I can confirm this behaviour in the recent stable version. Looking at
attached backtrace, the crash seems to happen inside the javascript
garbage collector.
Matthew: For debugging, you can install the necessary packages:
apt-get install gdb icdeove-dbg
Then run icedove in gdb. You can find more information at
https://wiki.debian.org/HowToGetABacktrace
Then we can see if your crashes are the same problem or something different.
#0 0x00007ffff299e53c in chunk (this=0x0) at
/build/icedove-tNL3mB/icedove-45.1.0/mozilla/js/src/gc/Heap.h:1332
addr = 0
#1 runtimeFromAnyThread (this=0x0) at
/build/icedove-tNL3mB/icedove-45.1.0/mozilla/js/src/gc/Heap.h:1309
No locals.
#2 IsAboutToBeFinalizedInternal<js::ObjectGroup>
(thingp=thingp@entry=0x7fffde6f3d70)
at /build/icedove-tNL3mB/icedove-45.1.0/mozilla/js/src/gc/Marking.cpp:2383
thing = 0x0
nursery = <error reading variable nursery (Cannot access memory at
address 0xffff8)>
#3 js::gc::IsAboutToBeFinalized<js::ObjectGroup*>
(thingp=thingp@entry=0x7fffde6f3d70)
at /build/icedove-tNL3mB/icedove-45.1.0/mozilla/js/src/gc/Marking.cpp:2460
No locals.
#4 0x00007ffff2895396 in js::ObjectGroupCompartment::sweepNewTable
(this=<optimized out>, table=<optimized out>)
at
/build/icedove-tNL3mB/icedove-45.1.0/mozilla/js/src/vm/ObjectGroup.cpp:1808
entry = {
group = {<js::ReadBarrieredBase<js::ObjectGroup*>> =
{<js::BarrieredBase<js::ObjectGroup*>> =
{<js::BarrieredBaseMixins<js::ObjectGroup*>> = {<No data fields>}, value =
0x0}, <No data fields>}, <No data fields>}, associated = 0x0}
e = {<js::detail::HashTable<js::ObjectGroupCompartment::NewEntry const,
js::HashSet<js::ObjectGroupCompartment::NewEntry,
js::ObjectGroupCompartment::NewEntry, js::SystemAllocPolicy>::SetOps,
js::SystemAllocPolicy>::Range> = {cur = 0x7fffb3d4f580, end = 0x7fffb3d4f700},
table_ = @0x7fffaa7646e0,
rekeyed = false, removed = false}
this = <optimized out>
table = <optimized out>
#5 0x00007ffff289c96c in js::ObjectGroupCompartment::sweep (this=<optimized
out>, fop=<optimized out>)
at
/build/icedove-tNL3mB/icedove-45.1.0/mozilla/js/src/vm/ObjectGroup.cpp:1799
No locals.
#6 0x00007ffff277bbb5 in SweepObjectGroupsTask::run (this=0x7fffffffc480) at
/build/icedove-tNL3mB/icedove-45.1.0/mozilla/js/src/jsgc.cpp:4997
c = {iterMarker = {gc = 0x7fffdfd0f3f8}, zone = {current =
0x7fffc18b8000}, comp = {mIsSome = true, mStorage = {u = {mBytes = {0 '\000',
-128 '\200',
-117 '\213', -63 '\301', -1 '\377', 127 '\177', 0 '\000', 0
'\000', <optimized out>, <optimized out>, <optimized out>, <optimized out>,
<optimized out>, <optimized out>, <optimized out>, <optimized
out>}, mDummy = 140736440532992}}}}
#7 0x00007ffff285691c in js::GCParallelTask::runFromHelperThread
(this=0x7fffffffc480)
at
/build/icedove-tNL3mB/icedove-45.1.0/mozilla/js/src/vm/HelperThreads.cpp:974
timeStart = 1467493323522826
#8 0x00007ffff2858078 in js::HelperThread::handleGCParallelWorkload
(this=0x7fffe74f65a8)
at
/build/icedove-tNL3mB/icedove-45.1.0/mozilla/js/src/vm/HelperThreads.cpp:997
No locals.
#9 0x00007ffff285ace0 in js::HelperThread::threadLoop (this=0x7fffe74f65a8) at
/build/icedove-tNL3mB/icedove-45.1.0/mozilla/js/src/vm/HelperThreads.cpp:1594
ionCompile = false
stackLimit = <optimized out>
#10 0x00007ffff64b7178 in _pt_root (arg=0x7ffff6b5b8e0) at
/build/icedove-tNL3mB/icedove-45.1.0/mozilla/nsprpub/pr/src/pthreads/ptthread.c:216
rv = <optimized out>
thred = 0x7ffff6b5b8e0
detached = 0
id = 140736925222656
tid = 7276
#11 0x00007ffff7bc70a4 in start_thread (arg=0x7fffde6f4700) at
pthread_create.c:309
__res = <optimized out>
pd = 0x7fffde6f4700
now = <optimized out>
unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140736925222656,
7338197234711684801, 1, 140737354125408, 140737332492512, 140736925222656,
-7338264440216852799, -7338214298799020351}, mask_was_saved =
0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0,
canceltype = 0}}}
not_first_call = <optimized out>
pagesize_m1 = <optimized out>
sp = <optimized out>
freesize = <optimized out>
__PRETTY_FUNCTION__ = "start_thread"
#12 0x00007ffff6ed687d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:111
No locals.
