Bug#695625: iceweasel: hang in js::WeakMapBase::markAllIteratively

Vincent Lefevre vincent at vinc17.net
Mon Dec 10 22:15:34 UTC 2012


Package: iceweasel
Version: 10.0.11esr-1
Severity: important

Iceweasel got frozen just after I entered a comment in Facebook,
taking 100% CPU time. I first tried a "strace -p ...", but the
output was empty, i.e. there were no system calls. They I tried
gdb several times and got the following backtraces. Iceweasel
apparently hangs in js::WeakMapBase::markAllIteratively.

0x00007f4bd1af1118 in Range (e=0x7f4b91f39f00, this=<optimized out>, 
    c=0x7f4b91f39c00) at ./../../dist/include/js/HashTable.h:184
184     ./../../dist/include/js/HashTable.h: No such file or directory.
(gdb) bt
#0  0x00007f4bd1af1118 in Range (e=0x7f4b91f39f00, this=<optimized out>, 
    c=0x7f4b91f39c00) at ./../../dist/include/js/HashTable.h:184
#1  all (this=<optimized out>) at ./../../dist/include/js/HashTable.h:637
#2  all (this=0x7f4b91f8f2d0) at ./../../dist/include/js/HashTable.h:1092
#3  js::WeakMap<JSObject*, JS::Value, js::DefaultHasher<JSObject*>, js::DefaultMarkPolicy<JSObject*, JS::Value> >::markIteratively (this=0x7f4b91f8f2c0, 
    tracer=0x7fff2b3f2e40)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsweakmap.h:218
#4  0x00007f4bd1af095c in js::WeakMapBase::markAllIteratively (
    tracer=0x7fff2b3f2e40)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsweakmap.cpp:67
#5  0x00007f4bd1a1f5dc in EndMarkPhase (gcmarker=0x7fff2b3f2e40, 
    cx=0x7f4b951919f0, gckind=<optimized out>)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsgc.cpp:2518
#6  MarkAndSweep (gckind=GC_NORMAL, cx=0x7f4b951919f0)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsgc.cpp:2676
#7  GCCycle (cx=cx at entry=0x7f4b951919f0, comp=comp at entry=0x0, 
    gckind=gckind at entry=GC_NORMAL)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsgc.cpp:2921
#8  0x00007f4bd1a20603 in js_GC (cx=cx at entry=0x7f4b951919f0, comp=0x0, 
    gckind=gckind at entry=GC_NORMAL, reason=reason at entry=js::gcstats::LASTDITCH)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsgc.cpp:2983
#9  0x00007f4bd1a20c20 in RunLastDitchGC (cx=0x7f4b951919f0)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsgc.cpp:1612
#10 js::gc::ArenaLists::refillFreeList (cx=0x7f4b951919f0, 
    thingKind=js::gc::FINALIZE_OBJECT8_BACKGROUND)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsgc.cpp:1640
#11 0x00007f4bd19dcbaf in NewGCThing<JSObject> (thingSize=<optimized out>, 
    kind=js::gc::FINALIZE_OBJECT8_BACKGROUND, cx=0x7f4b951919f0)
    at ../../../js/src/jsgcinlines.h:355
#12 js_NewGCObject (kind=js::gc::FINALIZE_OBJECT8_BACKGROUND, 
    cx=0x7f4b951919f0) at ../../../js/src/jsgcinlines.h:362
#13 NewObject<false, false> (parent=0x0, proto=0x7f4b1dd1bd78, 
    clasp=0x7f4bd1ed75e0, kind=js::gc::FINALIZE_OBJECT8_BACKGROUND, 
    cx=0x7f4b951919f0) at ../../../js/src/jsobjinlines.h:1647
#14 NewArray<false> (proto=<optimized out>, length=0, cx=0x7f4b951919f0)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsarray.cpp:3874
#15 js::NewDenseUnallocatedArray (cx=0x7f4b951919f0, length=0, 
    proto=<optimized out>)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsarray.cpp:3919
#16 0x00007f4bd1b92fdf in js::mjit::Compiler::jsop_newinit (
    this=this at entry=0x7fff2b3f34b0)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/methodjit/Compiler.cpp:6455
#17 0x00007f4bd1ba1064 in js::mjit::Compiler::generateMethod (
    this=this at entry=0x7fff2b3f34b0)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/methodjit/Compiler.cpp:2375
#18 0x00007f4bd1ba3502 in js::mjit::Compiler::performCompilation (
    this=this at entry=0x7fff2b3f34b0, jitp=jitp at entry=0x7f4b4cef2c30)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/methodjit/Compiler.cpp:534
#19 0x00007f4bd1ba359e in js::mjit::Compiler::compile (
    this=this at entry=0x7fff2b3f34b0)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/methodjit/Compiler.cpp:158
#20 0x00007f4bd1ba3719 in js::mjit::TryCompile (cx=0x7f4b951919f0, 
    script=0x7f4b4cef2b80, construct=false)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/methodjit/Compiler.cpp:641
#21 0x00007f4bd1a55c79 in CanMethodJIT (
    request=js::mjit::CompileRequest_Interpreter, construct=false, 
    script=0x7f4b4cef2b80, cx=0x7f4b951919f0)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/methodjit/MethodJIT-inl.h:79
#22 CanMethodJIT (request=js::mjit::CompileRequest_Interpreter, 
    construct=false, script=0x7f4b4cef2b80, cx=0x7f4b951919f0)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsinterp.cpp:1585
#23 js::Interpret (cx=0x7f4b951919f0, entryFrame=0x7f4bb69ff410, 
    interpMode=js::JSINTERP_NORMAL)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsinterp.cpp:3989
#24 0x00007f4bd1c05739 in UncachedInlineCall (f=..., initial=<optimized out>, 
    pret=0x7fff2b3f7f70, unjittable=<optimized out>, argc=argc at entry=4)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/methodjit/InvokeHelpers.cpp:392
#25 0x00007f4bd1c06c6c in js::mjit::stubs::UncachedCallHelper (f=..., argc=4, 
    lowered=<optimized out>, ucr=<optimized out>)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/methodjit/InvokeHelpers.cpp:479
#26 0x00007f4bd1bf2f6f in CallCompiler::update (this=0x7fff2b3f7fc0)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/methodjit/MonoIC.cpp:1100
#27 0x00007f4bd1bef713 in js::mjit::ic::Call (f=..., ic=<optimized out>)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/methodjit/MonoIC.cpp:1160
#28 0x00007f4b994faf3b in ?? ()
#29 0x0000000400000000 in ?? ()
#30 0x000000000000010d in ?? ()
#31 0x00007fff2b3f9b90 in ?? ()
#32 0x0000000000000000 in ?? ()

#0  0x00007f4bd1af1008 in keyMarked (k=0x7f4bb628eb88, 
    this=<synthetic pointer>)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsweakmap.h:263
#1  markEntryIfLive (v=..., k=0x7f4bb628eb88, this=<synthetic pointer>)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsweakmap.h:288
#2  js::WeakMap<JSObject*, JS::Value, js::DefaultHasher<JSObject*>, js::DefaultMarkPolicy<JSObject*, JS::Value> >::markIteratively (this=<optimized out>, 
    tracer=0x7fff2b3f2e40)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsweakmap.h:220
#3  0x00007f4bd1af095c in js::WeakMapBase::markAllIteratively (
    tracer=0x7fff2b3f2e40)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsweakmap.cpp:67
#4  0x00007f4bd1a1f5dc in EndMarkPhase (gcmarker=0x7fff2b3f2e40, 
    cx=0x7f4b951919f0, gckind=<optimized out>)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsgc.cpp:2518
[...]

#0  0x00007f4bd1af1118 in Range (e=0x7f4b91f39f00, this=<optimized out>, 
    c=0x7f4b91f39c00) at ./../../dist/include/js/HashTable.h:184
#1  all (this=<optimized out>) at ./../../dist/include/js/HashTable.h:637
#2  all (this=0x7f4b91f8f2d0) at ./../../dist/include/js/HashTable.h:1092
#3  js::WeakMap<JSObject*, JS::Value, js::DefaultHasher<JSObject*>, js::DefaultMarkPolicy<JSObject*, JS::Value> >::markIteratively (this=0x7f4b91f8f2c0, 
    tracer=0x7fff2b3f2e40)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsweakmap.h:218
#4  0x00007f4bd1af095c in js::WeakMapBase::markAllIteratively (
    tracer=0x7fff2b3f2e40)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsweakmap.cpp:67
#5  0x00007f4bd1a1f5dc in EndMarkPhase (gcmarker=0x7fff2b3f2e40, 
    cx=0x7f4b951919f0, gckind=<optimized out>)
    at /tmp/buildd/iceweasel-10.0.11esr/js/src/jsgc.cpp:2518
[...]

After more than 10 minutes, I killed Iceweasel.

-- Package-specific info:

-- Extensions information
Name: -Global Styles- userstyle
Status: enabled

Name: Adblock Plus
Location: ${PROFILE_EXTENSIONS}/{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
Status: enabled

Name: Add-on Compatibility Reporter
Location: ${PROFILE_EXTENSIONS}/compatibility at addons.mozilla.org.xpi
Status: enabled

Name: AlloCiné userstyle
Status: enabled

Name: Bamboo Feed Reader
Location: ${PROFILE_EXTENSIONS}/{b2e69492-2358-071a-7056-24ad0c3defb1}
Status: enabled

Name: Cinémathèque Française userstyle
Status: enabled

Name: Combine Stop/Reload buttons userstyle
Status: enabled

Name: DOM Inspector
Location: ${PROFILE_EXTENSIONS}/inspector at mozilla.org
Status: enabled

Name: Default theme
Location: /usr/lib/iceweasel/extensions/{972ce4c6-7e08-4474-a285-3208198ce6fd}
Package: iceweasel
Status: enabled

Name: Dictionnaire français «Moderne»
Location: ${PROFILE_EXTENSIONS}/fr-moderne at dictionaries.addons.mozilla.org
Status: enabled

Name: Different cursor for links that open in new windows userstyle
Status: enabled

Name: Disable autocomplete userstyle
Status: user-disabled

Name: Disable marquee userstyle
Status: user-disabled

Name: DownloadHelper
Location: ${PROFILE_EXTENSIONS}/{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
Status: enabled

Name: Flagfox
Location: ${PROFILE_EXTENSIONS}/{1018e4d6-728f-4b20-ad56-37578a4de76b}
Status: enabled

Name: Flashblock
Location: ${PROFILE_EXTENSIONS}/{3d7eb24f-2740-49df-8937-200b1cc08f8a}.xpi
Status: enabled

Name: Font Finder
Location: ${PROFILE_EXTENSIONS}/fontfinder at bendodson.com.xpi
Status: enabled

Name: Forecastfox
Location: ${PROFILE_EXTENSIONS}/{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
Status: enabled

Name: GLPI - assistance.ens-lyon.fr userstyle
Status: enabled

Name: Google Search userstyle
Status: enabled

Name: Greasemonkey
Location: ${PROFILE_EXTENSIONS}/{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
Status: enabled

Name: HeadingsMap
Location: ${PROFILE_EXTENSIONS}/headings at niquelheadings.net.xpi
Status: enabled

Name: IMDb userstyle
Status: enabled

Name: Link Widgets
Location: ${PROFILE_EXTENSIONS}/linkwidget at clav.mozdev.org
Status: enabled

Name: Live HTTP headers
Location: ${PROFILE_EXTENSIONS}/{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}
Status: enabled

Name: Move tabbar to the bottom userstyle
Status: user-disabled

Name: Move tabbar to the left userstyle
Status: user-disabled

Name: Move tabbar to the right userstyle
Status: user-disabled

Name: Multiple row bookmark toolbar userstyle
Status: user-disabled

Name: Nerim userstyle
Status: enabled

Name: Open in Browser
Location: ${PROFILE_EXTENSIONS}/openinbrowser at www.spasche.net.xpi
Status: enabled

Name: PeopleForCinema userstyle
Status: enabled

Name: Pinger
Location: ${PROFILE_EXTENSIONS}/janetka at pinger.xpi
Status: enabled

Name: QuickWiki
Location: ${PROFILE_EXTENSIONS}/{EE223D7A-F30F-11DD-8F0A-D2AD55D89593}.xpi
Status: enabled

Name: SearchStatus
Location: ${PROFILE_EXTENSIONS}/{d57c9ff1-6389-48fc-b770-f78bd89b6e8a}.xpi
Status: enabled

Name: Showcase
Location: ${PROFILE_EXTENSIONS}/{89506680-e3f4-484c-a2c0-ed711d481eda}.xpi
Status: user-disabled

Name: Slashdot.org - Remove ads userstyle
Status: enabled

Name: SourceForge font size in comments userstyle
Status: enabled

Name: Stylish
Location: ${PROFILE_EXTENSIONS}/{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi
Status: enabled

Name: Stylish-Custom
Location: ${PROFILE_EXTENSIONS}/Stylish-Custom at choggi.dyndns.org
Status: enabled

Name: Tab Mix Plus
Location: ${PROFILE_EXTENSIONS}/{dc572301-7619-498c-a57d-39143191b318}.xpi
Status: enabled

Name: TinEye Reverse Image Search
Location: ${PROFILE_EXTENSIONS}/tineye at ideeinc.com
Status: enabled

Name: United States English Spellchecker
Location: ${PROFILE_EXTENSIONS}/en-US at dictionaries.addons.mozilla.org
Status: enabled

Name: Web Developer
Location: ${PROFILE_EXTENSIONS}/{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi
Status: enabled

Name: Wikipedia font size userstyle
Status: enabled

Name: X-Ray
Location: ${PROFILE_EXTENSIONS}/{3f1182ea-3243-4d32-8826-71fb1cc9c328}
Status: enabled

Name: YesScript
Location: ${PROFILE_EXTENSIONS}/yesscript at userstyles.org.xpi
Status: enabled

Name: allocine-imdb user-script
Status: enabled

Name: cac-imdb user-script
Status: enabled

Name: gTranslate
Location: ${PROFILE_EXTENSIONS}/{aff87fa2-a58e-4edd-b852-0a20203c1e17}.xpi
Status: enabled

Name: itt-datetimes user-script
Status: enabled

Name: twitter-times user-script
Status: enabled

Name: us-to-iso8601 user-script
Status: user-disabled

-- Plugins information
Name: DivX® Web Player
Location: /usr/lib/mozilla/plugins/libtotem-mully-plugin.so
Package: totem-mozilla
Status: enabled

Name: DivX® Web Player
Location: /usr/lib/mozilla/plugins/libtotem-mully-plugin.so
Package: totem-mozilla
Status: enabled

Name: DjView-4.9
Location: /usr/lib/mozilla/plugins/nsdejavu.so
Package: djview-plugin
Status: enabled

Name: Gnome Shell Integration
Location: /usr/lib/mozilla/plugins/libgnome-shell-browser-plugin.so
Package: gnome-shell
Status: enabled

Name: QuickTime Plug-in 7.6.6
Location: /usr/lib/mozilla/plugins/libtotem-narrowspace-plugin.so
Package: totem-mozilla
Status: enabled

Name: Shockwave Flash
Location: /usr/lib/flashplugin-nonfree/libflashplayer.so
Status: enabled

Name: VLC Multimedia Plugin (compatible Totem 3.0.1)
Location: /usr/lib/mozilla/plugins/libtotem-cone-plugin.so
Package: totem-mozilla
Status: enabled

Name: VLC Web Plugin
Location: /usr/lib/mozilla/plugins/libvlcplugin.so
Package: browser-plugin-vlc
Status: enabled

Name: Windows Media Player Plug-in 10 (compatible; Totem)
Location: /usr/lib/mozilla/plugins/libtotem-gmp-plugin.so
Package: totem-mozilla
Status: enabled

Name: gxine starter plugin
Location: /usr/lib/gxine/gxineplugin.so
Package: gxineplugin
Status: enabled


-- Addons package information
ii  browser-plugin 2.0.0-2      amd64        multimedia plugin for web browser
ii  djview-plugin  4.9-3        amd64        Browser plugin for the DjVu image
ii  gnome-shell    3.4.2-4      amd64        graphical shell for the GNOME des
ii  gxineplugin    0.5.907-2    amd64        the xine video player, GTK+/Gnome
ii  iceweasel      10.0.11esr-1 amd64        Web browser based on Firefox
ii  totem-mozilla  3.0.1-8      amd64        Totem Mozilla plugin

-- System Information:
Debian Release: wheezy/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 3.5-trunk-amd64 (SMP w/2 CPU cores)
Locale: LANG=POSIX, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages iceweasel depends on:
ii  debianutils         4.3.4
ii  fontconfig          2.9.0-7
ii  libc6               2.13-37
ii  libgdk-pixbuf2.0-0  2.26.1-1
ii  libglib2.0-0        2.33.12+really2.32.4-3
ii  libgtk2.0-0         2.24.10-2
ii  libnspr4            2:4.9.3-1
ii  libnspr4-0d         2:4.9.3-1
ii  libsqlite3-0        3.7.14.1-1
ii  libstdc++6          4.7.2-4
ii  procps              1:3.3.4-2
ii  xulrunner-10.0      10.0.11esr-1

iceweasel recommends no packages.

Versions of packages iceweasel suggests:
ii  fonts-stix [otf-stix]  1.1.0-1
ii  libgssapi-krb5-2       1.10.1+dfsg-3
pn  mozplugger             <none>

Versions of packages xulrunner-10.0 depends on:
ii  libasound2                1.0.25-4
ii  libatk1.0-0               2.4.0-2
ii  libbz2-1.0                1.0.6-4
ii  libc6                     2.13-37
ii  libcairo2                 1.12.2-2
ii  libdbus-1-3               1.6.8-1
ii  libdbus-glib-1-2          0.100-1
ii  libevent-2.0-5            2.0.19-stable-3
ii  libfontconfig1            2.9.0-7
ii  libfreetype6              2.4.9-1
ii  libgcc1                   1:4.7.2-4
ii  libgdk-pixbuf2.0-0        2.26.1-1
ii  libglib2.0-0              2.33.12+really2.32.4-3
ii  libgtk2.0-0               2.24.10-2
ii  libhunspell-1.3-0         1.3.2-4
ii  libjpeg8                  8d-1
ii  libmozjs10d               10.0.11esr-1
ii  libnotify4                0.7.5-1
ii  libnspr4-0d               2:4.9.3-1
ii  libnss3-1d                2:3.14-2
ii  libpango1.0-0             1.30.0-1
ii  libpixman-1-0             0.26.0-3
ii  libreadline6              6.2-9
ii  libsqlite3-0              3.7.14.1-1
ii  libstartup-notification0  0.12-1
ii  libstdc++6                4.7.2-4
ii  libvpx1                   1.1.0-1
ii  libx11-6                  2:1.5.0-1
ii  libxext6                  2:1.3.1-2
ii  libxrender1               1:0.9.7-1
ii  libxt6                    1:1.1.3-1
ii  zlib1g                    1:1.2.7.dfsg-13

Versions of packages xulrunner-10.0 suggests:
ii  libcanberra0  0.28-6
ii  libgnomeui-0  2.24.5-2

-- no debconf information



More information about the pkg-mozilla-maintainers mailing list