Installing yahoo toolbar, possibily google browser sync, and other extensions with firefox beta 2.0 results in crash at startup. Looks like this might be 11th or so top ranked crash for the early beta testing. nsDOMClassInfo::MarkReachablePreservedWrappers 1a9bf9a3 Product ID Firefox2 Build ID 2006071020 Trigger Time 2006-07-13 15:57:29.0 Platform Win32 Operating System Windows NT 5.1 build 2600 Module firefox.exe + (0018c97d) URL visited User Comments installing yahoo toolbar 1.2 for firefox. crash on startup. Since Last Crash 236 sec Total Uptime 236 sec Trigger Reason Access violation Source File, Line No. c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5176 Stack Trace nsDOMClassInfo::MarkReachablePreservedWrappers [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5176] nsDOMGCParticipantSH::Mark [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 6912] XPC_WN_Helper_Mark [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1032] js_Mark [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 4581] MarkGCThingChildren [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1763] MarkGCThingChildren [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1785] js_MarkGCThing [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 2144] js_GC [c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 2512] To query for more/current blackboxes check http://talkback-public.mozilla.org/search/start.jsp?search=1&searchby=stacksig&match=contains&searchfor=+nsDOMClassInfo%3A%3AMarkReachablePreservedWrappers+1a9bf9a3&vendor=MozillaOrg&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid&rlimit=500

granrose found this in his early testing.

The Win32 2006 07 07 19 build seems to be the first instance of this particular stack signature in the database

Similar Stacktrace on Mac from around the same build dates looks a little deeper Signature nsDOMClassInfo::MarkReachablePreservedWrappers() 6f0626e1 Product ID Firefox2 Build ID 2006070719 Trigger Time 2006-07-13 13:24:38.0 Platform MacOSX Operating System Darwin 8.7.0 Module firefox-bin + (0022d7cc) URL visited User Comments Since Last Crash 25706 sec Total Uptime 49641 sec Trigger Reason SIGBUS: Bus Error: (signal 10) Source File, Line No. /builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/dom/src/base//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5176 Stack Trace nsDOMClassInfo::MarkReachablePreservedWrappers() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/dom/src/base//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5176] nsDOMClassInfo::MarkReachablePreservedWrappers() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/dom/src/base//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5176] XPC_WN_Helper_Mark() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src/xpconnect/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1032] js_Mark() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/jsobj.c, line 4583] MarkGCThingChildren() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/jsgc.c, line 1761] MarkGCThingChildren() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/jsgc.c, line 1787] gc_root_marker() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/jsgc.c, line 2211] JS_DHashTableEnumerate() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/jsdhash.c, line 675] js_GC() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/jsgc.c, line 2512] js_ForceGC() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/jsgc.c, line 2235] nsJSContext::ScriptEvaluated() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/dom/src/base//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 2120] nsJSContext::ScriptExecuted() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/dom/src/base//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 2195] AutoScriptEvaluate::~AutoScriptEvaluate() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src/xpconnect/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, l] nsXPCWrappedJSClass::CallMethod() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src/xpconnect/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1381] PrepareAndDispatch() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/xpcom/reflect/xptcall/src/md/unix//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_ppc_rhaps] SharedStub() _XPTC_InvokeByIndex() XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src/xpconnect/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/xpco] XPC_WN_GetterSetter() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src/xpconnect/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1475] js_Invoke() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/jsinterp.c, line 1349] js_InternalInvoke() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/jsinterp.c, line 1448] js_InternalGetOrSet() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/jsinterp.c, line 1508] js_SetProperty() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/jsobj.c, line 3455] js_Interpret() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/jsinterp.c, line 3835] js_Invoke() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/jsinterp.c, line 1368] nsXPCWrappedJSClass::CallMethod() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src/xpconnect/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1417] PrepareAndDispatch() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/xpcom/reflect/xptcall/src/md/unix//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_ppc_rhaps] SharedStub() _XPTC_InvokeByIndex() XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src/xpconnect/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/xpco] XPC_WN_CallMethod() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src/xpconnect/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1450] js_Invoke() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/jsinterp.c, line 1349] js_Interpret() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/jsinterp.c, line 4083] js_Invoke() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/jsinterp.c, line 1368] nsXPCWrappedJSClass::CallMethod() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/js/src/xpconnect/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1417] PrepareAndDispatch() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/xpcom/reflect/xptcall/src/md/unix//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_ppc_rhaps] SharedStub() nsHttpChannel::OnStopRequest() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/netwerk/protocol/http/src//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp, line 7] nsInputStreamPump::OnStateStop() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/extensions/transformiix/source/xslt/util//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/db/sqlite3/src/pragma.c, line 713] nsInputStreamPump::OnInputStreamReady() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/extensions/transformiix/source/xslt/util//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/db/sqlite3/src/pragma.c, li] nsInputStreamReadyEvent::EventHandler() PL_HandleEvent() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/xpcom/threads//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/xpcom/threads/plevent.c, line 689] PL_ProcessPendingEvents() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/xpcom/threads//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/xpcom/threads/plevent.c, line 623] CoreFoundation.368.27.0 + 0x234cc (0x907dc4cc) CoreFoundation.368.27.0 + 0x229fc (0x907db9fc) CoreFoundation.368.27.0 + 0x2247c (0x907db47c) HIToolbox.226.0.0 + 0x8740 (0x931eb740) HIToolbox.226.0.0 + 0x7d4c (0x931ead4c) HIToolbox.226.0.0 + 0x4cee4 (0x9322fee4) HIToolbox.226.0.0 + 0x4ccd4 (0x9322fcd4) nsAppShell::Run() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/widget/src/mac//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/widget/src/mac/nsAppShell.cpp, line 94] nsAppStartup::Run() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/extensions/transformiix/source/xslt/util//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/db/sqlite3/src/pragma.c, line 152] XRE_main() [/builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/build/unifox/ppc/toolkit/xre//builds/tinderbox/Fx-Mozilla1.8-release/Darwin_8.7.0_Depend/mozilla/toolkit/xre/nsAppRunner.cpp, line 2378] _start() start()

a change was made near c:/builds/tinderbox/Fx-Mozilla1.8-release/WINNT_5.2_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5176 a couple of weeks ago.. 1.292.2.38 <dbaron@dbaron.org> 2006-06-14 20:15 Bug 336791: land leak fixes that use nsIDOMGCParticipant to break cycles caused by JavaScript closures as XPCOM objects (bugs 241518, 319293, 319642, 322985, 323807, 323534, 325279, 326646, 339412, 206520, 321054, 339488). See individual bugs for reviewers. a181=darin

granrose reports that crash seen in builds at least back until 6/22.

Are there more precise steps to reproduce (i.e., something without "and other extensions")?

hey david - here's a yahoo toolbar that will install in 2.0b1. Repro steps: install toolbar, restart BE, crash.

any progress?

i think i've been seeing something like this several times a day on linux: ClassifyWrapper() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5237] PL_DHashTableEnumerate() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/xpcom/build/pldhash.c, line 684] nsDOMClassInfo::BeginGCMark() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5307] nsDOMClassInfo::MarkReachablePreservedWrappers() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5136] nsDOMGCParticipantSH::Mark() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 6912] XPC_WN_Helper_Mark() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1032] js_Mark() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsobj.c, line 4597] MarkGCThingChildren() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsgc.c, line 1817] js_MarkGCThing() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsgc.c, line 2161] gc_root_marker() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsgc.c, line 2225] JS_DHashTableEnumerate() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsdhash.c, line 675] js_GC() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsgc.c, line 2558] js_ForceGC() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsgc.c, line 2252] JS_GC() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsapi.c, line 1918] nsJSContext::Notify() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 2212] nsTimerImpl::Fire() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/xpcom/threads/nsTimerImpl.cpp, line 398] handleTimerEvent() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/xpcom/threads/nsTimerImpl.cpp, line 462] PL_HandleEvent() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/xpcom/threads/plevent.c, line 689] PL_ProcessPendingEvents() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/xpcom/threads/plevent.c, line 623] nsEventQueueImpl::ProcessPendingEvents() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/xpcom/threads/nsEventQueue.cpp, line 421] event_processor_callback() [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.EL_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp, line 67] is this the same or a little different?

Different. And please use attachments for full stacks rather than pasting them in the bug.

Pretty major one-liner here. We were ending up crashing on a null SCCIndex because of a failed QueryInterface.

Comment on attachment 230804 [details] [diff] [review] patch r+sr=jst

Checked in to trunk.

Comment on attachment 230804 [details] [diff] [review] patch This is a crash that happens anytime anything interesting enough to have preserved wrappers ends up inside a document fragment. It's low risk, since it's touching only the document fragment code, and document fragments are pretty rarely used (especially judging from how long it took this bug to be noticed).

Fix checked in to MOZILLA_1_8_BRANCH.

Thanks, David! I've confirmed that the toolbar no longer crashes in the latest trunk and 1.8 branch builds.

Verified FIXED Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1b1) Gecko/20060731 BonEcho/2.0b1. With Yahoo! toolbar installed, I not longer crash on startup.