Closed Bug 1045933 Opened 10 years ago Closed 10 years ago

[e10s] "FindBar Tweaks" add-on crashes Gmail [@ UrgentMessageCheck ]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
30 Branch
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1042587
Tracking Flags:
Tracking Status
e10s + ---
firefox34 --- affected

People

(Reporter: cpeterson, Unassigned)

References

Details

(Keywords: crash, regression, reproducible)

STR: 1. In an e10s window, log into gmail. 2. bp-b311c467-e43b-4cc5-b37b-9aab12140729 bp-b311c467-e43b-4cc5-b37b-9aab12140729 bp-c74d5be9-ff4e-4666-befe-e6fda2140729 bp-a0e6bf26-b308-4cd2-b935-888872140729 0 XUL UrgentMessageCheck js/ipc/JavaScriptChild.cpp 1 XUL js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp 2 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/vm/Interpreter.cpp 3 XUL js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 4 XUL js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const js/src/jsproxy.cpp 5 XUL js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) js/src/jsproxy.cpp 6 XUL js::proxy_Call(JSContext*, unsigned int, JS::Value*) js/src/jsproxy.cpp 7 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/jscntxtinlines.h 8 XUL js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 9 XUL JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) js/src/jsapi.cpp 10 XUL mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) obj-firefox/x86_64/dom/bindings/EventListenerBinding.cpp 11 XUL void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, mozilla::dom::CallbackObject::ExceptionHandling) obj-firefox/x86_64/dist/include/mozilla/dom/EventListenerBinding.h 12 XUL mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) dom/events/EventListenerManager.cpp 13 XUL mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) dom/events/EventListenerManager.cpp 14 XUL mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) dom/events/EventDispatcher.cpp 15 XUL mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsCOMArray<mozilla::dom::EventTarget>*) dom/events/EventDispatcher.cpp 16 XUL mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, nsIDOMEvent*, nsPresContext*, nsEventStatus*) dom/events/EventDispatcher.cpp 17 XUL nsINode::DispatchEvent(nsIDOMEvent*, bool*) content/base/src/nsINode.cpp 18 XUL mozilla::AsyncEventDispatcher::Run() dom/events/AsyncEventDispatcher.cpp 19 XUL nsContentUtils::RemoveScriptBlocker() content/base/src/nsContentUtils.cpp 20 XUL mozilla::dom::Element::SetAttr(int, nsIAtom*, nsIAtom*, nsAString_internal const&, bool) obj-firefox/x86_64/dist/include/nsContentUtils.h 21 XUL nsGenericHTMLElement::SetAttr(int, nsIAtom*, nsIAtom*, nsAString_internal const&, bool) content/html/content/src/nsGenericHTMLElement.cpp 22 XUL mozilla::dom::HTMLSharedElement::SetAttr(int, nsIAtom*, nsIAtom*, nsAString_internal const&, bool) content/html/content/src/HTMLSharedElement.cpp 23 XUL mozilla::dom::Element::SetAttribute(nsAString_internal const&, nsAString_internal const&, mozilla::ErrorResult&) obj-firefox/x86_64/dist/include/mozilla/dom/Element.h 24 XUL mozilla::dom::ElementBinding::setAttribute obj-firefox/x86_64/dom/bindings/ElementBinding.cpp 25 XUL mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) dom/bindings/BindingUtils.cpp 26 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/jscntxtinlines.h 27 XUL js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 28 XUL js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const js/src/jsproxy.cpp 29 XUL js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) js/src/jsproxy.cpp 30 XUL js::proxy_Call(JSContext*, unsigned int, JS::Value*) js/src/jsproxy.cpp 31 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/jscntxtinlines.h 32 XUL js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 33 XUL JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) js/src/jsapi.cpp 34 XUL mozilla::jsipc::WrapperAnswer::AnswerCallOrConstruct(unsigned long long const&, nsTArray<mozilla::jsipc::JSParam> const&, bool const&, mozilla::jsipc::ReturnStatus*, mozilla::jsipc::JSVariant*, nsTArray<mozilla::jsipc::JSParam>*) js/ipc/WrapperAnswer.cpp 35 XUL _ZThn24_N7mozilla5jsipc14JavaScriptBaseINS0_16PJavaScriptChildEE21AnswerCallOrConstructERKyRK8nsTArrayINS0_7JSParamEERKbPNS0_12ReturnStatusEPNS0_9JSVariantEPS8_ js/ipc/JavaScriptBase.h 36 XUL mozilla::jsipc::PJavaScriptChild::OnCallReceived(IPC::Message const&, IPC::Message*&) obj-firefox/x86_64/ipc/ipdl/PJavaScriptChild.cpp 37 XUL mozilla::ipc::MessageChannel::DispatchUrgentMessage(IPC::Message const&) ipc/glue/MessageChannel.cpp 38 XUL mozilla::ipc::MessageChannel::ProcessPendingUrgentRequest() ipc/glue/MessageChannel.cpp 39 XUL mozilla::ipc::MessageChannel::SendAndWait(IPC::Message*, IPC::Message*) ipc/glue/MessageChannel.cpp 40 XUL mozilla::ipc::MessageChannel::RPCCall(IPC::Message*, IPC::Message*) ipc/glue/MessageChannel.cpp 41 XUL mozilla::ipc::MessageChannel::Call(IPC::Message*, IPC::Message*) ipc/glue/MessageChannel.cpp 42 XUL mozilla::dom::PBrowserChild::CallRpcMessage(nsString const&, mozilla::dom::ClonedMessageData const&, nsTArray<mozilla::jsipc::CpowEntry> const&, IPC::Principal const&, nsTArray<nsString>*) obj-firefox/x86_64/ipc/ipdl/PBrowserChild.cpp 43 XUL mozilla::dom::TabChild::DoSendBlockingMessage(JSContext*, nsAString_internal const&, mozilla::dom::StructuredCloneData const&, JS::Handle<JSObject*>, nsIPrincipal*, nsTArray<nsString>*, bool) dom/ipc/TabChild.cpp 44 XUL _ZThn56_N7mozilla3dom8TabChild21DoSendBlockingMessageEP9JSContextRK18nsAString_internalRKNS0_19StructuredCloneDataEN2JS6HandleIP8JSObjectEEP12nsIPrincipalP8nsTArrayI8nsStringEb obj-firefox/x86_64/dom/ipc/Unified_cpp_dom_ipc0.cpp 45 XUL nsFrameMessageManager::SendMessage(nsAString_internal const&, JS::Handle<JS::Value>, JS::Handle<JS::Value>, nsIPrincipal*, JSContext*, unsigned char, JS::MutableHandle<JS::Value>, bool) content/base/src/nsFrameMessageManager.cpp 46 XUL nsFrameMessageManager::SendRpcMessage(nsAString_internal const&, JS::Handle<JS::Value>, JS::Handle<JS::Value>, nsIPrincipal*, JSContext*, unsigned char, JS::MutableHandle<JS::Value>) content/base/src/nsFrameMessageManager.cpp 47 XUL NS_InvokeByIndex xpcom/reflect/xptcall/md/unix/xptcinvoke_x86_64_unix.cpp 48 XUL XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) js/xpconnect/src/XPCWrappedNative.cpp 49 XUL XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) js/xpconnect/src/XPCWrappedNativeJSOps.cpp 50 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/jscntxtinlines.h 51 XUL js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 52 XUL js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const js/src/jsproxy.cpp 53 XUL js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) js/src/jsproxy.cpp 54 XUL js::proxy_Call(JSContext*, unsigned int, JS::Value*) js/src/jsproxy.cpp 55 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/jscntxtinlines.h 56 XUL Interpret js/src/vm/Interpreter.cpp 57 XUL js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp 58 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/vm/Interpreter.cpp 59 XUL js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 60 XUL js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const js/src/jsproxy.cpp 61 XUL js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) js/src/jsproxy.cpp 62 XUL js::proxy_Call(JSContext*, unsigned int, JS::Value*) js/src/jsproxy.cpp 63 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/jscntxtinlines.h 64 XUL js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 65 XUL JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) js/src/jsapi.cpp 66 XUL nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) js/xpconnect/src/XPCWrappedJSClass.cpp 67 XUL PrepareAndDispatch xpcom/reflect/xptcall/md/unix/xptcstubs_x86_64_darwin.cpp 68 XUL SharedStub 69 XUL mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) dom/events/EventListenerManager.cpp 70 XUL mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) dom/events/EventListenerManager.cpp 71 XUL mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) dom/events/EventDispatcher.cpp 72 XUL mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsCOMArray<mozilla::dom::EventTarget>*) dom/events/EventDispatcher.cpp 73 XUL PresShell::HandleEventInternal(mozilla::WidgetEvent*, nsEventStatus*) layout/base/nsPresShell.cpp 74 XUL PresShell::HandleEventWithTarget(mozilla::WidgetEvent*, nsIFrame*, nsIContent*, nsEventStatus*) layout/base/nsPresShell.cpp 75 XUL mozilla::EventStateManager::CheckForAndDispatchClick(nsPresContext*, mozilla::WidgetMouseEvent*, nsEventStatus*) dom/events/EventStateManager.cpp 76 XUL mozilla::EventStateManager::PostHandleEvent(nsPresContext*, mozilla::WidgetEvent*, nsIFrame*, nsEventStatus*) dom/events/EventStateManager.cpp 77 XUL PresShell::HandleEventInternal(mozilla::WidgetEvent*, nsEventStatus*) layout/base/nsPresShell.cpp 78 XUL PresShell::HandlePositionedEvent(nsIFrame*, mozilla::WidgetGUIEvent*, nsEventStatus*) layout/base/nsPresShell.cpp 79 XUL PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) layout/base/nsPresShell.cpp 80 XUL nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*) view/src/nsViewManager.cpp 81 XUL nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool) view/src/nsView.cpp 82 XUL mozilla::widget::PuppetWidget::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&) widget/xpwidgets/PuppetWidget.cpp 83 XUL mozilla::dom::TabChild::RecvRealMouseEvent(mozilla::WidgetMouseEvent const&) dom/ipc/TabChild.cpp 84 XUL _ZThn296_N7mozilla3dom8TabChild18RecvRealMouseEventERKNS_16WidgetMouseEventE obj-firefox/x86_64/dom/ipc/Unified_cpp_dom_ipc0.cpp 85 XUL mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) obj-firefox/x86_64/ipc/ipdl/PBrowserChild.cpp 86 XUL mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) obj-firefox/x86_64/ipc/ipdl/PContentChild.cpp 87 XUL mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) ipc/glue/MessageChannel.cpp 88 XUL mozilla::ipc::MessageChannel::OnMaybeDequeueOne() ipc/glue/MessageChannel.cpp 89 XUL MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) ipc/chromium/src/base/message_loop.cc 104 XUL js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 105 XUL JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) js/src/jsapi.cpp 106 XUL nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) js/xpconnect/src/XPCWrappedJSClass.cpp 107 XUL PrepareAndDispatch xpcom/reflect/xptcall/md/unix/xptcstubs_x86_64_darwin.cpp 108 XUL SharedStub 109 XUL nsGlobalWindow::ShowSlowScriptDialog() dom/base/nsGlobalWindow.cpp 110 XUL XPCJSRuntime::InterruptCallback(JSContext*) js/xpconnect/src/XPCJSRuntime.cpp 111 XUL js::InvokeInterruptCallback(JSContext*) js/src/jscntxt.cpp 112 XUL js::jit::InterruptCheck(JSContext*) js/src/jscntxt.h 113 @0x1084c64a9
To reproduce this bug, you must install the "FindBar Tweaks" addon: https://addons.mozilla.org/en-US/firefox/addon/findbar-tweak/ With that addon installed, the following Google+ page also crashes in UrgentMessageCheck: https://plus.google.com/118001203734093179935/about?pid=5627255368058992850&oid=118001203734093179935
Blocks: 1003654
I bisected this crash to the following pushlog in Nightly 33 build 2014-07-19: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=99f694d1b50c&tochange=35f3fa435d2c I think we're hitting the assert from bug 1040726.
Blocks: 1040726
Keywords: regression
Severity: normal → critical
Summary: [e10s] gmail settings menu crash [@ UrgentMessageCheck ] → [e10s] "FindBar Tweaks" add-on crashes Gmail [@ UrgentMessageCheck ]
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.