I was testing Fennec's SessionStore to make sure that the "Tabs from last time" feature worked in the event of a restart, not just a normal shutdown. I got a crash in the CycleCollector: #0 0xb77ca832 in ?? () from /lib/ld-linux.so.2 #1 0xb52c2ce6 in nanosleep () from /lib/tls/i686/cmov/libc.so.6 #2 0xb52c2b10 in sleep () from /lib/tls/i686/cmov/libc.so.6 #3 0xb57fae0d in ah_crap_handler (signum=11) at /home/mfinkle/source/mozilla-trunk/mozilla/toolkit/xre/nsSigHandlers.cpp:132 #4 0xb57fae66 in child_ah_crap_handler (signum=11) at /home/mfinkle/source/mozilla-trunk/mozilla/toolkit/xre/nsSigHandlers.cpp:145 #5 <signal handler called> #6 0xb6d1203e in canonicalize (in=0xb1b4ada4) at /home/mfinkle/source/mozilla-trunk/mozilla/xpcom/base/nsCycleCollector.cpp:1209 #7 0xb6d12855 in GCGraphBuilder::NoteXPCOMChild (this=0xbf8d8fa4, child=0xb1b4ada4) at /home/mfinkle/source/mozilla-trunk/mozilla/xpcom/base/nsCycleCollector.cpp:1555 #8 0xb5d9c3e7 in nsDocument::cycleCollection::Traverse (this=0xb75ebcc4, p=0xb0468c00, cb=...) at /home/mfinkle/source/mozilla-trunk/mozilla/content/base/src/nsDocument.cpp:1680 #9 0xb5f72699 in nsHTMLDocument::cycleCollection::Traverse (this=0xb75ebcc4, p=0xb0468c00, cb=...) at /home/mfinkle/source/mozilla-trunk/mozilla/content/html/document/src/nsHTMLDocument.cpp:243 #10 0xb6d12647 in GCGraphBuilder::Traverse (this=0xbf8d8fa4, aPtrInfo=0xadd11f0c) at /home/mfinkle/source/mozilla-trunk/mozilla/xpcom/base/nsCycleCollector.cpp:1484 #11 0xb6d12c22 in nsCycleCollector::MarkRoots (this=0xb3e21800, builder=...) at /home/mfinkle/source/mozilla-trunk/mozilla/xpcom/base/nsCycleCollector.cpp:1706 #12 0xb6d136c4 in nsCycleCollector::BeginCollection (this=0xb3e21800) at /home/mfinkle/source/mozilla-trunk/mozilla/xpcom/base/nsCycleCollector.cpp:2645 #13 0xb6d13a48 in nsCycleCollector_beginCollection () at /home/mfinkle/source/mozilla-trunk/mozilla/xpcom/base/nsCycleCollector.cpp:3232 #14 0xb65684ab in XPCCycleCollectGCCallback (cx=0xb33b6800, status=JSGC_MARK_END) at /home/mfinkle/source/mozilla-trunk/mozilla/js/src/xpconnect/src/nsXPConnect.cpp:363 #15 0xb4f881d7 in GC (cx=0xb33b6800) at /home/mfinkle/source/mozilla-trunk/mozilla/js/src/jsgc.cpp:3283 #16 0xb4f88a98 in GCUntilDone (cx=0xb33b6800, gckind=GC_NORMAL) at /home/mfinkle/source/mozilla-trunk/mozilla/js/src/jsgc.cpp:3655 #17 0xb4f88bec in js_GC (cx=0xb33b6800, gckind=GC_NORMAL) at /home/mfinkle/source/mozilla-trunk/mozilla/js/src/jsgc.cpp:3709 #18 0xb4f26e30 in JS_GC (cx=0xb33b6800) at /home/mfinkle/source/mozilla-trunk/mozilla/js/src/jsapi.cpp:2447 #19 0xb65686f3 in nsXPConnect::Collect (this=0xb3e16780) at /home/mfinkle/source/mozilla-trunk/mozilla/js/src/xpconnect/src/nsXPConnect.cpp:465 #20 0xb6d134ed in nsCycleCollector::Collect (this=0xb3e21800, aTryCollections=5) at /home/mfinkle/source/mozilla-trunk/mozilla/xpcom/base/nsCycleCollector.cpp:2523 ---Type <return> to continue, or q <return> to quit--- #21 0xb6d137f3 in nsCycleCollector::Shutdown (this=0xb3e21800) at /home/mfinkle/source/mozilla-trunk/mozilla/xpcom/base/nsCycleCollector.cpp:2751 #22 0xb6d13b53 in nsCycleCollector_shutdown () at /home/mfinkle/source/mozilla-trunk/mozilla/xpcom/base/nsCycleCollector.cpp:3254 #23 0xb6c92496 in mozilla::ShutdownXPCOM (servMgr=0x0) at /home/mfinkle/source/mozilla-trunk/mozilla/xpcom/build/nsXPComInit.cpp:654 #24 0xb6c920ba in NS_ShutdownXPCOM_P (servMgr=0x0) at /home/mfinkle/source/mozilla-trunk/mozilla/xpcom/build/nsXPComInit.cpp:558 #25 0xb57fb56a in XRE_TermEmbedding () at /home/mfinkle/source/mozilla-trunk/mozilla/toolkit/xre/nsEmbedFunctions.cpp:219 #26 0xb6b5d9a7 in mozilla::ipc::ScopedXREEmbed::Stop (this=0xb3e2d1b4) at /home/mfinkle/source/mozilla-trunk/mozilla/ipc/glue/ScopedXREEmbed.cpp:100 #27 0xb6b22a32 in mozilla::dom::ContentProcessProcess::CleanUp (this=0xb3e2d020) at /home/mfinkle/source/mozilla-trunk/mozilla/dom/ipc/ContentProcessProcess.cpp:63 #28 0xb57fbb78 in XRE_InitChildProcess (aArgc=1, aArgv=0xbf8ddeb4, aProcess=GeckoProcessType_Content) at /home/mfinkle/source/mozilla-trunk/mozilla/toolkit/xre/nsEmbedFunctions.cpp:431 #29 0x08049357 in main (argc=3, argv=0xbf8ddeb4) at /home/mfinkle/source/mozilla-trunk/mozilla/ipc/app/MozillaRuntimeMain.cpp:87

Very reproducible

I'm 99% positive this is bug 572980 showing up. It'll disappear when we merge e10s to m-c.