Closed Bug 1162024 Opened 10 years ago Closed 7 years ago

crash in mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*)

Categories

(Core :: XPCOM, defect)

Product:
Core
Component:
XPCOM
Platform:
Unspecified
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1045992
Tracking Flags:
Tracking Status
firefox45 --- affected
firefox46 --- affected
firefox47 --- affected
firefox48 --- affected
firefox49 --- affected
firefox-esr45 --- affected
firefox50 --- affected
firefox51 --- affected
firefox52 --- wontfix
firefox54 --- affected

People

(Reporter: ehsan.akhgari, Unassigned)

References

Details

(4 keywords)

Crash Data

This bug was filed from the Socorro interface and is report bp-b790da78-c38e-4e88-9fdd-e05322150506. ============================================================= Seems like a null pointer dereference.
The volume is really high, it's around #40 in both 38.0.1 and 40.0a2 topcrash lists. The majority of user comments is about "watching video on youtube". Close to 100% of the crashes are on OSX.
Crash Signature: [@ mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*)] → [@ mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*)] [@ @0x0 | mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*) ]
Keywords: top100, topcrash
Well, I landed bug 1114804 in 38, to try to fix bug 997908, but I guess it didn't actually fix it, as this sounds very similar.
These are the #6 Mac topcrasher on the 40.a2 branch, but don't even show up in the top 50 on the 41 branch. In fact I can only find one in the last week on the 41 branch, on any platform: bp-e4f70bc1-67dd-46cc-b692-c55ff2150531 I suggest we wait and see what happens :-) See bug 1018360 comment #0 for an explanation of how non-null crash addresses on amd64 chips can be misreported as null (on OS X and Linux) or -1 (on Windows).
Keywords: topcrash-mac
I did land bug 866681 in 41, which makes more stuff use the DeferredFinalizer mechanism. Maybe that helped somehow?
Actually let's watch these (on the 41 branch) for another week or so. Two more have appeared in recent builds since I wrote comment #5: bp-267fe48e-bce7-4721-a901-be4932150601 bp-083aca24-a8d9-473d-afad-72b3d2150601 And I don't see any drop in these crashes' frequency with the 2015-05-15-03-02-02-mozilla-central nightly -- which is (presumably) where your patches for bug 866681 first appeared. https://crash-stats.mozilla.com/search/?version=41.0a1&platform=Mac+OS+X&signature=DeferredFinalize&build_id=%3E%3D20150514032200&date=%3E%3D2015-05-14&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#crash-reports
> bp-267fe48e-bce7-4721-a901-be4932150601 > bp-083aca24-a8d9-473d-afad-72b3d2150601 Oops, these have a slightly different signature. But I suspect they may be related.
Depends on: 1174796
Crash Signature: [@ mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*)] [@ @0x0 | mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*) ] → [@ mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*)] [@ @0x0 | mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*) ] [@ mozilla::dom::DeferredFinalizerImpl<T>::DeferredFinalize] …
If I'm not misreading <https://crash-stats.mozilla.com/topcrashers/?platform=Mac+OS+X&product=Firefox&version=44.0.2&days=28>, this is actually very common crash on Mac (#3 on 44.0.2). I'll also note that I've seen two users, who report that this crash and another very common crash (js::jit::AssemblerX86Shared::bind, bug 1124397) happen regularly: https://support.mozilla.org/en-US/questions/1111080 and bug 1197220.
We hit this crash today in our firefox-ui-tests on OS X 10.11 for the Firefox 45.0.1 it locale: https://treeherder.mozilla.org/logviewer.html#?job_id=158317&repo=mozilla-release The test which caused this crash is clearing the cookies via the sanitize feature. Crash reason: EXC_BAD_ACCESS / 0x0000000d Crash address: 0x0 Process uptime: 21 seconds 0 XUL!mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*) [nsCOMPtr.h:e0e51efe7b15 : 295 + 0x0] 1 XUL!mozilla::IncrementalFinalizeRunnable::ReleaseNow(bool) [CycleCollectedJSRuntime.cpp:e0e51efe7b15 : 1200 + 0x8] 2 XUL!mozilla::IncrementalFinalizeRunnable::Run() [CycleCollectedJSRuntime.cpp:e0e51efe7b15 : 1234 + 0x8] 3 XUL!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:e0e51efe7b15 : 972 + 0x6]
Looks like this is still a top-crash for Firefox 45.0.x. As of now it's listed on position 33. For other branches (beta, aurora, nightly) we do not have it listed in the top-crash list.
status-firefox45: --- → affected
status-firefox46: --- → unaffected
> For other branches (beta, aurora, nightly) we do not have it listed in the top-crash list. I don't think there's enough data to consider newer versions unaffected. If you filter by OS, this is still #3 Mac crash on 46 beta <https://crash-stats.mozilla.com/topcrashers/?platform=Mac+OS+X&product=Firefox&version=46.0b1&days=28>. (The other channels might not be representative of the release/beta population.)
this is still a top crash on 46.0 (#3 with 5% of all crashes on os x)
status-firefox46: unaffected → affected
Crash volume for signature 'mozilla::dom::DeferredFinalizerImpl<T>::DeferredFinalize': - nightly (version 50): 1 crash from 2016-06-06. - aurora (version 49): 2 crashes from 2016-06-07. - beta (version 48): 31 crashes from 2016-06-06. - release (version 47): 93 crashes from 2016-05-31. - esr (version 45): 1429 crashes from 2016-04-07. Crash volume on the last weeks: Week N-1 Week N-2 Week N-3 Week N-4 Week N-5 Week N-6 Week N-7 - nightly 0 0 0 0 0 0 0 - aurora 1 0 0 1 0 0 0 - beta 8 1 3 7 6 2 2 - release 20 14 17 12 9 10 6 - esr 117 135 140 142 160 131 101 Affected platforms: Windows, Mac OS X, Linux
status-firefox47: --- → affected
status-firefox48: --- → affected
status-firefox49: --- → affected
status-firefox50: --- → affected
status-firefox-esr45: --- → affected
Crash volume for signature 'mozilla::dom::DeferredFinalizerImpl<T>::DeferredFinalize': - nightly (version 52): 3 crashes from 2016-09-19. - aurora (version 51): 0 crashes from 2016-09-19. - beta (version 50): 14 crashes from 2016-09-20. - release (version 49): 37 crashes from 2016-09-05. - esr (version 45): 1651 crashes from 2016-07-25. Crash volume on the last weeks (Week N is from 10-17 to 10-23): W. N-1 W. N-2 W. N-3 W. N-4 - nightly 0 2 1 0 - aurora 0 0 0 0 - beta 1 5 3 2 - release 11 11 8 2 - esr 198 195 175 191 Affected platforms: Windows, Mac OS X, Linux Crash rank on the last 7 days: Browser Content Plugin - nightly - aurora - beta #4214 #4056 - release #3355 #2032 - esr #56
status-firefox52: --- → affected
Crash volume for signature 'mozilla::dom::DeferredFinalizerImpl<T>::DeferredFinalize': - nightly (version 54): 4 crashes from 2017-01-23. - aurora (version 53): 0 crashes from 2017-01-23. - beta (version 52): 22 crashes from 2017-01-23. - release (version 51): 22 crashes from 2017-01-16. - esr (version 45): 6458 crashes from 2016-08-10. Crash volume on the last weeks (Week N is from 02-06 to 02-12): W. N-1 W. N-2 W. N-3 W. N-4 W. N-5 W. N-6 W. N-7 - nightly 2 0 - aurora 0 0 - beta 10 0 - release 13 6 0 - esr 371 384 343 341 279 236 308 Affected platforms: Windows, Mac OS X, Linux Crash rank on the last 7 days: Browser Content Plugin - nightly #278 - aurora - beta #1399 #669 - release #4391 #1339 - esr #53
status-firefox51: --- → affected
status-firefox54: --- → affected
Too late for firefox 52, mass-wontfix.
status-firefox52: affected → wontfix
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.