Ubuntu
firefox package

MASTER Firefox Crash [@js_FinalizeStringRT][@js_atom_uninterner]

Bug #71702 reported by Ivaylo Ivanov
148
Affects Status Importance Assigned to Milestone
Mozilla Firefox
Invalid
Critical
firefox (Ubuntu)
Fix Released
High
Mozilla Bugs

Bug Description

I should make several attempts to start firefox on Edgy.From 2 attempts 1 success.

DistroRelease: Ubuntu 6.10
Package: firefox 2.0+0dfsg-0ubuntu3

Stacktrace:
 Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1".
 Core was generated by `/usr/lib/firefox/firefox-bin'.
 Program terminated with signal 11, Segmentation fault.
 #0 0xffffe410 in __kernel_vsyscall ()
 #0 0xffffe410 in __kernel_vsyscall ()
 No symbol table info available.
 #1 0xb7dac651 in raise () from /lib/tls/i686/cmov/libpthread.so.0
 No symbol table info available.
 #2 0x08057556 in nsProfileLock::FatalSignalHandler (signo=-1210384396)
     at nsProfileLock.cpp:206
  unblock_sigs = {__val = {1024, 0 <repeats 31 times>}}
  oldact = <value optimized out>
 #3 <signal handler called>
 No symbol table info available.
 #4 0xb7755a2e in free () from /lib/tls/i686/cmov/libc.so.6
 No symbol table info available.
 #5 0xb7f27e1f in js_FinalizeStringRT (rt=0x810db68, str=0x1a00)
     at jsstr.c:2632

See original description
Revision history for this message
In , Darin-moz (darin-moz) wrote :

Created attachment 164123
stack trace

This stack trace was taken with a CVS trunk build (up-to-date as of today) of
Firefox on Linux. I didn't do much more than run the browser and then close
it.

Revision history for this message
In , Darin-moz (darin-moz) wrote :

Created attachment 164124
another stack

here's another stack. in this case, i just loaded firefox w/ default homepage,
and then pressed the close button.

this stack seems to implicate JS_GC ...

Revision history for this message
In , Darin-moz (darin-moz) wrote :

Interestingly enough, I cannot reproduce this crash when running under valgrind :(

Revision history for this message
In , Darin-moz (darin-moz) wrote :

This crash, or at least one with a similar JS_GC stack, is still happening with
CVS trunk as of 11/5 on Linux. Again, I cannot catch it in valgrind.

Revision history for this message
In , Antoine-mechelynck-gmail (antoine-mechelynck-gmail) wrote :

Created attachment 244978
TB25676224W

TB25676224W : similar stack trace, but on BonEcho 2.0 (mozilla1.8 branch)

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1) Gecko/20061106 BonEcho/2.0
Build ID: 2006110604

Revision history for this message
In , Antoine-mechelynck-gmail (antoine-mechelynck-gmail) wrote :

This is a crash: please raise severity to "critical" and add "crash" keyword.
Maybe also mention "1.8 Branch" in Version.

Revision history for this message
Ivaylo Ivanov (icefox) wrote : Firefox crash

I should make several attempts to start firefox on Edgy.From 2 attempts 1 success.

Revision history for this message
Ivaylo Ivanov (icefox) wrote :
David Farning (dfarning)
description: updated
David Farning (dfarning)
description: updated
Changed in firefox:
status: Unconfirmed → Confirmed
David Farning (dfarning)
Changed in firefox:
assignee: nobody → mozillateam
importance: Undecided → Medium
David Farning (dfarning)
Changed in firefox:
assignee: mozillateam → mozilla-bugs
Revision history for this message
Hilario J. Montoliu (hjmf) (hmontoliu) wrote : Re: Crash nsProfileLock::FatalSignalHandler

Extracted already retraced stacktrace form original report.

Revision history for this message
Hilario J. Montoliu (hjmf) (hmontoliu) wrote :

Maybe related to https://bugzilla.mozilla.org/show_bug.cgi?id=322131

Revision history for this message
Alexander Sack (asac) wrote :

Ivailo, when did this crash happen? e.g. what did you do when ffox crashed?

Revision history for this message
Hilario J. Montoliu (hjmf) (hmontoliu) wrote : Retraced Stacktrace

Retrace done:
...
#3 <signal handler called>
#4 0xb7755a2e in free () from /lib/tls/i686/cmov/libc.so.6
#5 0xb7f27e1f in js_FinalizeStringRT (rt=0x810db68, str=0x8aff2e0) at jsstr.c:2632

#6 0xb7ebc706 in js_atom_uninterner (he=0x8b45188, i=) at jsatom.c:391

#7 0xb7ee0379 in JS_HashTableEnumerateEntries (ht=0x8158da8, f=0xb7ebc6c0 <js_atom_uninterner>, arg=0xbfdf6078) at jshash.c:366
 he = (JSHashEntry *) 0x8b45188
 hep = (JSHashEntry **) 0x87d0f48
 bucket = (JSHashEntry **) 0x8888988
 nlimit = 2816
 n = 2133
 nbuckets = <value optimized out>
 newlog2 = <value optimized out>
 rv = 0
#8 0xb7ebc7b9 in js_FinishAtomState (state=0x810dc4c) at jsatom.c:406
...

I'm uploading again the retraced stacktrace to include the retraced StackTrace too.

Revision history for this message
Hilario J. Montoliu (hjmf) (hmontoliu) wrote : Retraced Thread Stacktrace

Retraced Thread Stacktrace

Revision history for this message
Hilario J. Montoliu (hjmf) (hmontoliu) wrote :

Same stacktrace that the one reported in https://bugzilla.mozilla.org/show_bug.cgi?id=267063 Shutdown crash in ~nsJSRuntimeServiceImpl [@ free - js_FinalizeStringRT]

Hilario J. Montoliu (hjmf) (hmontoliu)
Changed in firefox:
status: Unconfirmed → Rejected
Revision history for this message
Hilario J. Montoliu (hjmf) (hmontoliu) wrote :

Same stacktrace that TB25676224W on https://bugzilla.mozilla.org/show_bug.cgi?id=267063

Changed in firefox:
importance: Undecided → Unknown
status: Rejected → Unknown
Bug Watch Updater (bug-watch-updater)
Changed in firefox:
status: Unknown → Confirmed
Hilario J. Montoliu (hjmf) (hmontoliu)
Changed in firefox:
importance: Medium → High
Christian Reis (kiko)
Changed in firefox:
status: Confirmed → In Progress
Revision history for this message
Alexander Sack (asac) wrote :

we haven't received any dupes of this for a while. So this appears to be fixed.

Changed in firefox:
status: In Progress → Fix Released
Bug Watch Updater (bug-watch-updater)
Changed in firefox:
importance: Unknown → Critical
Revision history for this message
In , Ms2ger (ms2ger) wrote :

Code is gone.

Bug Watch Updater (bug-watch-updater)
Changed in firefox:
status: Confirmed → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.