[edgy] Firefox Crashed [@js_MarkGCThing] [@ WrappedNativeJSGCThingMarker]

[Hugh Hyatt]

Binary package hint: firefox

From the Attached Crash Report:
Distro Release: Ubuntu 6.10
System Arch: i686
Package (version): firefox (2.0.0.3+0dfsg-0ubuntu0.6.10)
Source Package: firefox

Original Description:
Firefox crashes while system is idle
Left my system idling overnight, with automatic screen lock after 10 minutes. When I unlocked the screen the next morning, Firefox had crashed.

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Thank you for your report.

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Retraced Thread Stacktrace

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Retrace done:
...
#3 <signal handler called>
#4 js_MarkGCThing (cx=0x92307a8, thing=0x8de8ef0) at jsgc.c:2447
 flagp = (uint8 *) 0x18fff66 <Address 0x18fff66 out of bounds>
#5 0xb7e4dd84 in JS_MarkGCThing (cx=0x92307a8, thing=0x8de8ef0,
    name=0xb68380b4 "XPCWrappedNative::mFlatJSObject", arg=0x0) at jsapi.c:1862

#6 0xb682d242 in WrappedNativeJSGCThingMarker (table=0x98b7c88,
    hdr=0xa1c14cc, number=246, arg=0x92307a8) at xpcwrappednativescope.cpp:250
 wrapper = (class XPCWrappedNative *) 0x10b5d5e
#7 0xb7e60943 in JS_DHashTableEnumerate (table=0x98b7c88,
    etor=0xb682d200 <WrappedNativeJSGCThingMarker>, arg=0x92307a8)
    at jsdhash.c:674
 entryAddr = 0xa1c14cc ""
 entryLimit = 0xa1c56f0 ""
 i = <value optimized out>
 capacity = 2048
...

Tagging as mt-confirm for further processing

[Alexander Sack (asac)]

Hi,

we have not received any duplicates for some time. Thus, this crash was likely due to some unique plugin extension combination or has been fixed in the meantime.

Thanks for your contribution. Don't hesitate to submit new crashes,