[javascript][GC] crash in JS_TraceChildren

[Nizar Kerkeni]

Binary package hint: firefox-3.0

ubuntu hardy beta on i386
firefox crash when on, yahoo web mail, i choose to display a new mail.

ProblemType: Crash
Architecture: i386
Date: Tue Apr 1 17:32:24 2008
DistroRelease: Ubuntu 8.04
ExecutablePath: /usr/lib/firefox-3.0b4/firefox
NonfreeKernelModules: nvidia
Package: firefox-3.0 3.0~b4+nobinonly-0ubuntu1
PackageArchitecture: i386
ProcCmdline: /usr/lib/firefox-3.0b4/firefox -new-tab http://img376.imageshack.us/my.php?image=openoffice24li8.jpg
ProcEnviron:
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=fr_FR.UTF-8
 SHELL=/bin/bash
Signal: 11
SourcePackage: firefox-3.0
StacktraceTop:
 __kernel_vsyscall ()
 raise () from /lib/tls/i686/cmov/libpthread.so.0
 ?? () from /usr/lib/xulrunner-1.9b4/libxul.so
 ?? ()
 ?? ()
Title: firefox crashed with SIGSEGV in __kernel_vsyscall()
Uname: Linux 2.6.24-12-generic i686
UserGroups: adm admin audio cdrom dialout dip floppy lpadmin netdev plugdev powerdev sambashare scanner video

[Apport retracing service (apport)]

StacktraceTop:?? ()
JS_TraceChildren (trc=0xbf9bac3c, thing=0x916b3a0, kind=0) at jsgc.c:2214
nsXPConnect::Traverse (this=0x814f668, p=0x916b3a0, cb=@0xbf9bacfc) at nsXPConnect.cpp:919
GCGraphBuilder::Traverse (this=0xbf9bacfc, aPtrInfo=0xccbc4dc) at nsCycleCollector.cpp:1291
nsCycleCollector::MarkRoots (this=0x80e1ad0, builder=@0xbf9bacfc)

[Alexander Sack (asac)]

Resetting not frequently reported old crash reports.

Thanks for your contribution,
  - Alexander