717568 - Crash @ js::GetPropertyOperation

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Scoobidiver (away)]

It first appeared in 12.0a1/20120110.
The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=cf8c9f9aeefc&tochange=c713003d3226

Signature 	js::GetPropertyOperation(JSContext*, unsigned char*, JS::Value const&, JS::Value*) More Reports Search
UUID	c0bb8aa9-11ff-46c4-896f-142aa2120112
Date Processed	2012-01-12 02:49:10.375201
Uptime	605
Last Crash	14.7 hours before submission
Install Age	14.7 hours since version was first installed.
Install Time	2012-01-11 20:04:46
Product	Firefox
Version	12.0a1
Build ID	20120111031049
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7600
Build Architecture	amd64
Build Architecture Info	family 15 model 107 stepping 2
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x1e0002
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x6739, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.892.0.0
D2D? D2D+
DWrite? DWrite+
D3D10 Layers? D3D10 Layers+
EMCheckCompatibility	True

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	js::GetPropertyOperation 	js/src/jsinterpinlines.h:271
1 	xul.dll 	CallResolveOp 	js/src/jsobj.cpp:4967
2 	xul.dll 	js::Wrapper::get 	js/src/jswrapper.cpp:230
3 	xul.dll 	js::mjit::stubs::GetProp 	js/src/methodjit/StubCalls.cpp:1209
4 	xul.dll 	js::GetPropertyHelper 	js/src/jsobj.cpp:5471
5 	xul.dll 	js::mjit::EnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:1051
6 	xul.dll 	CheckStackAndEnterMethodJIT 	js/src/methodjit/MethodJIT.cpp:1109
7 	xul.dll 	js::Interpret 	js/src/jsinterp.cpp:3050
8 	xul.dll 	SearchTable 	obj-firefox/xpcom/build/pldhash.cpp:472
9 	xul.dll 	js_PutArgsObject 	js/src/jsfun.cpp:245
10 	xul.dll 	PL_DHashTableOperate 	obj-firefox/xpcom/build/pldhash.cpp:625
11 	xul.dll 	`anonymous namespace'::CSSParserImpl::ParseVariant 	layout/style/nsCSSParser.cpp:4681
12 	xul.dll 	nsCSSScanner::Next 	layout/style/nsCSSScanner.cpp:837

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3AGetPropertyOperation%28JSContext*%2C%20unsigned%20char*%2C%20JS%3A%3AValue%20const%26%2C%20JS%3A%3AValue*%29

Comment 1

[Marcia Knous [:marcia]]

Adding the mac specific signature which seems to be 10.7 specific.

Comment 2

[David Mandelin [:dmandelin]]

Looks like it hasn't happened since Jan 11 builds.

Comment 3

[Scoobidiver (away)]

It's #21 top browser crasher in 15.0a2 and #38 in 16.0a1.

The first frames of the stack are various.

It's correlated to Firebug in 15.0a2:
js::GetPropertyOperation(JSContext*, unsigned char*, JS::Value const&, JS::Value*)|EXCEPTION_ACCESS_VIOLATION_READ (16 crashes)
     81% (13/16) vs.   3% (118/4167) [e-mail] (Firebug, https://addons.mozilla.org/addon/1843)
     50% (8/16) vs.  13% (533/4167) {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} (Adblock Plus, https://addons.mozilla.org/addon/1865)
     31% (5/16) vs.   4% (175/4167) {e4a8a97b-f2ed-450b-b12d-ee082ba24781} (Greasemonkey, https://addons.mozilla.org/addon/748)
     25% (4/16) vs.   1% (45/4167) {a7c6cf7f-112c-4500-a7ea-39801a327e5f} (FireFTP, https://addons.mozilla.org/addon/684)

Comment 4

[Alex Keybl [:akeybl]]

This will likely drop off after Nightly/Aurora, but let's fix since this is highly correlated to the popular Firebug dev add-on.

Comment 5

[David Mandelin [:dmandelin]]

If the regression range is right, it's probably bug 712714. It looks like the most common case is an NPE in GetPropertyOperation, where lval.isObject() is true, but lval.toObject() is null, which seems bad. Brian, could you take a look at this?

Comment 6

[Brian Hackett [Laid off!]]

Well, without STR there's basically nothing to do here.  If we're crashing while accessing a torn value (mismatched type/payload) then the problem is most likely in the JIT.  Bug 712714 added GetPropertyOperation (refactoring duplicated code in the interp and stub calls) so these crashes are likely morphed from another signature that predated 712714.

Comment 7

[David Mandelin [:dmandelin]]

(In reply to Brian Hackett (:bhackett) from comment #6)
> Well, without STR there's basically nothing to do here.  If we're crashing
> while accessing a torn value (mismatched type/payload) then the problem is
> most likely in the JIT.  Bug 712714 added GetPropertyOperation (refactoring
> duplicated code in the interp and stub calls) so these crashes are likely
> morphed from another signature that predated 712714.

OK, thanks. If it's most likely in the JIT, then it would be near impossible to attack without STR. The crash does exist in Release, but it's #231. It's #21 on Aurora, but that is a much smaller data set. So, I'm inclined to say there's nothing to unless it rises in frequency on the Beta channel. Alex and Scoobidiver, does that sound right to you?

Comment 8

[Scoobidiver (away)]

(In reply to David Mandelin from comment #7)
> The crash does exist in Release, but it's #231. It's #21 on Aurora, but that is
> a much smaller data set. So, I'm inclined to say there's nothing to unless it
> rises in frequency on the Beta channel. Alex and Scoobidiver, does that sound
> right to you?
Aurora and Beta populations are usually representative of the Release population, except when it's correlated to some pieces of software such as Trusteer Rapport. I also checked there are no dupes. So it's a valid top crasher.

One comment says: "trying print a document on global research when crash occured"

It's still mainly correlated to Firebug:
js::GetPropertyOperation(JSContext*, unsigned char*, JS::Value const&, JS::Value*)|EXCEPTION_ACCESS_VIOLATION_READ (28 crashes)
     82% (23/28) vs.   3% (198/6506) [e-mail] (Firebug, https://addons.mozilla.org/addon/1843)
     25% (7/28) vs.   1% (96/6506) {c45c406e-ab73-11d8-be73-000a95be3b12} (Web Developer, https://addons.mozilla.org/addon/60)
     18% (5/28) vs.   0% (11/6506) [e-mail]
     18% (5/28) vs.   2% (128/6506) {46551EC9-40F0-4e47-8E18-8E5CF550CFB8} (Stylish, https://addons.mozilla.org/addon/2108)
     14% (4/28) vs.   0% (16/6506) {d47a9f51-8281-43fa-f450-f28ef8735e9a} (Pixlr, https://addons.mozilla.org/addon/9924)
     14% (4/28) vs.   0% (29/6506) [e-mail] (Rainbow, https://addons.mozilla.org/addon/14328)
     21% (6/28) vs.   8% (514/6506) {b9db16a4-6edc-47ec-a1f4-b86292ed211d} (Video DownloadHelper, https://addons.mozilla.org/addon/3006)
     25% (7/28) vs.  12% (762/6506) {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} (Adblock Plus, https://addons.mozilla.org/addon/1865)

Comment 9

[Marcia Knous [:marcia]]

js::GetPropertyOperation(JSContext*, unsigned char*, JS::Value const&, JS::Value*) ranks as #19 currently on Aurora. js::GetPropertyOperation does not show in the top crash list for Aurora. Adding some URLs to see if we can repro.

Here are some URLs from Aurora:

Total Count 	URL
16 	https://www.facebook.com/
10 	about:blank
10 	http://www.facebook.com/
3 	http://www.tumblr.com/dashboard
2 	https://twitter.com/#!/
2 	http://www.facebook.com/media/set/?set=a.10150934429517976.439092.640092975&type
2 	http://my.dev.zippyq.com/first_login.php
2 	https://mail.google.com/mail/?shva=1#inbox
1 	http://apps.facebook.com/tlx_easteregghunt/?fb_source=bookmark_apps&ref=bookmark
1 	http://school.cucas.edu.cn/HomePage/171/2010-09-25/Program_25666.shtml
1 	http://prom.ua/price-prom_ua.xls
1 	http://letitbit.net/download4.php
1 	http://www.youtube.com/watch?v=0nclGS7OVXY&feature=related
1 	http://sistemas.upsin.edu.mx/sistemas/
1 	http://www.egyhacks.net/
1 	https://www.facebook.com/login.php?login_attempt=1
1 	http://ask.shiksha.com/messageBoard/MsgBoard/discussionHome/9/1/1/answer/
1 	http://8tracks.com/emilijonas/anybody-can-pilot-a-ship-when-the-sea-is-calm
1       http://www.facebook.com/frederic.saam

More sites with 1 crash each:
https://www.facebook.com/ajax/pagelet/generic.php/ProfileTimelineSectionPagelet?
http://www.google.ru/
http://dortmundfanatics.hu/df_admin/index.php
https://www.facebook.com/ajax/pagelet/generic.php/ProfileTimelineSectionPagelet?
http://www.youtube.com/watch?v=mFRnTFXUga8&feature=related
http://search.babylon.com/?babsrc=NT_FFUP
http://dev2.theweald.org.uk/homework/task/1369
http://dc597.4shared.com/download/0fPQt-Do/4Sync-1054m.exe
https://www.google.de/#hl=de&safe=off&sclient=psy-ab&q=g%C3%BCrtel+schl%C3%A4ge&
http://fun7.blog.hu/
https://www.facebook.com/photo.php?fbid=402996759742249&set=a.402996259742299.86
http://www.facebook.com/eqgaming
http://www.facebook.com/ajax/pagelet/generic.php/ProfileTimelineSectionPagelet?_
https://www.facebook.com/pooja.ojha.982?ref=ts
http://wbm2-0.task.com.br/?_task=mail
http://www.aten.com/products/productItem.php?model_no=IP8000
https://www.facebook.com/pokes?ref=notif&notif_t=poke&__a=1&ajaxpipe=1&ajaxpipe_
https://www.facebook.com/mike.shadowrocker
http://www.filecrop.com/puzzle-bobble.jar.html
http://8tracks.com/khangaroospouch/real
http://en.wikipedia.org/wiki/Denmark_national_football_team#Current_squad
http://www.facebook.com/messages/568474021
http://www.odnoklassniki.ru/sashka..sanduletzu

Comment 10

[u279076]

Does this require any specific hardware? is a discrete GPU required to reproduce this crash?

Comment 11

[Marcia Knous [:marcia]]

Here is some additional information from crash-stats regarding the Windows signature - most of the crashes in this signature in the last week are occurring on 13.0.1

Operating System 	Percentage 	Number Of Crashes
Windows XP 	          71.363 %	466
Windows 7 	          25.574 %	167
Windows Vista 	           1.991 %	13
Windows 8 	           0.766 %	5
Windows Unknown 	   0.306 %	2 

Architecture 	Percentage 	Number Of Crashes
x86 	           99.847 % 	652
amd64 	            0.153 % 	1 

I will look in the crash-analysis directory to see if there is any other useful information.

Comment 12

[u279076]

I've been unable to reproduce any crashes so far. I'm using Firefox 13.0.1 with Java 7u5 and Flash 11.3.300.262 installed in Windows XP SP2 32-bit. I installed all the addons in comment 8.

Websites Tested:
 * Facebook
 * Twitter
 * Tumblr
 * YouTube

I've tried browsing around, loading plug-in content, printing different pages, print preview, and session restore with video playing and downloading. So far I've hit no crashes in the last hour.

Comment 13

[Marcia Knous [:marcia]]

Looking at 13.0.1 data, I do see a 22% (13/60) vs.  16% (27190/174192) aswJsFlt.dll - this is an Avast Antivirus dll.

Comment 14

[Scoobidiver (away)]

This bug is tracked for the spike of crashes beginning in 15.0a1, so trying to reproduce the issue on 13.0.1 isn't relevant.

The spike is gone after 16.0a1/20120622 and 15.0a2/20120625. The working ranges are:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=da85d45f39ef&tochange=bb4b37094b9f
http://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?fromchange=07c03ce3989c&tochange=cc068ba06631
I see no JS fix in common!

Comment 15

[Alex Keybl [:akeybl]]

Actually, I'm not sure there's a need to track spiking crashes. They deserve their own categorization (for now I'm adding [spiked] to the whiteboard).

Comment 16

[Scoobidiver (away)]

It's #9 top browser crasher in 18.0a2.

This spike is correlated to Yandex Bar like in bug 770238 and bug 698296:
     93% (43/46) vs.   6% (145/2256) [e-mail] (Yandex.Bar, https://addons.mozilla.org/addon/3495)
          2% (1/46) vs.   0% (1/2256) 6.6
          2% (1/46) vs.   0% (1/2256) 6.8
         13% (6/46) vs.   1% (13/2256) 6.9.1
          7% (3/46) vs.   1% (14/2256) 7.1.1
          9% (4/46) vs.   1% (12/2256) 7.2
         11% (5/46) vs.   0% (10/2256) 7.2.1
          7% (3/46) vs.   0% (5/2256) 7.2.2
         41% (19/46) vs.   4% (86/2256) 7.2.3
          2% (1/46) vs.   0% (2/2256) 7.2.4
     65% (30/46) vs.   5% (108/2256) [e-mail]
          7% (3/46) vs.   1% (14/2256) 1.1
         30% (14/46) vs.   3% (64/2256) 1.3
          2% (1/46) vs.   0% (8/2256) 2.0
         20% (9/46) vs.   1% (17/2256) 2.0.1
          7% (3/46) vs.   0% (5/2256) 2.0.2
     13% (6/46) vs.   1% (28/2256) {B100D0FF-0001-8CE4-2790-AACE49B8AE35} (3.5.11)

Comment 17

[Alex Keybl [:akeybl]]

Let's see if this signature movement carries over into Beta 18. I'm not sure that tracking this will really get us any further traction with engineering, given how much of a longstanding issue this has been.

Comment 18

[Alex Keybl [:akeybl]]

(Additionally, QA has been doing significant exploratory testing around Yandex without running into any of these crashes thus far)

Comment 19

[Manuela Muntean [Away]]

I tried to reproduce the crash using the add-ons specified in comment 8 and the sites specified in comment 12, but I was unsuccessful. I've tried browsing around, loading websites with plug-in content, session restore with video playing and downloading, but no crash occurred.

Firefox 15 beta 1
User Agent: Mozilla/5.0 (Windows NT 6.1; rv:15.0) Gecko/20100101 Firefox/15.0
Build ID: 20120717110313

Comment 20

[Alex Keybl [:akeybl]]

This crash is dropping significantly since the latest Yandex rollout. No need to track given that.

Comment 21

[Scoobidiver (away)]

It's #33 top browser crasher w/o hangs in 17.0, #29 in 18.0b1 and #85 in 19.0a2 so no longer a top crasher (arbitrary restricted to the top 20).

Comment 22

[Robert Kaiser]

Marking as topcrash because it's #19 on 18.0b4 desktop.

Comment 23

[Scoobidiver (away)]

It's a period where it's not a top crasher: #57 in 19.0, #45 in 20.0b1.

Comment 24

[Manuela Muntean [Away]]

There aren't any reports regarding the 3rd signature of this bug, within last month:  [@ js::GetPropertyOperation(JSContext*, JSScript*, unsigned char*, JS::Value const&, JS::Value*)].


I found some crash reports within last month, on Firefox 19, 20 beta 1 and 20 beta 2, regarding the 5th signature,  [@ js::GetPropertyOperation(JSContext*, JSScript*, unsigned char*, JS::MutableHandle<JS::Value>, JS::MutableHandle<JS::Value>)]. Reports are available here: https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&query=js%3A%3AGetPropertyOperation%28JSContext%2A%2C%20JSScript%2A%2C%20unsigned%20char%2A%2C%20JS%3A%3AMutableHandle%26lt%3BJS%3A%3AValue%26gt%3B%2C%20JS%3A%3AMutableHandle%26lt%3BJS%3A%3AValue%26gt%3B%29&reason_type=contains&date=03%2F04%2F2013%2007%3A10%3A28&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=js%3A%3AGetPropertyOperation%28JSContext%2A%2C%20JSScript%2A%2C%20unsigned%20char%2A%2C%20JS%3A%3AMutableHandle%3CJS%3A%3AValue%3E%2C%20JS%3A%3AMutableHandle%3CJS%3A%3AValue%3E%29


Regarding the other signatures, I didn't find any reports within last month, that impacted Firefox 19, 20 beta 1 or 20 beta 2.

Reports are available here: 

https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&query=js%3A%3AGetPropertyOperation%28JSContext%2A%2C%20unsigned%20char%2A%2C%20JS%3A%3AValue%20const%26amp%3B%2C%20JS%3A%3AValue%2A%29&reason_type=contains&date=03%2F04%2F2013%2007%3A10%3A21&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=js%3A%3AGetPropertyOperation%28JSContext%2A%2C%20unsigned%20char%2A%2C%20JS%3A%3AValue%20const%26%2C%20JS%3A%3AValue%2A%29

https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&query=js%3A%3AGetPropertyOperation%28JSContext%2A%2C%20JSScript%2A%2C%20unsigned%20char%2A%2C%20JS%3A%3AValue%26amp%3B%2C%20JS%3A%3AValue%2A%29&reason_type=contains&date=03%2F04%2F2013%2007%3A10%3A26&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=js%3A%3AGetPropertyOperation%28JSContext%2A%2C%20JSScript%2A%2C%20unsigned%20char%2A%2C%20JS%3A%3AValue%26%2C%20JS%3A%3AValue%2A%29

https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&query=js%3A%3AGetPropertyOperation%28JSContext%2A%2C%20unsigned%20char%2A%2C%20JS%3A%3AMutableHandle%26lt%3BJS%3A%3AValue%26gt%3B%2C%20JS%3A%3AMutableHandle%26lt%3BJS%3A%3AValue%26gt%3B%29&reason_type=contains&date=03%2F04%2F2013%2007%3A10%3A28&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=js%3A%3AGetPropertyOperation%28JSContext%2A%2C%20unsigned%20char%2A%2C%20JS%3A%3AMutableHandle%3CJS%3A%3AValue%3E%2C%20JS%3A%3AMutableHandle%3CJS%3A%3AValue%3E%29

https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&query=js%3A%3AGetPropertyOperation&reason_type=contains&date=03%2F04%2F2013%2007%3A10%3A29&range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&signature=js%3A%3AGetPropertyOperation

Comment 25

[Mihai Morar, (:MihaiMorar)]

(In reply to Manuela Muntean [:Manuela] [QA] from comment #24)

> Regarding the other signatures, I didn't find any reports within last month,
> that impacted Firefox 19, 20 beta 1 or 20 beta 2.
> 
> Reports are available here: 
> 
> https://crash-stats.mozilla.com/report/
> list?product=Firefox&query_search=signature&query_type=contains&query=js%3A%3
> AGetPropertyOperation%28JSContext%2A%2C%20unsigned%20char%2A%2C%20JS%3A%3AVal
> ue%20const%26amp%3B%2C%20JS%3A%3AValue%2A%29&reason_type=contains&date=03%2F0
> 4%2F2013%2007%3A10%3A21&range_value=4&range_unit=weeks&hang_type=any&process_
> type=any&do_query=1&signature=js%3A%3AGetPropertyOperation%28JSContext%2A%2C%
> 20unsigned%20char%2A%2C%20JS%3A%3AValue%20const%26%2C%20JS%3A%3AValue%2A%29
> 
> https://crash-stats.mozilla.com/report/
> list?product=Firefox&query_search=signature&query_type=contains&query=js%3A%3
> AGetPropertyOperation%28JSContext%2A%2C%20JSScript%2A%2C%20unsigned%20char%2A
> %2C%20JS%3A%3AValue%26amp%3B%2C%20JS%3A%3AValue%2A%29&reason_type=contains&da
> te=03%2F04%2F2013%2007%3A10%3A26&range_value=4&range_unit=weeks&hang_type=any
> &process_type=any&do_query=1&signature=js%3A%3AGetPropertyOperation%28JSConte
> xt%2A%2C%20JSScript%2A%2C%20unsigned%20char%2A%2C%20JS%3A%3AValue%26%2C%20JS%
> 3A%3AValue%2A%29
> 
> https://crash-stats.mozilla.com/report/
> list?product=Firefox&query_search=signature&query_type=contains&query=js%3A%3
> AGetPropertyOperation%28JSContext%2A%2C%20unsigned%20char%2A%2C%20JS%3A%3AMut
> ableHandle%26lt%3BJS%3A%3AValue%26gt%3B%2C%20JS%3A%3AMutableHandle%26lt%3BJS%
> 3A%3AValue%26gt%3B%29&reason_type=contains&date=03%2F04%2F2013%2007%3A10%3A28
> &range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&sig
> nature=js%3A%3AGetPropertyOperation%28JSContext%2A%2C%20unsigned%20char%2A%2C
> %20JS%3A%3AMutableHandle%3CJS%3A%3AValue%3E%2C%20JS%3A%3AMutableHandle%3CJS%3
> A%3AValue%3E%29
> 
> https://crash-stats.mozilla.com/report/
> list?product=Firefox&query_search=signature&query_type=contains&query=js%3A%3
> AGetPropertyOperation&reason_type=contains&date=03%2F04%2F2013%2007%3A10%3A29
> &range_value=4&range_unit=weeks&hang_type=any&process_type=any&do_query=1&sig
> nature=js%3A%3AGetPropertyOperation

None of these URLs don't provide any crashes for a higher version than FF 18. There are indeed a couple of crashes for:

js::GetPropertyOperation(JSContext*, JSScript*, unsigned char*, JS::MutableHandle<JS::Value>, JS::MutableHandle<JS::Value>) but the most recent of them are on Aurora 21 and Nightly 22. No crashes found for latest versions of Nightly, Aurora or Beta/RC

Comment 26

[Scoobidiver (away)]

It's #41 browser crasher in 22.0 and #100 in 23.0b9.

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3AGetPropertyOperation%28JSContext*%2C+JSScript*%2C+unsigned+char*%2C+JS%3A%3AMutableHandle%3CJS%3A%3AValue%3E%2C+JS%3A%3AMutableHandle%3CJS%3A%3AValue%3E%29

Comment 27

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 28

[vamsi]

thanks for information

http://www.cbse10thresults-2019.xyz