536306 - Crash [@ checkReportFlags ] occurs when loading Eventbug and Selenium IDE

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Tanner M. Young [:tmyoung]]

http://crash-stats.mozilla.com/report/index/bp-df08c665-dee9-40d3-ad3a-112ac2091221
http://crash-stats.mozilla.com/report/index/bp-e4b41252-3432-4fba-92bf-536de2091221

When I installed Eventbug, the browser restarted but would crashed when it tried to load my profile.  I could select the profile but not start the browser.

Steps to reproduce:

1) Install Firebug 1.5X.0b8 ( http://getfirebug.com/releases/firebug/1.5X/firebug-1.5X.0b8.xpi )
2) Install Eventbug ( http://getfirebug.com/releases/eventbug/1.5/eventbug-0.1b1.xpi )
3) Restart the browser

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.3a1pre) Gecko/20091221 Minefield/3.7a1pre (.NET CLR 3.5.30729) ID:20091221052153

Comment 1

[John J. Barton]

We better check FF 3.6

Comment 2

[John J. Barton]

Actually I cannot reproduce this on FF 3.7 

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a1pre) Gecko/20091221 Minefield/3.7a1pre

Tanner do you have other extensions installed?

Comment 3

[Tanner M. Young [:tmyoung]]

Yes, a long list:

Adblock Plus 1.1.2
Add to Search Bar 1.8
AutoAuth 1.3
Better Gmail 2 0.9.4
Closure Inspector 0.9
DOM Inspector 2.0.4
DownloadHelper 4.6.2
EventBug 0.1b1 [DISABLED]
Firebug 1.5X.0b8
Html Validator 0.8.5.8
Microsoft .NET Framework Assistant 0.0.0 [DISABLED]
Minimap Addon 0.3.13
Mozilla QA Companion 1.2.1 [DISABLED]
MozMill 1.3 [DISABLED]
Nightly Tester Tools 2.0.3
Page Speed 1.4
Selenium IDE 1.0.2 [DISABLED]
Test Pilot 0.4
Wolfram Alpha Google 0.9 [DISABLED]
XSS Me 0.4.3

Either tonight or in the morning, I will figure out which one conflicts with Eventbug.

Comment 4

[Tanner M. Young [:tmyoung]]

Selenium IDE appears to be the offending add-on.

Updated STR:

1) Install Firebug 1.5X.0b8 (
http://getfirebug.com/releases/firebug/1.5X/firebug-1.5X.0b8.xpi )
2) Install Eventbug (
http://getfirebug.com/releases/eventbug/1.5/eventbug-0.1b1.xpi )
3) Install Selenium IDE ( http://release.openqa.org/selenium-ide/1.0.2/selenium-ide-1.0.2.xpi )
3) Restart the browser

Comment 5

[timeless]

Signature	checkReportFlags
UUID	df08c665-dee9-40d3-ad3a-112ac2091221
Time 	2009-12-21 15:34:07.264701
Uptime	2
Last Crash	20 seconds before submission
Product	Firefox
Version	3.7a1pre
Build ID	20091221052153
Branch	1.9.3
OS	Windows NT
OS Version	6.0.6002 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 6 model 23 stepping 7
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x18
User Comments	
Processor Notes 	
Related Bugs

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	mozjs.dll 	checkReportFlags 	js/src/jscntxt.cpp:1419
1 	mozjs.dll 	js_ReportErrorNumberVA 	js/src/jscntxt.cpp:1643
2 	mozjs.dll 	JS_ReportErrorFlagsAndNumber 	js/src/jsapi.cpp:5601
3 	mozjs.dll 	JSScopeProperty::set 	js/src/jsscope.h:857
4 	mozjs.dll 	js_SetPropertyHelper 	js/src/jsobj.cpp:4713
5 	mozjs.dll 	js_SetProperty 	js/src/jsobj.cpp:4826
6 	mozjs.dll 	JS_SetPropertyById 	js/src/jsapi.cpp:3598
7 	xul.dll 	XPC_SJOW_GetOrSetProperty 	
8 	xul.dll 	XPC_SJOW_SetProperty 	js/src/xpconnect/src/XPCSafeJSObjectWrapper.cpp:582
9 	mozjs.dll 	js_SetPropertyHelper 	js/src/jsobj.cpp:4811
10 	mozjs.dll 	js_Interpret 	js/src/jsops.cpp:1890
11 	mozjs.dll 	js_Invoke 	js/src/jsinterp.cpp:1384
12 	mozjs.dll 	js_InternalInvoke 	js/src/jsinterp.cpp:1439
13 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5106
14 	xul.dll 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:2164
15 	xul.dll 	nsGlobalWindow::RunTimeout 	dom/base/nsGlobalWindow.cpp:8130
16 	xul.dll 	nsGlobalWindow::TimerCallback 	dom/base/nsGlobalWindow.cpp:8474

Comment 6

[timeless]

Attachment: proposal

igor: if you object to this patch, please write your own. this is a one off donation.

Comment 7

[Igor Bukanov]

Comment on attachment 429458 [details] [diff] [review]
proposal

># HG changeset patch
># Parent fadc5f2804d701ca7b4770fecae1f5e3eb6a7dab
># User [e-mail]
>Bug 536306 Crash [@ checkReportFlags ] occurs when loading Eventbug and Selenium IDE
>r=igor
>
>diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
>--- a/js/src/jscntxt.cpp
>+++ b/js/src/jscntxt.cpp
>@@ -1419,7 +1419,10 @@ checkReportFlags(JSContext *cx, uintN *f
>     if (JSREPORT_IS_STRICT_MODE_ERROR(*flags)) {
>         /* Error in strict code; warning with strict option; okay otherwise. */
>         JS_ASSERT(JS_IsRunning(cx));
>-        if (js_GetTopStackFrame(cx)->script->strictModeCode)
>+        JSStackFrame *fp = js_GetTopStackFrame(cx);
>+        if (!fp->script)
>+            return true;
>+        if (fp->script->strictModeCode)

The issue here is that a script calls a native function that on behalf of it do the property assignment. So to cover that case the code should use I think not js_GetTopStackFrame(cx) but rather js_GetScriptedCaller and decide strictness based on that.

Comment 8

[Igor Bukanov]

Attachment: fix v1

The comments in the patch should explain the changes.

Comment 9

[timeless]

Comment on attachment 429622 [details] [diff] [review]
fix v1

+         * the nearest scripted frame is script, see bug 536306.

... is strict ?

Comment 10

[Igor Bukanov]

Attachment: fix v2

Here is a typo fix.

Comment 11

[timeless]

http://hg.mozilla.org/mozilla-central/rev/d25662b686bc

Comment 12

[Tanner M. Young [:tmyoung]]

Verified Fixed.

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.3a4pre) Gecko/20100317 Minefield/3.7a4pre (.NET CLR 3.5.30729) ID:20100317041424