1108345 - Pentadactyl crashes when using Firefox 35 [@ js::ToBooleanSlow(JS::Handle<JS::Value>) ]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Florent Fayolle]

Attachment: pentadactyl-20141011.xpi

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0
Build ID: 20141201162954

Steps to reproduce:

1. Install this version of the Pentadactyl addon (latest nightly of pentadactyl with the maxVersion of the install.rdf file modified)
2. Put the .pentadatylrc this file in your home ($HOME on Linux)
3. Restart Firefox
4. Open two tabs
5. Use Shift-H


Actual results:

Firefox crashes


Expected results:

The user should switch to another tab.

Florent

Comment 1

[Florent Fayolle]

Attachment: .pentadactylrc

Comment 2

[Florent Fayolle]

The crash report is given here:
https://crash-stats.mozilla.com/report/index/8e92421a-36f5-4be1-a3a3-e2c622141207

Kris: I took the liberty to cc you since I know you are one of the maintainer of the addon.

Florent

Comment 3

[Kevin Brosnan [Ex-Mozilla]]

Is this something that the JS engine should own?

Comment 4

[Brian Hackett [Laid off!]]

It's crashing in JS, yeah.  Can you reproduce this?  Is there a blame cset?

Comment 5

[Florent Fayolle]

Brian, who are you asking that question? (the needinfo flag is unset)
I can bisect the regression using mozregression to get a date of a nightly, but I can't bisect more if I have to compile. Are you interested?

Florent

Comment 6

[Andrew McCreight [:mccr8]]

Getting it down to a particular Nightly would be a good first step.

Comment 7

[Florent Fayolle]

> Getting it down to a particular Nightly would be a good first step.

OK, will do that.

Florent

Comment 8

[Florent Fayolle]

Oops, sorry, wrong modifications...

Florent

Comment 9

[Florent Fayolle]

The regression occurred in the nightly of 2014-09-16. I will continue bisecting tomorrow, but here is a regression range:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=d295c8ec&tochange=bb579e3d

Oddly, in that link, there are commits of Wed Sep 17. Is that normal?

Florent

Comment 10

[Florent Fayolle]

Here is a tinier range of commits:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=ed5f95178615&tochange=fada58fb0996

Florent

Comment 11

[Kevin Brosnan [Ex-Mozilla]]

[Tracking Requested - why for this release]: regression

Comment 12

[Kevin Brosnan [Ex-Mozilla]]

Needinfo is to look at this bug and see if this is something for the JS team to fix or is the extension doing something bad?

Comment 13

[Shu-yu Guo [:shu]]

I can't reproduce this with STR on Nightly, and I see this message during loading.

pentadactyl: Loading base: TypeError: iter[Symbol.iterator] is not a function

pentadactyl: bootstrap: TypeError: iter[Symbol.iterator] is not a function
map@resource://dactyl/bootstrap.jsm -> resource://dactyl/base.jsm:1622:1
toObject@resource://dactyl/bootstrap.jsm -> resource://dactyl/base.jsm:1563:17
iterProto[k]@resource://dactyl/bootstrap.jsm -> resource://dactyl/base.jsm:1869:19
deprecated@resource://dactyl/bootstrap.jsm -> resource://dactyl/base.jsm:331:31
@resource://dactyl/bootstrap.jsm -> resource://dactyl/base.jsm:1900:1
loadSubScript@resource://dactyl/bootstrap.jsm:20:26
_load@resource://gre/modules/addons/XPIProvider.jsm -> jar:file:///home/shu/moz/central/obj-dbg/tmp/scratch_user/extensions/[e-mail]!/bootstrap.js:137:17
load@resource://gre/modules/addons/XPIProvider.jsm -> jar:file:///home/shu/moz/central/obj-dbg/tmp/scratch_user/extensions/[e-mail]!/bootstrap.js:160:17
init@resource://gre/modules/addons/XPIProvider.jsm -> jar:file:///home/shu/moz/central/obj-dbg/tmp/scratch_user/extensions/[e-mail]!/bootstrap.js:261:25
startup@resource://gre/modules/addons/XPIProvider.jsm -> jar:file:///home/shu/moz/central/obj-dbg/tmp/scratch_user/extensions/[e-mail]!/bootstrap.js:366:13
XPI_callBootstrapMethod@resource://gre/modules/addons/XPIProvider.jsm:4436:9
XPI_startup@resource://gre/modules/addons/XPIProvider.jsm:2160:13
callProvider@resource://gre/modules/AddonManager.jsm:208:12
_startProvider@resource://gre/modules/AddonManager.jsm:667:5
AMI_startup@resource://gre/modules/AddonManager.jsm:821:9
AMP_startup@resource://gre/modules/AddonManager.jsm:2399:5
AMC_observe@file:///home/shu/moz/central/obj-dbg/dist/bin/components/addonManager.js:55:7

So I guess it's not loading the xpi. Let me build beta I guess...

Comment 14

[Shu-yu Guo [:shu]]

The crash is caused by not backporting bug 1077949. I rolled up a patch and requested backport in that bug.

Note that while that fixes the crash, the addon needs to be fixed as well. It has a temporal dead zone violation (accessing a 'let' binding before initializing it).

Comment 15

[Sylvestre Ledru [:Sylvestre]]

Regression plus crashing, tracking.

Comment 16

[Lukas Blakk [:lsblakk] use ?needinfo]

Fixed in bug 1077949, resolving this bug.  The issues with the addon should be tracked by that addon developer.