firefox crashes on tab mix plus session restore

[Marc Horowitz]

Binary package hint: firefox-3.5

Before I upgraded from Jaunty (with firefox 3.0.x) to Karmic (firefox 3.5.x), I saved my current session of 34 windows and about 190 tabs. Firefox 3.5 is unable to restore this session; it crashes every time.* After churning for a minute or two, it seg faults. apport is overwhelmed:

  Sorry, the program "firefox" closed unexpectedly

  Your computer does not have enough free memory to automatically analyze the problem and send a report to the developers.

So I let it dump core and took a stack trace by hand. Each stack trace is different, but they all have a common characteristic: over 2000 frames of this over and over again:

#2673 0x412d661f in nsThread::Shutdown (this=0x4d243420) at nsThread.cpp:468
#2674 0x412e2c27 in NS_InvokeByIndex_P () from /usr/lib/xulrunner-1.9.1.6/libxul.so
#2675 0x412dabf1 in nsProxyObjectCallInfo::Run (this=0x4d28d1c0) at nsProxyEvent.cpp:181
#2676 0x412d62f9 in nsThread::ProcessNextEvent (this=0x406f7420, mayWait=1, result=0xbfdb6bc0) at nsThread.cpp:521
#2677 0x412a6b3f in NS_ProcessNextEvent_P (thread=0x0, mayWait=1) at nsThreadUtils.cpp:247
#2678 0x412d661f in nsThread::Shutdown (this=0x4d2432e0) at nsThread.cpp:468
#2679 0x412e2c27 in NS_InvokeByIndex_P () from /usr/lib/xulrunner-1.9.1.6/libxul.so
#2680 0x412dabf1 in nsProxyObjectCallInfo::Run (this=0x4d246cd0) at nsProxyEvent.cpp:181
#2681 0x412d62f9 in nsThread::ProcessNextEvent (this=0x406f7420, mayWait=1, result=0xbfdb6cdc) at nsThread.cpp:521
#2682 0x412a6b3f in NS_ProcessNextEvent_P (thread=0x0, mayWait=1) at nsThreadUtils.cpp:247

I should say I looked at $pc in frame 0 and in the topmost frame, and they differed by about 200k. Since I'm not running into the glibc stack limit, I can't be sure the deep stack is the cause of the core dump, but it's awfully suspicious, and the only remotely common thing about the multiple crashes I looked at.

I can't tell if something's just broken, or if there's some awful recursion which manages to complete in simpler cases but is failing catastrophically when there's an enormous amount of work to do.

When I start firefox again, it offers to restart the "previous" crashed session, which usually has between 12 and 24 tabs in it. If I restore a smaller session, firefox seems ok with it.

While I normally have a number of firefox add-ons enabled, the problem occurs if I enable only tab mix plus, which is necessary to restore the session it has stored.

----
* Ok, sometimes it just freezes. I seem to have forgotten to save the core, but in that case, free() caused a seg fault, which caused something in the signal handler to try to call free(), which deadlocked on a mutex. Oops. If it happens again I'll file a new bug with that stack trace.

ProblemType: Bug
Architecture: i386
Date: Wed Dec 30 01:09:01 2009
DistroRelease: Ubuntu 9.10
NonfreeKernelModules: openafs nvidia
Package: firefox 3.5.6+nobinonly-0ubuntu0.9.10.1
PackageArchitecture: all
ProcEnviron:
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/tcsh
ProcVersionSignature: Ubuntu 2.6.31-16.53-generic
SourcePackage: firefox-3.5
Uname: Linux 2.6.31-16-generic i686