

Comment 2

[dcone (gone)]

This is a duplicate I am sure of the content going away bug.  90060.

Next time you submit a bug, a URL is really needed.. or a test case, its very 
hard if not impossible to fix a stack trace.  I am guessing this is that bug 
because it looks like it was in the timer.. and I have a fix going in for that.. 
which crashes sites that content is changed.. dynamically or because the user 
switched pages, etc, etc.

*** This bug has been marked as a duplicate of 90060 ***

Comment 3

[sujay]

Henri this should be fixed now...please try again..

Comment 4

[Henri Sivonen (:hsivonen)]

Attachment: Newer crash log excerpt

This is still the most frequent crasher I'm experiencing. I still don't have
any useful steps to reproduce. It just happes upon a mouse click sometimes.

Comment 5

[Henri Sivonen (:hsivonen)]

Crashed again. The stack is always the same. This time it was at
http://www.appmac.com/, but I can't reproduce the crash when I try. I'm sure
it'll reoccur when I'm not trying.

I'll try to come up with steps to reproduce.

Comment 6

[Henri Sivonen (:hsivonen)]

I loaded http://lxr.mozilla.org/seamonkey/source/expat/xmlparse/xmlparse.c#117
Then I selected "m_externalEntityRefHandler" on line 381. Mozilla crashed when I
pressed command-C.

It doesn't crash if I do the same again. However, from time to time, Mozilla
crashes with the same stack when handling some user event (mouse click or
keyboard event). I believe the crash happens when the memory is in a particular
state and that state can't be recreated by just redoing the last steps.

Sorry, I can't come up with specific steps to reproduce. This happens seemingly
at random when Mozilla has been in use for a long time. I open and close a lot
of windows. I leave Mozilla open when I put the system to sleep at night.

Mozilla has crashed 15 times on my computer in the 2001-10-29...2001-11-23
timeframe. Of those 15 crashes, 8 have been instances of this problem.

CCing sfraser, because the CVS logs tell me he has worked on the related code.

Comment 7

[Simon Fraser [no longer active]]

Something is trashing the heap.

Comment 8

[Bill McGonigle (not currently reading bugmail; please contact directly)]

Attachment: Another Crash Log

From 2001112608 - I got this submitting a form at
http://www.wahoocomputers.com/cgi-bin/store/commerce.cgi?product=lanster_case 
.  I happened to also be seeing bug 108470 at the time I hit the submit button,
so I don't know if it's related, and I can't reproduce at the moment.

Comment 9

[Henri Sivonen (:hsivonen)]

FWIW, this bug also exists in the 0.9.4 branch.

Comment 10

[Matt Watson]

You could have the mozilla launcher script setenv MallocScribble=1 and 
MallocCheckHeapStart=1 and run Mozilla from the command line to help 
debug this.

Comment 11

[Henri Sivonen (:hsivonen)]

Is nsMacMemoryCushion a Classic mamory management thing? Is it needed on OS X at
all?

Comment 12

[Henri Sivonen (:hsivonen)]

The only abnormal debug printout I saw was:
MallocCheckHeap: PASSED check at 484998001th operation
MallocCheckHeap: PASSED check at 484999001th operation
At szone_check counter=970000
MallocCheckHeap: PASSED check at 485000001th operation
MallocCheckHeap: PASSED check at 485001001th operation

Then later when the crash happened, there was no useful printouts:

MallocCheckHeap: PASSED check at 486289001th operation
MallocCheckHeap: PASSED check at 486290001th operation
MallocCheckHeap: PASSED check at 486291001th operation
Segmentation fault

Is this bug on any crash radar? Should this be moved to a more specific Bugzilla
component?

Comment 13

[Henri Sivonen (:hsivonen)]

Adding nominations. On my computer, this bug is a very frequent crasher and
almost the only crasher.

Comment 14

[Mike Pinkerton (not reading bugmail)]

simon, do you think this got fixed with your patch for the multiple-memcushions?

Comment 15

[Simon Fraser [no longer active]]

I checked in the fix for this yesterday.

*** This bug has been marked as a duplicate of 124517 ***