1096496 - Tab crashes on bugzilla.mozilla.org when uploading an attachment

Status: RESOLVED DUPLICATE of bug 1086684

(Core :: General, defect)

Description

[u279076]

I was trying to report a bug and attach a screenshot to the bug but the e10s tab kept crashing. I crashed three times before I gave up and switched to non-e10s mode. 

All three crashes have the same signature:
> mozalloc_abort(char const*) | Abort | NS_DebugBreak | mozilla::ipc::MessageChannel::DebugAbort(char const*, int, char const*, char const*, bool) const | mozilla::ipc::MessageChannel::Send(IPC::Message*, IPC::Message*) 

Here is one of those crash reports:
https://crash-stats.mozilla.com/report/index/3a3dc1c7-ee64-4a92-83b1-6c0d22141110

Comment 1

[u279076]

There are many more reports here (all on Mac OS X):
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozalloc_abort%28char+const*%29+|+Abort+|+NS_DebugBreak+|+mozilla%3A%3Aipc%3A%3AMessageChannel%3A%3ADebugAbort%28char+const*%2C+int%2C+char+const*%2C+char+const*%2C+bool%29+const+|+mozilla%3A%3Aipc%3A%3AMessageChannel%3A%3ASend%28IPC%3A%3AMessage*%2C+IPC%3A%3AMessage*%29

Comment 2

[Boris Zbarsky [:bzbarsky]]

Anthony, are you able to do this in e10s mode on https://landfill.bugzilla.org/bugzilla-tip/ ?  Or is this bmo-specific?  Trying to find a way to reproduce without spamming bmo.  ;)

Comment 3

[u279076]

(In reply to Boris Zbarsky [:bz] from comment #2)
> Anthony, are you able to do this in e10s mode on
> https://landfill.bugzilla.org/bugzilla-tip/ ? 

Yes, this reproduces for me by trying to attach an image to a new bug report on bugzilla-tip.

Comment 4

[Stephen Donner [:stephend] Not actively reading bugmail]

Here's mine, from a similar scenario with Bugzilla today, on nightly (Windows 7): https://crash-stats.mozilla.com/report/index/4b96145d-2e27-4343-b4a4-e823b2141112

Comment 5

[Dave Hunt [:davehunt] [he/him] ⌚BST]

I've also seen this today:
https://crash-stats.mozilla.com/report/index/cdbd7311-8cfc-4338-ab9f-9220f2141112

Comment 6

[Boris Zbarsky [:bzbarsky]]

I've been trying to reproduce (on Mac) on landfill and failing so far.  :(

Anything interesting about the filenames of the images in question?

Comment 7

[Dave Hunt [:davehunt] [he/him] ⌚BST]

Attachment: Example attachment that caused the crash

(In reply to Boris Zbarsky [:bz] from comment #6)
> I've been trying to reproduce (on Mac) on landfill and failing so far.  :(
> 
> Anything interesting about the filenames of the images in question?

Attached is a patch that caused the tab crash for me even on landfill.bugzilla.org. Also, when this happens for me all other open tabs show the 'Tab crashed' message, requiring me to click 'Try Again' or in some cases reloading from the toolbar.

Comment 8

[Dave Hunt [:davehunt] [he/him] ⌚BST]

This might be a more generic issue - I just saw the same thing uploading a running activity to runkeeper.com

Comment 9

[Boris Zbarsky [:bzbarsky]]

> Attached is a patch that caused the tab crash for me even on landfill.bugzilla.org.

OK.  Could you please post _exact_ steps to reproduce?  Because these steps that I just followed in a current trunk debug build with a clean profile:

1)  Save attachment 8522898 [details] [diff] [review] to /Users/bzbarsky/bug1095751.patch
2)  Load https://landfill.bugzilla.org/bugzilla-tip/show_bug.cgi?id=2565 in the debug build
3)  Click the "Add an attachment" link.
4)  Log in (because it's a clean profile, so no cookies)
5)  Click the "Browse..." button.
6)  Select the file with the mouse in the file picker, click "Open" in the filepicker.
7)  Type "hello" in the "Description" field.
8)  Click "Submit"

do not cause a crash for me.

I also tried with 2014-11-16 nightly (opt build now), just in case, using the same steps.  Again, no crash.

So it would be really nice to have steps to reproduce that _do_ cause the crash.

> This might be a more generic issue   

Sure.  The reason it would be nice to reproduce on landfill is that no one cares if we upload a bunch of stuff there.  But I'll settle for reliable steps to reproduce on any site, really.

Comment 10

[Dave Hunt [:davehunt] [he/him] ⌚BST]

I'm also unable to replicate on latest nightly with a fresh profile. I can still replicate it with my default profile though. The steps are:

1. Log into landfill.bugzilla.org
2. Start creating a new bug
3. Select any file as an attachment

Comment 11

[Boris Zbarsky [:bzbarsky]]

OK.  Can you figure out what it is about your profile that triggers the crash?  Extensions?  Preferences?  Something else?

Comment 12

[Mike Conley (:mconley) (:⚙️)]

The people who are able to reproduce this bug - do you have the Lazarus form recovery add-on?

If so, this is likely a dupe of bug 1086684.

Comment 13

[Dave Hunt [:davehunt] [he/him] ⌚BST]

(In reply to Mike Conley (:mconley) - Needinfo me! from comment #12)
> The people who are able to reproduce this bug - do you have the Lazarus form
> recovery add-on?
> 
> If so, this is likely a dupe of bug 1086684.

I had Lazarus enabled. After disabling it I cannot reproduce the problem. I'll leave Anthony to resolve as a duplicate if this is the same for him.

Comment 14

[Boris Zbarsky [:bzbarsky]]

That's why I asked about clean profiles...  is this extension not installed in the profile?

Comment 15

[Dave Hunt [:davehunt] [he/him] ⌚BST]

(In reply to Please do not ask for reviews for a bit [:bz] from comment #14)
> That's why I asked about clean profiles...  is this extension not installed
> in the profile?

As I said in comment 10 I can't replicate with a clean profile, and in comment 14 I also said that I can't replicate it when I just disable the Lazarus addon. I can't speak for Anthony though.

Comment 16

[Boris Zbarsky [:bzbarsky]]

Oh, I see.  I had misread comment 10 just now, sorry!

Comment 17

[u279076]

I do not have the Lazarus add-on nor do I know what that is. When I reported this I was able to reproduce with a new profile. That said, I can no longer reproduce this in today's Nightly. Perhaps this has been inadvertently fixed for my use case.